Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
G

Overview

General Information

Sample Name:G (renamed file extension from none to dll)
Analysis ID:562446
MD5:630b6dad3884c5f5d7ed81c5bb29cdbb
SHA1:a613c00841a31bc27a0c9bdf4f210d6c6aceaac6
SHA256:d393bc3918eb1f83e3e3b481ada09a63931b366137e5a7c5542f32ac4ddad4bb
Tags:dll
Infos:

Detection

Emotet
Score:92
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Emotet
System process connects to network (likely due to code injection or exploit)
Changes security center settings (notifications, updates, antivirus, firewall)
Machine Learning detection for sample
Sigma detected: Suspicious Call by Ordinal
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
Deletes files inside the Windows folder
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
Creates a DirectInput object (often for capturing keystrokes)
AV process strings found (often used to terminate AV products)
Sample file is different than original file name gathered from version info
PE file contains an invalid checksum
Tries to load missing DLLs
Contains functionality to read the PEB
Drops PE files to the windows directory (C:\Windows)
Connects to several IPs in different countries
Potential key logger detected (key state polling based)
Registers a DLL
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries disk information (often used to detect virtual machines)
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • loaddll32.exe (PID: 1008 cmdline: loaddll32.exe "C:\Users\user\Desktop\G.dll" MD5: 7DEB5DB86C0AC789123DEC286286B938)
    • cmd.exe (PID: 6084 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\G.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • rundll32.exe (PID: 5012 cmdline: rundll32.exe "C:\Users\user\Desktop\G.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
        • rundll32.exe (PID: 4596 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\G.dll",DllRegisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
          • rundll32.exe (PID: 6232 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Hqelimm\rmkavwi.ypm",YOtq MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
            • rundll32.exe (PID: 6280 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Hqelimm\rmkavwi.ypm",DllRegisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • regsvr32.exe (PID: 1384 cmdline: regsvr32.exe /s C:\Users\user\Desktop\G.dll MD5: 426E7499F6A7346F0410DEAD0805586B)
      • rundll32.exe (PID: 1012 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\G.dll",DllRegisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • rundll32.exe (PID: 4160 cmdline: rundll32.exe C:\Users\user\Desktop\G.dll,DllRegisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • rundll32.exe (PID: 6148 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\G.dll",DllRegisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
  • svchost.exe (PID: 1928 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6332 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6468 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6540 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • SgrmBroker.exe (PID: 6584 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)
  • svchost.exe (PID: 6604 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
    • MpCmdRun.exe (PID: 3540 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: A267555174BFA53844371226F482B86B)
      • conhost.exe (PID: 3940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • svchost.exe (PID: 4584 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 3456 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6796 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 4740 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 4544 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • cleanup

Malware Configuration

Threatname: Emotet

{"C2 list": ["160.16.102.168:80", "131.100.24.231:80", "200.17.134.35:7080", "207.38.84.195:8080", "212.237.56.116:7080", "58.227.42.236:80", "104.251.214.46:8080", "158.69.222.101:443", "192.254.71.210:443", "46.55.222.11:443", "45.118.135.203:7080", "107.182.225.142:8080", "103.75.201.2:443", "104.168.155.129:8080", "195.154.133.20:443", "159.8.59.82:8080", "110.232.117.186:8080", "45.142.114.231:8080", "41.76.108.46:8080", "203.114.109.124:443", "50.116.54.215:443", "209.59.138.75:7080", "185.157.82.211:8080", "164.68.99.3:8080", "162.214.50.39:7080", "138.185.72.26:8080", "178.63.25.185:443", "51.15.4.22:443", "81.0.236.90:443", "216.158.226.206:443", "45.176.232.124:443", "162.243.175.63:443", "212.237.17.99:8080", "45.118.115.99:8080", "129.232.188.93:443", "173.214.173.220:8080", "178.79.147.66:8080", "176.104.106.96:8080", "51.38.71.0:443", "173.212.193.249:8080", "217.182.143.207:443", "212.24.98.99:8080", "159.89.230.105:443", "79.172.212.216:8080", "212.237.5.209:443"], "Public Key": ["RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2", "RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5"]}

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
G.dllJoeSecurity_Emotet_1Yara detected EmotetJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    0000000A.00000002.771427491.00000000044D1000.00000020.00000800.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
      00000003.00000002.253283949.0000000004681000.00000020.00000800.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
        0000000A.00000002.771965666.0000000004EB1000.00000020.00000800.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
          00000006.00000002.271372941.00000000032A0000.00000040.00000800.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
            00000009.00000002.275329419.0000000004B41000.00000020.00000800.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
              Click to see the 60 entries

              Unpacked PEs

              SourceRuleDescriptionAuthorStrings
              2.2.regsvr32.exe.4160000.1.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                6.2.rundll32.exe.5250000.6.raw.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                  3.2.rundll32.exe.4680000.1.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                    6.2.rundll32.exe.52e0000.9.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                      6.2.rundll32.exe.4ff0000.5.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                        Click to see the 89 entries

                        Sigma Overview

                        System Summary

                        barindex
                        Sigma detected: Suspicious Call by Ordinal
                        Source: Process startedAuthor: Florian Roth: Data: Command: rundll32.exe "C:\Users\user\Desktop\G.dll",#1, CommandLine: rundll32.exe "C:\Users\user\Desktop\G.dll",#1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\G.dll",#1, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6084, ProcessCommandLine: rundll32.exe "C:\Users\user\Desktop\G.dll",#1, ProcessId: 5012

                        Jbx Signature Overview

                        Click to jump to signature section

                        Show All Signature Results

                        AV Detection

                        barindex
                        Found malware configuration
                        Source: 6.2.rundll32.exe.4ff0000.5.unpackMalware Configuration Extractor: Emotet {"C2 list": ["160.16.102.168:80", "131.100.24.231:80", "200.17.134.35:7080", "207.38.84.195:8080", "212.237.56.116:7080", "58.227.42.236:80", "104.251.214.46:8080", "158.69.222.101:443", "192.254.71.210:443", "46.55.222.11:443", "45.118.135.203:7080", "107.182.225.142:8080", "103.75.201.2:443", "104.168.155.129:8080", "195.154.133.20:443", "159.8.59.82:8080", "110.232.117.186:8080", "45.142.114.231:8080", "41.76.108.46:8080", "203.114.109.124:443", "50.116.54.215:443", "209.59.138.75:7080", "185.157.82.211:8080", "164.68.99.3:8080", "162.214.50.39:7080", "138.185.72.26:8080", "178.63.25.185:443", "51.15.4.22:443", "81.0.236.90:443", "216.158.226.206:443", "45.176.232.124:443", "162.243.175.63:443", "212.237.17.99:8080", "45.118.115.99:8080", "129.232.188.93:443", "173.214.173.220:8080", "178.79.147.66:8080", "176.104.106.96:8080", "51.38.71.0:443", "173.212.193.249:8080", "217.182.143.207:443", "212.24.98.99:8080", "159.89.230.105:443", "79.172.212.216:8080", "212.237.5.209:443"], "Public Key": ["RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2", "RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5"]}
                        Multi AV Scanner detection for submitted file
                        Source: G.dllVirustotal: Detection: 14%Perma Link
                        Machine Learning detection for sample
                        Source: G.dllJoe Sandbox ML: detected
                        Source: G.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 2_2_10021854 __EH_prolog3,GetFullPathNameA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,2_2_10021854
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_10021854 __EH_prolog3,GetFullPathNameA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,3_2_10021854

                        Networking

                        barindex
                        System process connects to network (likely due to code injection or exploit)
                        Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 160.16.102.168 80Jump to behavior
                        C2 URLs / IPs found in malware configuration
                        Source: Malware configuration extractorIPs: 160.16.102.168:80
                        Source: Malware configuration extractorIPs: 131.100.24.231:80
                        Source: Malware configuration extractorIPs: 200.17.134.35:7080
                        Source: Malware configuration extractorIPs: 207.38.84.195:8080
                        Source: Malware configuration extractorIPs: 212.237.56.116:7080
                        Source: Malware configuration extractorIPs: 58.227.42.236:80
                        Source: Malware configuration extractorIPs: 104.251.214.46:8080
                        Source: Malware configuration extractorIPs: 158.69.222.101:443
                        Source: Malware configuration extractorIPs: 192.254.71.210:443
                        Source: Malware configuration extractorIPs: 46.55.222.11:443
                        Source: Malware configuration extractorIPs: 45.118.135.203:7080
                        Source: Malware configuration extractorIPs: 107.182.225.142:8080
                        Source: Malware configuration extractorIPs: 103.75.201.2:443
                        Source: Malware configuration extractorIPs: 104.168.155.129:8080
                        Source: Malware configuration extractorIPs: 195.154.133.20:443
                        Source: Malware configuration extractorIPs: 159.8.59.82:8080
                        Source: Malware configuration extractorIPs: 110.232.117.186:8080
                        Source: Malware configuration extractorIPs: 45.142.114.231:8080
                        Source: Malware configuration extractorIPs: 41.76.108.46:8080
                        Source: Malware configuration extractorIPs: 203.114.109.124:443
                        Source: Malware configuration extractorIPs: 50.116.54.215:443
                        Source: Malware configuration extractorIPs: 209.59.138.75:7080
                        Source: Malware configuration extractorIPs: 185.157.82.211:8080
                        Source: Malware configuration extractorIPs: 164.68.99.3:8080
                        Source: Malware configuration extractorIPs: 162.214.50.39:7080
                        Source: Malware configuration extractorIPs: 138.185.72.26:8080
                        Source: Malware configuration extractorIPs: 178.63.25.185:443
                        Source: Malware configuration extractorIPs: 51.15.4.22:443
                        Source: Malware configuration extractorIPs: 81.0.236.90:443
                        Source: Malware configuration extractorIPs: 216.158.226.206:443
                        Source: Malware configuration extractorIPs: 45.176.232.124:443
                        Source: Malware configuration extractorIPs: 162.243.175.63:443
                        Source: Malware configuration extractorIPs: 212.237.17.99:8080
                        Source: Malware configuration extractorIPs: 45.118.115.99:8080
                        Source: Malware configuration extractorIPs: 129.232.188.93:443
                        Source: Malware configuration extractorIPs: 173.214.173.220:8080
                        Source: Malware configuration extractorIPs: 178.79.147.66:8080
                        Source: Malware configuration extractorIPs: 176.104.106.96:8080
                        Source: Malware configuration extractorIPs: 51.38.71.0:443
                        Source: Malware configuration extractorIPs: 173.212.193.249:8080
                        Source: Malware configuration extractorIPs: 217.182.143.207:443
                        Source: Malware configuration extractorIPs: 212.24.98.99:8080
                        Source: Malware configuration extractorIPs: 159.89.230.105:443
                        Source: Malware configuration extractorIPs: 79.172.212.216:8080
                        Source: Malware configuration extractorIPs: 212.237.5.209:443
                        Source: Joe Sandbox ViewASN Name: OnlineSASFR OnlineSASFR
                        Source: Joe Sandbox ViewASN Name: S-NET-ASPL S-NET-ASPL
                        Source: Joe Sandbox ViewIP Address: 195.154.133.20 195.154.133.20
                        Source: Joe Sandbox ViewIP Address: 185.157.82.211 185.157.82.211
                        Source: unknownNetwork traffic detected: IP country count 21
                        Source: unknownTCP traffic detected without corresponding DNS query: 160.16.102.168
                        Source: unknownTCP traffic detected without corresponding DNS query: 160.16.102.168
                        Source: unknownTCP traffic detected without corresponding DNS query: 160.16.102.168
                        Source: unknownTCP traffic detected without corresponding DNS query: 160.16.102.168
                        Source: unknownTCP traffic detected without corresponding DNS query: 160.16.102.168
                        Source: unknownTCP traffic detected without corresponding DNS query: 160.16.102.168
                        Source: unknownTCP traffic detected without corresponding DNS query: 160.16.102.168
                        Source: unknownTCP traffic detected without corresponding DNS query: 160.16.102.168
                        Source: unknownTCP traffic detected without corresponding DNS query: 160.16.102.168
                        Source: unknownTCP traffic detected without corresponding DNS query: 160.16.102.168
                        Source: unknownTCP traffic detected without corresponding DNS query: 160.16.102.168
                        Source: unknownTCP traffic detected without corresponding DNS query: 160.16.102.168
                        Source: svchost.exe, 00000023.00000003.567347594.0000020CDDF87000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","N equals www.facebook.com (Facebook)
                        Source: svchost.exe, 00000023.00000003.567347594.0000020CDDF87000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","N equals www.twitter.com (Twitter)
                        Source: svchost.exe, 00000023.00000003.567358074.0000020CDDF98000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000003.567347594.0000020CDDF87000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-01-21T16:24:38.4044683Z||.||031efeb6-e916-442f-a665-3e8426d4bc5a||1152921505694396307||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
                        Source: svchost.exe, 00000023.00000003.567358074.0000020CDDF98000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000003.567347594.0000020CDDF87000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-01-21T16:24:38.4044683Z||.||031efeb6-e916-442f-a665-3e8426d4bc5a||1152921505694396307||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
                        Source: svchost.exe, 00000007.00000002.613162045.0000028857899000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000002.585963155.0000020CDDF00000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
                        Source: svchost.exe, 00000007.00000002.613054115.000002885780D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
                        Source: 77EC63BDA74BD0D0E0426DC8F80085060.10.drString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
                        Source: rundll32.exe, 0000000A.00000003.327062871.0000000005222000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000003.328137684.0000000005221000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000003.328543955.0000000005221000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.772376808.0000000005221000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?ccd0eebeef977
                        Source: svchost.exe, 00000023.00000003.561038722.0000020CDDF5D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000003.560595902.0000020CDDF91000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://help.disneyplus.com.
                        Source: svchost.exe, 0000000D.00000002.308972985.000002C185413000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.bingmapsportal.com
                        Source: svchost.exe, 0000000B.00000002.771126375.000001F988044000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://%s.dnet.xboxlive.com
                        Source: svchost.exe, 0000000B.00000002.771126375.000001F988044000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://%s.xboxlive.com
                        Source: svchost.exe, 0000000B.00000002.771126375.000001F988044000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com
                        Source: svchost.exe, 0000000D.00000003.308075068.000002C185450000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
                        Source: svchost.exe, 0000000B.00000002.771095332.000001F988029000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
                        Source: svchost.exe, 0000000B.00000002.771095332.000001F988029000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
                        Source: svchost.exe, 0000000D.00000003.308210317.000002C18544B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
                        Source: svchost.exe, 0000000D.00000003.308210317.000002C18544B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.309019486.000002C18544D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
                        Source: svchost.exe, 0000000D.00000003.308075068.000002C185450000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
                        Source: svchost.exe, 0000000D.00000002.309007019.000002C18543E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
                        Source: svchost.exe, 0000000D.00000003.308210317.000002C18544B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.309019486.000002C18544D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
                        Source: svchost.exe, 0000000D.00000002.309044741.000002C18546A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.307872220.000002C185468000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
                        Source: svchost.exe, 0000000D.00000003.308075068.000002C185450000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
                        Source: svchost.exe, 0000000D.00000003.308361693.000002C18542C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.308991389.000002C18542D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
                        Source: svchost.exe, 0000000D.00000003.286009108.000002C185430000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
                        Source: svchost.exe, 0000000D.00000003.308210317.000002C18544B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.309019486.000002C18544D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
                        Source: svchost.exe, 0000000D.00000003.308075068.000002C185450000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
                        Source: svchost.exe, 0000000D.00000002.309007019.000002C18543E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
                        Source: svchost.exe, 0000000D.00000003.308075068.000002C185450000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
                        Source: svchost.exe, 0000000D.00000003.308075068.000002C185450000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
                        Source: svchost.exe, 0000000D.00000003.308075068.000002C185450000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
                        Source: svchost.exe, 0000000D.00000003.286009108.000002C185430000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
                        Source: svchost.exe, 0000000D.00000002.309011405.000002C185442000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.308572343.000002C185441000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
                        Source: svchost.exe, 0000000D.00000003.286009108.000002C185430000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Stops/
                        Source: svchost.exe, 0000000D.00000002.309011405.000002C185442000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.308572343.000002C185441000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
                        Source: svchost.exe, 0000000D.00000003.308075068.000002C185450000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
                        Source: svchost.exe, 0000000D.00000003.308361693.000002C18542C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.309015058.000002C185447000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.308429108.000002C185446000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
                        Source: svchost.exe, 0000000D.00000003.286009108.000002C185430000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?entry=
                        Source: svchost.exe, 00000023.00000003.561038722.0000020CDDF5D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000003.560595902.0000020CDDF91000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://disneyplus.com/legal.
                        Source: svchost.exe, 0000000D.00000003.308210317.000002C18544B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
                        Source: svchost.exe, 0000000D.00000002.309015058.000002C185447000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.308429108.000002C185446000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
                        Source: svchost.exe, 0000000D.00000002.309015058.000002C185447000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.308429108.000002C185446000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
                        Source: svchost.exe, 0000000D.00000003.307980966.000002C185464000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t
                        Source: svchost.exe, 0000000D.00000003.308075068.000002C185450000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
                        Source: svchost.exe, 0000000D.00000002.309007019.000002C18543E000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.286009108.000002C185430000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
                        Source: svchost.exe, 0000000D.00000003.308372123.000002C185438000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.286009108.000002C185430000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
                        Source: svchost.exe, 0000000D.00000003.286009108.000002C185430000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/roadshield.ashx?bucket=
                        Source: svchost.exe, 0000000D.00000002.309007019.000002C18543E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
                        Source: svchost.exe, 0000000D.00000002.309007019.000002C18543E000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.308972985.000002C185413000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
                        Source: svchost.exe, 0000000D.00000003.308372123.000002C185438000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.286009108.000002C185430000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
                        Source: svchost.exe, 0000000D.00000003.308475328.000002C185445000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
                        Source: svchost.exe, 0000000D.00000003.308372123.000002C185438000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.286009108.000002C185430000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
                        Source: svchost.exe, 0000000D.00000003.308372123.000002C185438000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.286009108.000002C185430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.309002264.000002C185438000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
                        Source: svchost.exe, 0000000D.00000003.308361693.000002C18542C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.308991389.000002C18542D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
                        Source: svchost.exe, 00000023.00000003.561038722.0000020CDDF5D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000003.560595902.0000020CDDF91000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
                        Source: svchost.exe, 00000023.00000003.561038722.0000020CDDF5D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000003.560595902.0000020CDDF91000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
                        Source: svchost.exe, 00000023.00000003.562388514.0000020CDDFAC000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000003.562676725.0000020CDDF95000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000003.562660746.0000020CDDF84000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000003.562744963.0000020CDE402000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000003.562510238.0000020CDDFAC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.tiktok.com/legal/report/feedback
                        Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10012C30 _memset,connect,send,recv,0_2_10012C30
                        Source: loaddll32.exe, 00000000.00000002.261420321.000000000145B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 2_2_1001B43F GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,2_2_1001B43F
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_1001B43F GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,3_2_1001B43F

                        E-Banking Fraud

                        barindex
                        Yara detected Emotet
                        Source: Yara matchFile source: G.dll, type: SAMPLE
                        Source: Yara matchFile source: 2.2.regsvr32.exe.4160000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.5250000.6.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 3.2.rundll32.exe.4680000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.52e0000.9.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.4ff0000.5.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.4f10000.3.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.2a30000.0.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.loaddll32.exe.2d80000.0.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.4bc0000.6.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.5a00000.12.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.5340000.11.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.4fc0000.4.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.4e20000.8.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.49f0000.5.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.5440000.3.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.57d0000.6.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.5250000.6.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.5170000.16.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.4eb0000.11.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.5280000.7.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.32a0000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.44d0000.3.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.5170000.16.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.53e0000.20.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.5a30000.13.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.loaddll32.exe.2d80000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.32a0000.0.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.4f70000.12.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.5830000.8.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.5480000.12.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.4cf0000.7.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.5080000.14.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.4e20000.8.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.5620000.5.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.4ec0000.0.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.5360000.18.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.4ec0000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.57d0000.6.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.4e80000.10.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.5390000.19.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.4e80000.10.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.5890000.10.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.5360000.18.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.53c0000.2.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.54f0000.4.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 9.2.rundll32.exe.4af0000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 3.2.rundll32.exe.4650000.0.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.5310000.10.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.4bc0000.6.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 9.2.rundll32.exe.4af0000.0.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.44a0000.2.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.49a0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.49c0000.4.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.50c0000.15.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.5310000.10.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.2a60000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.54f0000.4.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.5830000.8.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 2.2.regsvr32.exe.4130000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.54b0000.13.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 9.2.rundll32.exe.4b40000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.5080000.14.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.49c0000.4.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.5860000.9.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.4ef0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.5890000.10.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.4ee0000.2.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.44a0000.2.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.51a0000.17.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.4f70000.12.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.4fa0000.13.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.loaddll32.exe.10000000.2.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.53e0000.20.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.52b0000.8.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.5800000.7.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.4fc0000.4.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 2.2.regsvr32.exe.4130000.0.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.2a30000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.52b0000.8.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.5a00000.12.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.5410000.21.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.58c0000.11.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.4e50000.9.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.53c0000.2.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.5480000.12.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.4ee0000.2.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 3.2.rundll32.exe.4650000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.loaddll32.exe.2db0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 2.2.regsvr32.exe.10000000.2.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.10000000.14.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 3.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.10000000.22.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 9.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.10000000.14.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0000000A.00000002.771427491.00000000044D1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000003.00000002.253283949.0000000004681000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.771965666.0000000004EB1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.271372941.00000000032A0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000009.00000002.275329419.0000000004B41000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.272139717.0000000005341000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.271889554.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000002.00000002.252624792.0000000004161000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.274576456.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.772505137.0000000005391000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.771607352.00000000049F1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.272090559.00000000052E1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.272206669.00000000054B1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.276875884.0000000005861000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.274675979.00000000054F0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.772451917.0000000005360000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.274922446.0000000005621000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.272121589.0000000005310000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.772785811.0000000010001000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.272067370.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.276956910.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.276851297.0000000005830000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000009.00000002.275561648.0000000010001000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.772550066.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.272183835.0000000005480000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.771696556.0000000004BC0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.261493646.0000000002D80000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.271716926.0000000004F11000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.772088368.0000000004FA1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.772195967.00000000050C1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.271915479.0000000004FF1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.272014124.0000000005281000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.275830029.0000000005801000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.274491459.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.277008171.0000000010001000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.772607036.0000000005411000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.271693542.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.771329130.00000000044A0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.771770201.0000000004CF1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.274638425.0000000005441000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.271987224.0000000005250000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.772052651.0000000004F70000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.770804161.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.271513878.00000000049A1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.274516629.0000000004EF1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.771574854.00000000049C0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000002.00000002.252573847.0000000004130000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.275452087.00000000057D0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000009.00000002.274906583.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.771910511.0000000004E80000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.261522396.0000000002DB1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.276976546.0000000005A31000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.276938225.00000000058C1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.771839455.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.772278952.00000000051A1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.772140071.0000000005080000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.770959380.0000000002A61000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.772251780.0000000005170000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.272247152.0000000010001000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.771878250.0000000004E51000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.276919244.0000000005890000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000003.00000002.253256451.0000000004650000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000003.00000002.253348428.0000000010001000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY

                        System Summary

                        barindex
                        Source: G.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                        Source: C:\Windows\SysWOW64\rundll32.exeFile deleted: C:\Windows\SysWOW64\Hqelimm\rmkavwi.ypm:Zone.IdentifierJump to behavior
                        Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\SysWOW64\Ewgbbnt\Jump to behavior
                        Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_100360070_2_10036007
                        Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_100410500_2_10041050
                        Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10040B0E0_2_10040B0E
                        Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_1003130F0_2_1003130F
                        Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10041C560_2_10041C56
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 2_2_100360072_2_10036007
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 2_2_100410502_2_10041050
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 2_2_1003130F2_2_1003130F
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 2_2_100304602_2_10030460
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 2_2_100415922_2_10041592
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 2_2_1003E59F2_2_1003E59F
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 2_2_10040B0E2_2_10040B0E
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 2_2_10041C562_2_10041C56
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 2_2_10036CB52_2_10036CB5
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 2_2_1001CD162_2_1001CD16
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 2_2_10042D212_2_10042D21
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_100360073_2_10036007
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_100410503_2_10041050
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_1003130F3_2_1003130F
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_100304603_2_10030460
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_100415923_2_10041592
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_1003E59F3_2_1003E59F
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_10040B0E3_2_10040B0E
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_10041C563_2_10041C56
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_10036CB53_2_10036CB5
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_1001CD163_2_1001CD16
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_10042D213_2_10042D21
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EFF8FD4_2_04EFF8FD
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F09EEC4_2_04F09EEC
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F020BA4_2_04F020BA
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F0044F4_2_04F0044F
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF3C3C4_2_04EF3C3C
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF90114_2_04EF9011
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF7FF24_2_04EF7FF2
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF59F24_2_04EF59F2
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F113AD4_2_04F113AD
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F041164_2_04F04116
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F0DCF74_2_04F0DCF7
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF4EE34_2_04EF4EE3
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF64E24_2_04EF64E2
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EFAEFB4_2_04EFAEFB
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F0A2E84_2_04F0A2E8
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EFE2CC4_2_04EFE2CC
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EFB2C74_2_04EFB2C7
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F0DEDC4_2_04F0DEDC
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F05CC44_2_04F05CC4
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EFD6D84_2_04EFD6D8
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F066CA4_2_04F066CA
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF70B34_2_04EF70B3
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EFEE814_2_04EFEE81
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EFF09B4_2_04EFF09B
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EFEA994_2_04EFEA99
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F018894_2_04F01889
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F0907F4_2_04F0907F
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF5E604_2_04EF5E60
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F0A6664_2_04F0A666
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F0AE6D4_2_04F0AE6D
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F00E534_2_04F00E53
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F100564_2_04F10056
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF4C5D4_2_04EF4C5D
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF1A564_2_04EF1A56
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F06C494_2_04F06C49
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF20514_2_04EF2051
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF22514_2_04EF2251
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F0AA304_2_04F0AA30
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F0C6314_2_04F0C631
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F0F4354_2_04F0F435
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F0AC3A4_2_04F0AC3A
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F10E3A4_2_04F10E3A
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF3E3F4_2_04EF3E3F
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F0BE274_2_04F0BE27
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF7C374_2_04EF7C37
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F10C144_2_04F10C14
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F000014_2_04F00001
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F086064_2_04F08606
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF48164_2_04EF4816
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F06DF84_2_04F06DF8
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F095FA4_2_04F095FA
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F08BE34_2_04F08BE3
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F0DBEA4_2_04F0DBEA
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EFDFF34_2_04EFDFF3
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF9DCF4_2_04EF9DCF
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EFE5CF4_2_04EFE5CF
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F07DD54_2_04F07DD5
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF2BD94_2_04EF2BD9
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F09BCF4_2_04F09BCF
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F109B54_2_04F109B5
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F0C3A04_2_04F0C3A0
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF51BB4_2_04EF51BB
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F07BA64_2_04F07BA6
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF81B74_2_04EF81B7
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F0E3954_2_04F0E395
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EFAB874_2_04EFAB87
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF9B834_2_04EF9B83
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F04B874_2_04F04B87
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F0D3894_2_04F0D389
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EFE9914_2_04EFE991
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF89694_2_04EF8969
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF53614_2_04EF5361
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EFBB7E4_2_04EFBB7E
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F0176B4_2_04F0176B
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F025504_2_04F02550
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EFB74D4_2_04EFB74D
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF55484_2_04EF5548
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EFCF474_2_04EFCF47
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF43464_2_04EF4346
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F0CB5B4_2_04F0CB5B
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EFA55F4_2_04EFA55F
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F0894B4_2_04F0894B
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F10F334_2_04F10F33
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF6D244_2_04EF6D24
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F0473C4_2_04F0473C
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF8B3D4_2_04EF8B3D
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F0BB234_2_04F0BB23
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF77354_2_04EF7735
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F085194_2_04F08519
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F00B194_2_04F00B19
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04EF97144_2_04EF9714
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: String function: 10032B38 appears 45 times
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: String function: 10030D5A appears 41 times
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: String function: 100200FD appears 36 times
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: String function: 10030D27 appears 143 times
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 10032B38 appears 45 times
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 10030D5A appears 32 times
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 10030D27 appears 125 times
                        Source: G.dllBinary or memory string: OriginalFilenameFinalChatSocketCli.exe> vs G.dll
                        Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: xboxlivetitleid.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: cdpsgshims.dllJump to behavior
                        Source: G.dllVirustotal: Detection: 14%
                        Source: G.dllStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                        Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                        Source: unknownProcess created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\G.dll"
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\G.dll",#1
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\G.dll
                        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\G.dll",#1
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\G.dll,DllRegisterServer
                        Source: C:\Windows\SysWOW64\regsvr32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\G.dll",DllRegisterServer
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\G.dll",DllRegisterServer
                        Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\G.dll",DllRegisterServer
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Hqelimm\rmkavwi.ypm",YOtq
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Hqelimm\rmkavwi.ypm",DllRegisterServer
                        Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
                        Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
                        Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
                        Source: unknownProcess created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
                        Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
                        Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
                        Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
                        Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
                        Source: C:\Windows\System32\svchost.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                        Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
                        Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\G.dll",#1Jump to behavior
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\G.dllJump to behavior
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\G.dll,DllRegisterServerJump to behavior
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\G.dll",DllRegisterServerJump to behavior
                        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\G.dll",#1Jump to behavior
                        Source: C:\Windows\SysWOW64\regsvr32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\G.dll",DllRegisterServerJump to behavior
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\G.dll",DllRegisterServerJump to behavior
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Hqelimm\rmkavwi.ypm",YOtqJump to behavior
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Hqelimm\rmkavwi.ypm",DllRegisterServerJump to behavior
                        Source: C:\Windows\System32\svchost.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenableJump to behavior
                        Source: C:\Windows\SysWOW64\rundll32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
                        Source: classification engineClassification label: mal92.troj.evad.winDLL@33/9@0/46
                        Source: C:\Windows\SysWOW64\rundll32.exeFile read: C:\Users\desktop.iniJump to behavior
                        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\G.dll",#1
                        Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3940:120:WilError_01
                        Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_100125C0 _printf,FindResourceW,LoadResource,SizeofResource,VirtualAllocExNuma,VirtualAlloc,_malloc,0_2_100125C0
                        Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                        Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                        Source: C:\Windows\SysWOW64\rundll32.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                        Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hosts
                        Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hosts
                        Source: G.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                        Source: G.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                        Source: G.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                        Source: G.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                        Source: G.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
                        Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10032B7D push ecx; ret 0_2_10032B90
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 2_2_10032B7D push ecx; ret 2_2_10032B90
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 2_2_10030DFF push ecx; ret 2_2_10030E12
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_10032B7D push ecx; ret 3_2_10032B90
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_10030DFF push ecx; ret 3_2_10030E12
                        Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_1003D873 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__invoke_watson,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__invoke_watson,__decode_pointer,__decode_pointer,__decode_pointer,0_2_1003D873
                        Source: G.dllStatic PE information: real checksum: 0x8df98 should be: 0x88912
                        Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\G.dll
                        Source: C:\Windows\SysWOW64\rundll32.exePE file moved: C:\Windows\SysWOW64\Hqelimm\rmkavwi.ypmJump to behavior

                        Hooking and other Techniques for Hiding and Protection

                        barindex
                        Hides that the sample has been downloaded from the Internet (zone.identifier)
                        Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Windows\SysWOW64\Ewgbbnt\oudxseiqb.wun:Zone.Identifier read attributes | deleteJump to behavior
                        Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Windows\SysWOW64\Hqelimm\rmkavwi.ypm:Zone.Identifier read attributes | deleteJump to behavior
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 2_2_100134F0 IsIconic,2_2_100134F0
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 2_2_10018C9A IsIconic,GetWindowPlacement,GetWindowRect,2_2_10018C9A
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_100134F0 IsIconic,3_2_100134F0
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_10018C9A IsIconic,GetWindowPlacement,GetWindowRect,3_2_10018C9A
                        Source: C:\Windows\System32\svchost.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\System32\svchost.exe TID: 6168Thread sleep time: -60000s >= -30000sJump to behavior
                        Source: C:\Windows\System32\svchost.exe TID: 3016Thread sleep time: -180000s >= -30000s
                        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                        Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0Jump to behavior
                        Source: C:\Windows\System32\loaddll32.exeAPI coverage: 6.4 %
                        Source: C:\Windows\SysWOW64\regsvr32.exeAPI coverage: 3.4 %
                        Source: C:\Windows\SysWOW64\rundll32.exeAPI coverage: 3.8 %
                        Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10030334 VirtualQuery,GetSystemInfo,__invoke_watson,GetModuleHandleA,GetProcAddress,VirtualAlloc,VirtualProtect,0_2_10030334
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 2_2_10021854 __EH_prolog3,GetFullPathNameA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,2_2_10021854
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_10021854 __EH_prolog3,GetFullPathNameA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,3_2_10021854
                        Source: C:\Windows\SysWOW64\regsvr32.exeAPI call chain: ExitProcess graph end nodegraph_2-25063
                        Source: C:\Windows\SysWOW64\rundll32.exeAPI call chain: ExitProcess graph end nodegraph_3-22835
                        Source: C:\Windows\SysWOW64\rundll32.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                        Source: C:\Windows\SysWOW64\rundll32.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                        Source: svchost.exe, 00000007.00000002.613112741.000002885785F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000002.585901787.0000020CDD6F6000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: "@Hyper-V RAW
                        Source: svchost.exe, 00000007.00000002.613098931.0000028857849000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.612842226.0000028852229000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000002.585890269.0000020CDD6EB000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000002.585790893.0000020CDD671000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                        Source: svchost.exe, 0000000B.00000002.771126375.000001F988044000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.771113068.00000238D1829000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                        Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_1002F81E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_1002F81E
                        Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_1003D873 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__invoke_watson,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__invoke_watson,__decode_pointer,__decode_pointer,__decode_pointer,0_2_1003D873
                        Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10030A37 GetProcessHeap,GetProcessHeap,HeapAlloc,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,__heap_term,__RTC_Initialize,GetCommandLineA,___crtGetEnvironmentStringsA,__ioinit,__mtterm,__setargv,__setenvp,__cinit,__ioterm,__ioterm,__mtterm,__heap_term,___set_flsgetvalue,__calloc_crt,__decode_pointer,GetCurrentThreadId,__freeptd,0_2_10030A37
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04F04087 mov eax, dword ptr fs:[00000030h]4_2_04F04087
                        Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_1002F81E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_1002F81E
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 2_2_10037657 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_10037657
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 2_2_1002F81E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_1002F81E
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 2_2_1003ACCC __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_1003ACCC
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_10037657 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_10037657
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_1002F81E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_1002F81E
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_1003ACCC __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_1003ACCC

                        HIPS / PFW / Operating System Protection Evasion

                        barindex
                        System process connects to network (likely due to code injection or exploit)
                        Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 160.16.102.168 80Jump to behavior
                        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\G.dll",#1Jump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                        Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\Windows\System32\loaddll32.exeCode function: _strcpy_s,__snprintf_s,GetLocaleInfoA,LoadLibraryA,0_2_10014B71
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: GetLocaleInfoA,2_2_1003F570
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: GetThreadLocale,GetLocaleInfoA,GetACP,2_2_10043730
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: _strcpy_s,__snprintf_s,GetLocaleInfoA,LoadLibraryA,2_2_10014B71
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: GetLocaleInfoA,3_2_1003F570
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: GetThreadLocale,GetLocaleInfoA,GetACP,3_2_10043730
                        Source: C:\Windows\SysWOW64\rundll32.exeCode function: _strcpy_s,__snprintf_s,GetLocaleInfoA,LoadLibraryA,3_2_10014B71
                        Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_1003DAA7 cpuid 0_2_1003DAA7
                        Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_1003906D GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,0_2_1003906D
                        Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 2_2_1003CE1A __lock,__invoke_watson,__invoke_watson,__invoke_watson,____lc_codepage_func,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,2_2_1003CE1A
                        Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_10030A37 GetProcessHeap,GetProcessHeap,HeapAlloc,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,__heap_term,__RTC_Initialize,GetCommandLineA,___crtGetEnvironmentStringsA,__ioinit,__mtterm,__setargv,__setenvp,__cinit,__ioterm,__ioterm,__mtterm,__heap_term,___set_flsgetvalue,__calloc_crt,__decode_pointer,GetCurrentThreadId,__freeptd,0_2_10030A37

                        Lowering of HIPS / PFW / Operating System Security Settings

                        barindex
                        Changes security center settings (notifications, updates, antivirus, firewall)
                        Source: C:\Windows\System32\svchost.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cvalJump to behavior
                        Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA &apos;AntiVirusProduct&apos; OR TargetInstance ISA &apos;FirewallProduct&apos; OR TargetInstance ISA &apos;AntiSpywareProduct&apos;
                        Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
                        Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
                        Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct
                        Source: svchost.exe, 0000000F.00000002.770926389.000001D663A3D000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @V%ProgramFiles%\Windows Defender\MsMpeng.exe
                        Source: svchost.exe, 0000000F.00000002.770982746.000001D663B02000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

                        Stealing of Sensitive Information

                        barindex
                        Yara detected Emotet
                        Source: Yara matchFile source: G.dll, type: SAMPLE
                        Source: Yara matchFile source: 2.2.regsvr32.exe.4160000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.5250000.6.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 3.2.rundll32.exe.4680000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.52e0000.9.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.4ff0000.5.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.4f10000.3.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.2a30000.0.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.loaddll32.exe.2d80000.0.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.4bc0000.6.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.5a00000.12.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.5340000.11.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.4fc0000.4.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.4e20000.8.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.49f0000.5.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.5440000.3.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.57d0000.6.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.5250000.6.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.5170000.16.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.4eb0000.11.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.5280000.7.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.32a0000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.44d0000.3.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.5170000.16.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.53e0000.20.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.5a30000.13.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.loaddll32.exe.2d80000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.32a0000.0.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.4f70000.12.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.5830000.8.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.5480000.12.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.4cf0000.7.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.5080000.14.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.4e20000.8.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.5620000.5.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.4ec0000.0.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.5360000.18.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.4ec0000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.57d0000.6.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.4e80000.10.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.5390000.19.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.4e80000.10.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.5890000.10.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.5360000.18.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.53c0000.2.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.54f0000.4.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 9.2.rundll32.exe.4af0000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 3.2.rundll32.exe.4650000.0.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.5310000.10.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.4bc0000.6.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 9.2.rundll32.exe.4af0000.0.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.44a0000.2.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.49a0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.49c0000.4.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.50c0000.15.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.5310000.10.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.2a60000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.54f0000.4.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.5830000.8.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 2.2.regsvr32.exe.4130000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.54b0000.13.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 9.2.rundll32.exe.4b40000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.5080000.14.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.49c0000.4.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.5860000.9.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.4ef0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.5890000.10.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.4ee0000.2.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.44a0000.2.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.51a0000.17.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.4f70000.12.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.4fa0000.13.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.loaddll32.exe.10000000.2.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.53e0000.20.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.52b0000.8.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.5800000.7.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.4fc0000.4.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 2.2.regsvr32.exe.4130000.0.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.2a30000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.52b0000.8.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.5a00000.12.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.5410000.21.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.58c0000.11.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.4e50000.9.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.53c0000.2.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.5480000.12.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.4ee0000.2.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 3.2.rundll32.exe.4650000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.loaddll32.exe.2db0000.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 2.2.regsvr32.exe.10000000.2.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 4.2.rundll32.exe.10000000.14.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 3.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.rundll32.exe.10000000.22.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 9.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 6.2.rundll32.exe.10000000.14.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0000000A.00000002.771427491.00000000044D1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000003.00000002.253283949.0000000004681000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.771965666.0000000004EB1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.271372941.00000000032A0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000009.00000002.275329419.0000000004B41000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.272139717.0000000005341000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.271889554.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000002.00000002.252624792.0000000004161000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.274576456.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.772505137.0000000005391000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.771607352.00000000049F1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.272090559.00000000052E1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.272206669.00000000054B1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.276875884.0000000005861000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.274675979.00000000054F0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.772451917.0000000005360000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.274922446.0000000005621000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.272121589.0000000005310000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.772785811.0000000010001000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.272067370.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.276956910.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.276851297.0000000005830000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000009.00000002.275561648.0000000010001000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.772550066.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.272183835.0000000005480000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.771696556.0000000004BC0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.261493646.0000000002D80000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.271716926.0000000004F11000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.772088368.0000000004FA1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.772195967.00000000050C1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.271915479.0000000004FF1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.272014124.0000000005281000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.275830029.0000000005801000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.274491459.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.277008171.0000000010001000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.772607036.0000000005411000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.271693542.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.771329130.00000000044A0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.771770201.0000000004CF1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.274638425.0000000005441000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.271987224.0000000005250000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.772052651.0000000004F70000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.770804161.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.271513878.00000000049A1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.274516629.0000000004EF1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.771574854.00000000049C0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000002.00000002.252573847.0000000004130000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.275452087.00000000057D0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000009.00000002.274906583.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.771910511.0000000004E80000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.261522396.0000000002DB1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.276976546.0000000005A31000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.276938225.00000000058C1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.771839455.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.772278952.00000000051A1000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.772140071.0000000005080000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.770959380.0000000002A61000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.772251780.0000000005170000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000006.00000002.272247152.0000000010001000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.771878250.0000000004E51000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000004.00000002.276919244.0000000005890000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000003.00000002.253256451.0000000004650000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000003.00000002.253348428.0000000010001000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY

                        Mitre Att&ck Matrix

                        Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                        Valid Accounts1
                        Windows Management Instrumentation                        		1
                        DLL Side-Loading                        		1
                        DLL Side-Loading                        		1
                        Disable or Modify Tools                        		2
                        Input Capture                        		2
                        System Time Discovery                        		Remote Services1
                        Archive Collected Data                        		Exfiltration Over Other Network Medium1
                        Ingress Tool Transfer                        		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                        Default Accounts1
                        Native API                        		Boot or Logon Initialization Scripts111
                        Process Injection                        		1
                        Deobfuscate/Decode Files or Information                        		LSASS Memory2
                        File and Directory Discovery                        		Remote Desktop Protocol2
                        Input Capture                        		Exfiltration Over Bluetooth1
                        Encrypted Channel                        		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                        Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)2
                        Obfuscated Files or Information                        		Security Account Manager45
                        System Information Discovery                        		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
                        Application Layer Protocol                        		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                        Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)1
                        DLL Side-Loading                        		NTDS1
                        Query Registry                        		Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
                        Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
                        File Deletion                        		LSA Secrets51
                        Security Software Discovery                        		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                        Replication Through Removable MediaLaunchdRc.commonRc.common2
                        Masquerading                        		Cached Domain Credentials2
                        Virtualization/Sandbox Evasion                        		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                        External Remote ServicesScheduled TaskStartup ItemsStartup Items2
                        Virtualization/Sandbox Evasion                        		DCSync1
                        Application Window Discovery                        		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                        Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job111
                        Process Injection                        		Proc Filesystem1
                        Remote System Discovery                        		Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
                        Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)1
                        Hidden Files and Directories                        		/etc/passwd and /etc/shadowSystem Network Connections DiscoverySoftware Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
                        Supply Chain CompromiseAppleScriptAt (Windows)At (Windows)1
                        Regsvr32                        		Network SniffingProcess DiscoveryTaint Shared ContentLocal Data StagingExfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolFile Transfer ProtocolsData Encrypted for Impact
                        Compromise Software Dependencies and Development ToolsWindows Command ShellCronCron1
                        Rundll32                        		Input CapturePermission Groups DiscoveryReplication Through Removable MediaRemote Data StagingExfiltration Over Physical MediumMail ProtocolsService Stop

                        Behavior Graph

                        Hide Legend

                        Legend:

                        • Process
                        • Signature
                        • Created File
                        • DNS/IP Info
                        • Is Dropped
                        • Is Windows Process
                        • Number of created Registry Values
                        • Number of created Files
                        • Visual Basic
                        • Delphi
                        • Java
                        • .Net C# or VB.NET
                        • C, C++ or other language
                        • Is malicious
                        • Internet
                        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 562446 Sample: G Startdate: 28/01/2022 Architecture: WINDOWS Score: 92 49 129.232.188.93 xneeloZA South Africa 2->49 51 162.214.50.39 UNIFIEDLAYER-AS-1US United States 2->51 53 42 other IPs or domains 2->53 57 Found malware configuration 2->57 59 Multi AV Scanner detection for submitted file 2->59 61 Yara detected Emotet 2->61 63 3 other signatures 2->63 11 loaddll32.exe 1 2->11         started        13 svchost.exe 2->13         started        16 svchost.exe 9 1 2->16         started        19 9 other processes 2->19 signatures3 process4 dnsIp5 21 cmd.exe 1 11->21         started        23 rundll32.exe 2 11->23         started        26 regsvr32.exe 11->26         started        28 rundll32.exe 11->28         started        71 Changes security center settings (notifications, updates, antivirus, firewall) 13->71 30 MpCmdRun.exe 1 13->30         started        47 127.0.0.1 unknown unknown 16->47 signatures6 process7 signatures8 32 rundll32.exe 21->32         started        67 Hides that the sample has been downloaded from the Internet (zone.identifier) 23->67 34 rundll32.exe 26->34         started        36 conhost.exe 30->36         started        process9 process10 38 rundll32.exe 2 32->38         started        signatures11 65 Hides that the sample has been downloaded from the Internet (zone.identifier) 38->65 41 rundll32.exe 38->41         started        process12 process13 43 rundll32.exe 41->43         started        dnsIp14 55 160.16.102.168, 49768, 80 SAKURA-BSAKURAInternetIncJP Japan 43->55 69 System process connects to network (likely due to code injection or exploit) 43->69 signatures15

                        Screenshots

                        Thumbnails

                        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                        windows-stand

                        Antivirus, Machine Learning and Genetic Malware Detection

                        Initial Sample

                        SourceDetectionScannerLabelLink
                        G.dll15%VirustotalBrowse
                        G.dll100%Joe Sandbox ML

                        Dropped Files

                        ⊘No Antivirus matches

                        Unpacked PE Files

                        SourceDetectionScannerLabelLinkDownload
                        6.2.rundll32.exe.4ff0000.5.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        4.2.rundll32.exe.5a30000.13.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        6.2.rundll32.exe.52e0000.9.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        6.2.rundll32.exe.5280000.7.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        10.2.rundll32.exe.4eb0000.11.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        10.2.rundll32.exe.4e20000.8.unpack100%AviraHEUR/AGEN.1145233Download File
                        6.2.rundll32.exe.32a0000.0.unpack100%AviraHEUR/AGEN.1145233Download File
                        6.2.rundll32.exe.4f10000.3.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        10.2.rundll32.exe.49f0000.5.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        3.2.rundll32.exe.4680000.1.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        2.2.regsvr32.exe.4160000.1.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        6.2.rundll32.exe.5250000.6.unpack100%AviraHEUR/AGEN.1145233Download File
                        6.2.rundll32.exe.4fc0000.4.unpack100%AviraHEUR/AGEN.1145233Download File
                        6.2.rundll32.exe.5340000.11.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        10.2.rundll32.exe.44d0000.3.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        0.2.loaddll32.exe.2d80000.0.unpack100%AviraHEUR/AGEN.1145233Download File
                        10.2.rundll32.exe.5170000.16.unpack100%AviraHEUR/AGEN.1145233Download File
                        4.2.rundll32.exe.5440000.3.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        10.2.rundll32.exe.4bc0000.6.unpack100%AviraHEUR/AGEN.1145233Download File
                        4.2.rundll32.exe.57d0000.6.unpack100%AviraHEUR/AGEN.1145233Download File
                        10.2.rundll32.exe.4cf0000.7.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        6.2.rundll32.exe.5480000.12.unpack100%AviraHEUR/AGEN.1145233Download File
                        4.2.rundll32.exe.5830000.8.unpack100%AviraHEUR/AGEN.1145233Download File
                        4.2.rundll32.exe.5620000.5.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        4.2.rundll32.exe.5890000.10.unpack100%AviraHEUR/AGEN.1145233Download File
                        4.2.rundll32.exe.4ec0000.0.unpack100%AviraHEUR/AGEN.1145233Download File
                        10.2.rundll32.exe.5390000.19.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        10.2.rundll32.exe.5360000.18.unpack100%AviraHEUR/AGEN.1145233Download File
                        10.2.rundll32.exe.4e80000.10.unpack100%AviraHEUR/AGEN.1145233Download File
                        9.2.rundll32.exe.4af0000.0.unpack100%AviraHEUR/AGEN.1145233Download File
                        4.2.rundll32.exe.53c0000.2.unpack100%AviraHEUR/AGEN.1145233Download File
                        6.2.rundll32.exe.49a0000.1.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        10.2.rundll32.exe.49c0000.4.unpack100%AviraHEUR/AGEN.1145233Download File
                        6.2.rundll32.exe.5310000.10.unpack100%AviraHEUR/AGEN.1145233Download File
                        4.2.rundll32.exe.5860000.9.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        10.2.rundll32.exe.50c0000.15.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        10.2.rundll32.exe.2a60000.1.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        6.2.rundll32.exe.54b0000.13.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        4.2.rundll32.exe.54f0000.4.unpack100%AviraHEUR/AGEN.1145233Download File
                        2.2.regsvr32.exe.4130000.0.unpack100%AviraHEUR/AGEN.1145233Download File
                        4.2.rundll32.exe.4ef0000.1.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        10.2.rundll32.exe.5080000.14.unpack100%AviraHEUR/AGEN.1145233Download File
                        9.2.rundll32.exe.4b40000.1.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        6.2.rundll32.exe.52b0000.8.unpack100%AviraHEUR/AGEN.1145233Download File
                        10.2.rundll32.exe.4fa0000.13.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        6.2.rundll32.exe.4ee0000.2.unpack100%AviraHEUR/AGEN.1145233Download File
                        10.2.rundll32.exe.44a0000.2.unpack100%AviraHEUR/AGEN.1145233Download File
                        10.2.rundll32.exe.53e0000.20.unpack100%AviraHEUR/AGEN.1145233Download File
                        10.2.rundll32.exe.4f70000.12.unpack100%AviraHEUR/AGEN.1145233Download File
                        10.2.rundll32.exe.51a0000.17.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        4.2.rundll32.exe.5800000.7.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        10.2.rundll32.exe.2a30000.0.unpack100%AviraHEUR/AGEN.1145233Download File
                        10.2.rundll32.exe.5410000.21.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        4.2.rundll32.exe.5a00000.12.unpack100%AviraHEUR/AGEN.1145233Download File
                        4.2.rundll32.exe.58c0000.11.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        10.2.rundll32.exe.4e50000.9.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        0.2.loaddll32.exe.2db0000.1.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                        3.2.rundll32.exe.4650000.0.unpack100%AviraHEUR/AGEN.1145233Download File

                        Domains

                        ⊘No Antivirus matches

                        URLs

                        SourceDetectionScannerLabelLink
                        https://www.disneyplus.com/legal/your-california-privacy-rights0%URL Reputationsafe
                        http://crl.ver)0%Avira URL Cloudsafe
                        https://www.tiktok.com/legal/report/feedback0%URL Reputationsafe
                        https://%s.xboxlive.com0%URL Reputationsafe
                        https://www.disneyplus.com/legal/privacy-policy0%URL Reputationsafe
                        https://dynamic.t0%URL Reputationsafe
                        https://disneyplus.com/legal.0%URL Reputationsafe
                        http://help.disneyplus.com.0%URL Reputationsafe
                        https://%s.dnet.xboxlive.com0%URL Reputationsafe

                        Domains and IPs

                        Contacted Domains

                        ⊘No contacted domains info

                        URLs from Memory and Binaries

                        NameSourceMaliciousAntivirus DetectionReputation
                        https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashxsvchost.exe, 0000000D.00000003.308075068.000002C185450000.00000004.00000001.00020000.00000000.sdmpfalse
                          		high
                          https://www.disneyplus.com/legal/your-california-privacy-rightssvchost.exe, 00000023.00000003.561038722.0000020CDDF5D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000003.560595902.0000020CDDF91000.00000004.00000001.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=svchost.exe, 0000000D.00000003.308475328.000002C185445000.00000004.00000001.00020000.00000000.sdmpfalse
                            		high
                            https://dev.ditu.live.com/REST/v1/Routes/svchost.exe, 0000000D.00000002.309007019.000002C18543E000.00000004.00000001.00020000.00000000.sdmpfalse
                              		high
                              https://dev.virtualearth.net/REST/v1/Routes/Drivingsvchost.exe, 0000000D.00000003.308075068.000002C185450000.00000004.00000001.00020000.00000000.sdmpfalse
                                		high
                                https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashxsvchost.exe, 0000000D.00000002.309007019.000002C18543E000.00000004.00000001.00020000.00000000.sdmpfalse
                                  		high
                                  https://dev.ditu.live.com/REST/v1/Traffic/Incidents/svchost.exe, 0000000D.00000003.308210317.000002C18544B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.309019486.000002C18544D000.00000004.00000001.00020000.00000000.sdmpfalse
                                    		high
                                    https://dev.ditu.live.com/REST/v1/Transit/Stops/svchost.exe, 0000000D.00000002.309044741.000002C18546A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.307872220.000002C185468000.00000004.00000001.00020000.00000000.sdmpfalse
                                      		high
                                      https://t0.tiles.ditu.live.com/tiles/gensvchost.exe, 0000000D.00000003.308361693.000002C18542C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.308991389.000002C18542D000.00000004.00000001.00020000.00000000.sdmpfalse
                                        		high
                                        https://dev.virtualearth.net/REST/v1/Routes/svchost.exe, 0000000D.00000002.309007019.000002C18543E000.00000004.00000001.00020000.00000000.sdmpfalse
                                          		high
                                          https://dev.virtualearth.net/REST/v1/Traffic/Incidents/svchost.exe, 0000000D.00000003.286009108.000002C185430000.00000004.00000001.00020000.00000000.sdmpfalse
                                            		high
                                            https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=svchost.exe, 0000000D.00000003.308372123.000002C185438000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.286009108.000002C185430000.00000004.00000001.00020000.00000000.sdmpfalse
                                              		high
                                              https://dev.virtualearth.net/REST/v1/Routes/Walkingsvchost.exe, 0000000D.00000003.308075068.000002C185450000.00000004.00000001.00020000.00000000.sdmpfalse
                                                		high
                                                https://dev.virtualearth.net/REST/v1/Transit/Stops/svchost.exe, 0000000D.00000003.286009108.000002C185430000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://crl.ver)svchost.exe, 00000007.00000002.613054115.000002885780D000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		low
                                                  https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?svchost.exe, 0000000D.00000003.308361693.000002C18542C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.309015058.000002C185447000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.308429108.000002C185446000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://www.tiktok.com/legal/report/feedbacksvchost.exe, 00000023.00000003.562388514.0000020CDDFAC000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000003.562676725.0000020CDDF95000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000003.562660746.0000020CDDF84000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000003.562744963.0000020CDE402000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000003.562510238.0000020CDDFAC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    • URL Reputation: safe
                                                    		unknown
                                                    https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=svchost.exe, 0000000D.00000002.309007019.000002C18543E000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.308972985.000002C185413000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=svchost.exe, 0000000D.00000002.309011405.000002C185442000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.308572343.000002C185441000.00000004.00000001.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://%s.xboxlive.comsvchost.exe, 0000000B.00000002.771126375.000001F988044000.00000004.00000001.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		low
                                                        https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=svchost.exe, 0000000D.00000003.308361693.000002C18542C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.308991389.000002C18542D000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://dev.virtualearth.net/REST/v1/Locationssvchost.exe, 0000000D.00000003.308075068.000002C185450000.00000004.00000001.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=svchost.exe, 0000000D.00000003.308372123.000002C185438000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.286009108.000002C185430000.00000004.00000001.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://dev.virtualearth.net/mapcontrol/logging.ashxsvchost.exe, 0000000D.00000003.308075068.000002C185450000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://dev.ditu.live.com/mapcontrol/logging.ashxsvchost.exe, 0000000D.00000003.308075068.000002C185450000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://dev.ditu.live.com/REST/v1/Imagery/Copyright/svchost.exe, 0000000D.00000003.308210317.000002C18544B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?entry=svchost.exe, 0000000D.00000003.286009108.000002C185430000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=svchost.exe, 0000000D.00000003.308372123.000002C185438000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.286009108.000002C185430000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=svchost.exe, 0000000D.00000002.309015058.000002C185447000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.308429108.000002C185446000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://www.disneyplus.com/legal/privacy-policysvchost.exe, 00000023.00000003.561038722.0000020CDDF5D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000003.560595902.0000020CDDF91000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                          • URL Reputation: safe
                                                                          		unknown
                                                                          https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/svchost.exe, 0000000D.00000003.308210317.000002C18544B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.309019486.000002C18544D000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://dev.virtualearth.net/REST/v1/Transit/Schedules/svchost.exe, 0000000D.00000002.309011405.000002C185442000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.308572343.000002C185441000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://dynamic.tsvchost.exe, 0000000D.00000003.307980966.000002C185464000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                              • URL Reputation: safe
                                                                              		unknown
                                                                              https://dev.virtualearth.net/REST/v1/Routes/Transitsvchost.exe, 0000000D.00000003.308075068.000002C185450000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://disneyplus.com/legal.svchost.exe, 00000023.00000003.561038722.0000020CDDF5D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000003.560595902.0000020CDDF91000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                • URL Reputation: safe
                                                                                		unknown
                                                                                https://t0.ssl.ak.tiles.virtualearth.net/tiles/gensvchost.exe, 0000000D.00000003.308372123.000002C185438000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.286009108.000002C185430000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.309002264.000002C185438000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=svchost.exe, 0000000D.00000002.309015058.000002C185447000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.308429108.000002C185446000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://ecn.dev.virtualearth.net/mapcontrol/roadshield.ashx?bucket=svchost.exe, 0000000D.00000003.286009108.000002C185430000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://activity.windows.comsvchost.exe, 0000000B.00000002.771126375.000001F988044000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://www.bingmapsportal.comsvchost.exe, 0000000D.00000002.308972985.000002C185413000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://dev.ditu.live.com/REST/v1/Locationssvchost.exe, 0000000D.00000003.308075068.000002C185450000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://dev.virtualearth.net/REST/v1/Imagery/Copyright/svchost.exe, 0000000D.00000003.286009108.000002C185430000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://help.disneyplus.com.svchost.exe, 00000023.00000003.561038722.0000020CDDF5D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000003.560595902.0000020CDDF91000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                              • URL Reputation: safe
                                                                                              		unknown
                                                                                              https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/svchost.exe, 0000000D.00000002.309007019.000002C18543E000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.286009108.000002C185430000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://%s.dnet.xboxlive.comsvchost.exe, 0000000B.00000002.771126375.000001F988044000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                • URL Reputation: safe
                                                                                                		low
                                                                                                https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/svchost.exe, 0000000D.00000003.308210317.000002C18544B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.309019486.000002C18544D000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=svchost.exe, 0000000D.00000003.308210317.000002C18544B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                    		high

                                                                                                    World Map of Contacted IPs

                                                                                                    • No. of IPs < 25%
                                                                                                    • 25% < No. of IPs < 50%
                                                                                                    • 50% < No. of IPs < 75%
                                                                                                    • 75% < No. of IPs

                                                                                                    Public IPs

                                                                                                    IPDomainCountryFlagASNASN NameMalicious
                                                                                                    195.154.133.20
                                                                                                    		unknownFrance
                                                                                                    		12876OnlineSASFRtrue
                                                                                                    185.157.82.211
                                                                                                    		unknownPoland
                                                                                                    		42927S-NET-ASPLtrue
                                                                                                    212.237.17.99
                                                                                                    		unknownItaly
                                                                                                    		31034ARUBA-ASNITtrue
                                                                                                    79.172.212.216
                                                                                                    		unknownHungary
                                                                                                    		61998SZERVERPLEXHUtrue
                                                                                                    110.232.117.186
                                                                                                    		unknownAustralia
                                                                                                    		56038RACKCORP-APRackCorpAUtrue
                                                                                                    173.214.173.220
                                                                                                    		unknownUnited States
                                                                                                    		19318IS-AS-1UStrue
                                                                                                    212.24.98.99
                                                                                                    		unknownLithuania
                                                                                                    		62282RACKRAYUABRakrejusLTtrue
                                                                                                    138.185.72.26
                                                                                                    		unknownBrazil
                                                                                                    		264343EmpasoftLtdaMeBRtrue
                                                                                                    178.63.25.185
                                                                                                    		unknownGermany
                                                                                                    		24940HETZNER-ASDEtrue
                                                                                                    160.16.102.168
                                                                                                    		unknownJapan9370SAKURA-BSAKURAInternetIncJPtrue
                                                                                                    81.0.236.90
                                                                                                    		unknownCzech Republic
                                                                                                    		15685CASABLANCA-ASInternetCollocationProviderCZtrue
                                                                                                    103.75.201.2
                                                                                                    		unknownThailand
                                                                                                    		133496CDNPLUSCOLTD-AS-APCDNPLUSCOLTDTHtrue
                                                                                                    216.158.226.206
                                                                                                    		unknownUnited States
                                                                                                    		19318IS-AS-1UStrue
                                                                                                    45.118.115.99
                                                                                                    		unknownIndonesia
                                                                                                    		131717IDNIC-CIFO-AS-IDPTCitraJelajahInformatikaIDtrue
                                                                                                    51.15.4.22
                                                                                                    		unknownFrance
                                                                                                    		12876OnlineSASFRtrue
                                                                                                    159.89.230.105
                                                                                                    		unknownUnited States
                                                                                                    		14061DIGITALOCEAN-ASNUStrue
                                                                                                    162.214.50.39
                                                                                                    		unknownUnited States
                                                                                                    		46606UNIFIEDLAYER-AS-1UStrue
                                                                                                    200.17.134.35
                                                                                                    		unknownBrazil
                                                                                                    		1916AssociacaoRedeNacionaldeEnsinoePesquisaBRtrue
                                                                                                    217.182.143.207
                                                                                                    		unknownFrance
                                                                                                    		16276OVHFRtrue
                                                                                                    107.182.225.142
                                                                                                    		unknownUnited States
                                                                                                    		32780HOSTINGSERVICES-INCUStrue
                                                                                                    51.38.71.0
                                                                                                    		unknownFrance
                                                                                                    		16276OVHFRtrue
                                                                                                    45.118.135.203
                                                                                                    		unknownJapan63949LINODE-APLinodeLLCUStrue
                                                                                                    50.116.54.215
                                                                                                    		unknownUnited States
                                                                                                    		63949LINODE-APLinodeLLCUStrue
                                                                                                    131.100.24.231
                                                                                                    		unknownBrazil
                                                                                                    		61635GOPLEXTELECOMUNICACOESEINTERNETLTDA-MEBRtrue
                                                                                                    46.55.222.11
                                                                                                    		unknownBulgaria
                                                                                                    		34841BALCHIKNETBGtrue
                                                                                                    41.76.108.46
                                                                                                    		unknownSouth Africa
                                                                                                    		327979DIAMATRIXZAtrue
                                                                                                    173.212.193.249
                                                                                                    		unknownGermany
                                                                                                    		51167CONTABODEtrue
                                                                                                    45.176.232.124
                                                                                                    		unknownColombia
                                                                                                    		267869CABLEYTELECOMUNICACIONESDECOLOMBIASASCABLETELCOCtrue
                                                                                                    178.79.147.66
                                                                                                    		unknownUnited Kingdom
                                                                                                    		63949LINODE-APLinodeLLCUStrue
                                                                                                    212.237.5.209
                                                                                                    		unknownItaly
                                                                                                    		31034ARUBA-ASNITtrue
                                                                                                    162.243.175.63
                                                                                                    		unknownUnited States
                                                                                                    		14061DIGITALOCEAN-ASNUStrue
                                                                                                    176.104.106.96
                                                                                                    		unknownSerbia
                                                                                                    		198371NINETRStrue
                                                                                                    207.38.84.195
                                                                                                    		unknownUnited States
                                                                                                    		30083AS-30083-GO-DADDY-COM-LLCUStrue
                                                                                                    164.68.99.3
                                                                                                    		unknownGermany
                                                                                                    		51167CONTABODEtrue
                                                                                                    192.254.71.210
                                                                                                    		unknownUnited States
                                                                                                    		64235BIGBRAINUStrue
                                                                                                    212.237.56.116
                                                                                                    		unknownItaly
                                                                                                    		31034ARUBA-ASNITtrue
                                                                                                    104.168.155.129
                                                                                                    		unknownUnited States
                                                                                                    		54290HOSTWINDSUStrue
                                                                                                    45.142.114.231
                                                                                                    		unknownGermany
                                                                                                    		44066DE-FIRSTCOLOwwwfirst-colonetDEtrue
                                                                                                    203.114.109.124
                                                                                                    		unknownThailand
                                                                                                    		131293TOT-LLI-AS-APTOTPublicCompanyLimitedTHtrue
                                                                                                    209.59.138.75
                                                                                                    		unknownUnited States
                                                                                                    		32244LIQUIDWEBUStrue
                                                                                                    159.8.59.82
                                                                                                    		unknownUnited States
                                                                                                    		36351SOFTLAYERUStrue
                                                                                                    129.232.188.93
                                                                                                    		unknownSouth Africa
                                                                                                    		37153xneeloZAtrue
                                                                                                    58.227.42.236
                                                                                                    		unknownKorea Republic of
                                                                                                    		9318SKB-ASSKBroadbandCoLtdKRtrue
                                                                                                    158.69.222.101
                                                                                                    		unknownCanada
                                                                                                    		16276OVHFRtrue
                                                                                                    104.251.214.46
                                                                                                    		unknownUnited States
                                                                                                    		54540INCERO-HVVCUStrue

                                                                                                    Private

                                                                                                    IP
                                                                                                    127.0.0.1

                                                                                                    General Information

                                                                                                    Joe Sandbox Version:34.0.0 Boulder Opal
                                                                                                    Analysis ID:562446
                                                                                                    Start date:28.01.2022
                                                                                                    Start time:22:06:22
                                                                                                    Joe Sandbox Product:CloudBasic
                                                                                                    Overall analysis duration:0h 14m 11s
                                                                                                    Hypervisor based Inspection enabled:false
                                                                                                    Report type:full
                                                                                                    Sample file name:G (renamed file extension from none to dll)
                                                                                                    Cookbook file name:default.jbs
                                                                                                    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                                    Number of analysed new started processes analysed:38
                                                                                                    Number of new started drivers analysed:0
                                                                                                    Number of existing processes analysed:0
                                                                                                    Number of existing drivers analysed:0
                                                                                                    Number of injected processes analysed:0
                                                                                                    Technologies:
                                                                                                    • HCA enabled
                                                                                                    • EGA enabled
                                                                                                    • HDC enabled
                                                                                                    • AMSI enabled
                                                                                                    Analysis Mode:default
                                                                                                    Analysis stop reason:Timeout
                                                                                                    Detection:MAL
                                                                                                    Classification:mal92.troj.evad.winDLL@33/9@0/46
                                                                                                    EGA Information:
                                                                                                    • Successful, ratio: 100%
                                                                                                    HDC Information:
                                                                                                    • Successful, ratio: 100% (good quality ratio 81.8%)
                                                                                                    • Quality average: 63.4%
                                                                                                    • Quality standard deviation: 34.5%
                                                                                                    HCA Information:
                                                                                                    • Successful, ratio: 100%
                                                                                                    • Number of executed functions: 23
                                                                                                    • Number of non-executed functions: 143
                                                                                                    Cookbook Comments:
                                                                                                    • Adjust boot time
                                                                                                    • Enable AMSI
                                                                                                    • Override analysis time to 240s for rundll32

                                                                                                    Warnings

                                                                                                    • Exclude process from analysis (whitelisted): audiodg.exe, BackgroundTransferHost.exe, HxTsr.exe, RuntimeBroker.exe, WMIADAP.exe, backgroundTaskHost.exe, wuapihost.exe
                                                                                                    • Excluded IPs from analysis (whitelisted): 204.79.197.200, 13.107.21.200, 2.20.156.69, 92.123.101.234, 84.53.177.16, 8.248.135.254, 67.26.83.254, 8.241.126.121, 8.248.113.254, 8.248.145.254, 20.54.7.98, 40.91.112.76
                                                                                                    • Excluded domains from analysis (whitelisted): fg.download.windowsupdate.com.c.footprint.net, displaycatalog-rp-uswest.md.mp.microsoft.com.akadns.net, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, wus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, www-bing-com.dual-a-0001.a-msedge.net, consumer-displaycatalogrp-aks2aks-uswest.md.mp.microsoft.com.akadns.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, www.bing.com, client.wns.windows.com, fs.microsoft.com, dual-a-0001.a-msedge.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, a-0001.a-afde
                                                                                                    • Not all processes where analyzed, report is missing behavior information
                                                                                                    • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                    • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                    • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                    • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                    • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                    • Report size getting too big, too many NtQueryValueKey calls found.

                                                                                                    Simulations

                                                                                                    Behavior and APIs

                                                                                                    TimeTypeDescription
                                                                                                    22:07:27API Interceptor10x Sleep call for process: svchost.exe modified
                                                                                                    22:08:41API Interceptor1x Sleep call for process: MpCmdRun.exe modified

                                                                                                    Joe Sandbox View / Context

                                                                                                    IPs

                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                    195.154.133.201162545482187818.xlsGet hashmaliciousBrowse
                                                                                                      364453688149503140239183.xlsGet hashmaliciousBrowse
                                                                                                        CJ68000754184.xlsGet hashmaliciousBrowse
                                                                                                          imedpub_2.xlsGet hashmaliciousBrowse
                                                                                                            imedpub_6.xlsGet hashmaliciousBrowse
                                                                                                              imedpub.com_6.xlsGet hashmaliciousBrowse
                                                                                                                imedpub.com_10.xlsGet hashmaliciousBrowse
                                                                                                                  iMedPub LTD_10.xlsGet hashmaliciousBrowse
                                                                                                                    iMedPub LTD_12.xlsGet hashmaliciousBrowse
                                                                                                                      iMedPub LTD_14.xlsGet hashmaliciousBrowse
                                                                                                                        NZW-010122 BNUV-280122.xlsmGet hashmaliciousBrowse
                                                                                                                          iMedPub LTD_15.xlsGet hashmaliciousBrowse
                                                                                                                            iMedPub LTD_2.xlsGet hashmaliciousBrowse
                                                                                                                              iMedPub LTD_3.xlsGet hashmaliciousBrowse
                                                                                                                                iMedPub LTD_7.xlsGet hashmaliciousBrowse
                                                                                                                                  iMedPub LTD_8.xlsGet hashmaliciousBrowse
                                                                                                                                    imedpub.xlsGet hashmaliciousBrowse
                                                                                                                                      InnovincConf_1.xlsGet hashmaliciousBrowse
                                                                                                                                        innovinc.org.xlsGet hashmaliciousBrowse
                                                                                                                                          ANFg7r0v2A.dllGet hashmaliciousBrowse
                                                                                                                                            185.157.82.2111162545482187818.xlsGet hashmaliciousBrowse
                                                                                                                                              364453688149503140239183.xlsGet hashmaliciousBrowse
                                                                                                                                                CJ68000754184.xlsGet hashmaliciousBrowse
                                                                                                                                                  imedpub_2.xlsGet hashmaliciousBrowse
                                                                                                                                                    imedpub_6.xlsGet hashmaliciousBrowse
                                                                                                                                                      imedpub.com_6.xlsGet hashmaliciousBrowse
                                                                                                                                                        imedpub.com_10.xlsGet hashmaliciousBrowse
                                                                                                                                                          iMedPub LTD_10.xlsGet hashmaliciousBrowse
                                                                                                                                                            iMedPub LTD_12.xlsGet hashmaliciousBrowse
                                                                                                                                                              iMedPub LTD_14.xlsGet hashmaliciousBrowse
                                                                                                                                                                NZW-010122 BNUV-280122.xlsmGet hashmaliciousBrowse
                                                                                                                                                                  iMedPub LTD_15.xlsGet hashmaliciousBrowse
                                                                                                                                                                    iMedPub LTD_2.xlsGet hashmaliciousBrowse
                                                                                                                                                                      iMedPub LTD_3.xlsGet hashmaliciousBrowse
                                                                                                                                                                        iMedPub LTD_7.xlsGet hashmaliciousBrowse
                                                                                                                                                                          iMedPub LTD_8.xlsGet hashmaliciousBrowse
                                                                                                                                                                            imedpub.xlsGet hashmaliciousBrowse
                                                                                                                                                                              InnovincConf_1.xlsGet hashmaliciousBrowse
                                                                                                                                                                                innovinc.org.xlsGet hashmaliciousBrowse
                                                                                                                                                                                  ANFg7r0v2A.dllGet hashmaliciousBrowse

                                                                                                                                                                                    Domains

                                                                                                                                                                                    ⊘No context

                                                                                                                                                                                    ASNs

                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                                                    S-NET-ASPL1162545482187818.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 185.157.82.211
                                                                                                                                                                                    364453688149503140239183.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 185.157.82.211
                                                                                                                                                                                    CJ68000754184.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 185.157.82.211
                                                                                                                                                                                    imedpub_2.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 185.157.82.211
                                                                                                                                                                                    imedpub_6.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 185.157.82.211
                                                                                                                                                                                    imedpub.com_6.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 185.157.82.211
                                                                                                                                                                                    imedpub.com_10.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 185.157.82.211
                                                                                                                                                                                    iMedPub LTD_10.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 185.157.82.211
                                                                                                                                                                                    iMedPub LTD_12.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 185.157.82.211
                                                                                                                                                                                    iMedPub LTD_14.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 185.157.82.211
                                                                                                                                                                                    NZW-010122 BNUV-280122.xlsmGet hashmaliciousBrowse
                                                                                                                                                                                    • 185.157.82.211
                                                                                                                                                                                    iMedPub LTD_15.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 185.157.82.211
                                                                                                                                                                                    iMedPub LTD_2.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 185.157.82.211
                                                                                                                                                                                    iMedPub LTD_3.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 185.157.82.211
                                                                                                                                                                                    iMedPub LTD_7.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 185.157.82.211
                                                                                                                                                                                    iMedPub LTD_8.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 185.157.82.211
                                                                                                                                                                                    imedpub.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 185.157.82.211
                                                                                                                                                                                    InnovincConf_1.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 185.157.82.211
                                                                                                                                                                                    innovinc.org.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 185.157.82.211
                                                                                                                                                                                    ANFg7r0v2A.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 185.157.82.211
                                                                                                                                                                                    OnlineSASFRGULPPYUMBy.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 195.154.146.35
                                                                                                                                                                                    1162545482187818.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.15.4.22
                                                                                                                                                                                    AcqQhfewOu.dllGet hashmaliciousBrowse
                                                                                                                                                                                    • 195.154.146.35
                                                                                                                                                                                    364453688149503140239183.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.15.4.22
                                                                                                                                                                                    80_513972285.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 195.154.146.35
                                                                                                                                                                                    Attachment-2801.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 195.154.146.35
                                                                                                                                                                                    CJ68000754184.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.15.4.22
                                                                                                                                                                                    DOCUMENT_2801.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 195.154.146.35
                                                                                                                                                                                    DETAILS-145.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 195.154.146.35
                                                                                                                                                                                    imedpub_2.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.15.4.22
                                                                                                                                                                                    imedpub_6.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.15.4.22
                                                                                                                                                                                    imedpub.com_6.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.15.4.22
                                                                                                                                                                                    imedpub.com_10.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.15.4.22
                                                                                                                                                                                    iMedPub LTD_10.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.15.4.22
                                                                                                                                                                                    iMedPub LTD_12.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.15.4.22
                                                                                                                                                                                    iMedPub LTD_14.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.15.4.22
                                                                                                                                                                                    NZW-010122 BNUV-280122.xlsmGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.15.4.22
                                                                                                                                                                                    iMedPub LTD_15.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.15.4.22
                                                                                                                                                                                    iMedPub LTD_2.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.15.4.22
                                                                                                                                                                                    iMedPub LTD_3.xlsGet hashmaliciousBrowse
                                                                                                                                                                                    • 51.15.4.22

                                                                                                                                                                                    JA3 Fingerprints

                                                                                                                                                                                    ⊘No context

                                                                                                                                                                                    Dropped Files

                                                                                                                                                                                    ⊘No context

                                                                                                                                                                                    Created / dropped Files

                                                                                                                                                                                    C:\ProgramData\Microsoft\Network\Downloader\edb.chk

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8192
                                                                                                                                                                                    Entropy (8bit):0.3593198815979092
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:SnaaD0JcaaD0JwQQU2naaD0JcaaD0JwQQU:4tgJctgJw/tgJctgJw
                                                                                                                                                                                    MD5:BF1DC7D5D8DAD7478F426DF8B3F8BAA6
                                                                                                                                                                                    SHA1:C6B0BDE788F553F865D65F773D8F6A3546887E42
                                                                                                                                                                                    SHA-256:BE47C764C38CA7A90A345BE183F5261E89B98743B5E35989E9A8BE0DA498C0F2
                                                                                                                                                                                    SHA-512:00F2412AA04E09EA19A8315D80BE66D2727C713FC0F5AE6A9334BABA539817F568A98CA3A45B2673282BDD325B8B0E2840A393A4DCFADCB16473F5EAF2AF3180
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.............*..........3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................*.............................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\ProgramData\Microsoft\Network\Downloader\edb.log

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    File Type:MPEG-4 LOAS
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1310720
                                                                                                                                                                                    Entropy (8bit):0.2494191616701416
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:BJiRdfVzkZm3lyf49uyc0ga04PdHS9LrM/oVMUdSRU43:BJiRdwfu2SRU43
                                                                                                                                                                                    MD5:E857A2FEF29FCA8E264531352652DBBC
                                                                                                                                                                                    SHA1:B564D344D0A8A7C9047F3F40580B57BCF419504F
                                                                                                                                                                                    SHA-256:19DB0E4C90D5537312D35784F53D43887DC6E88BCD7477FEAA19F77E00EC4010
                                                                                                                                                                                    SHA-512:2A94DF2F13BE243F3EB8AC38B13B3B18B23E05A708361E111328762A63D1B67B00C2E057131D6865F72813308F1199E5020B756D6553BFA4C63F4E852EF3ECB7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:V.d.........@..@.3...w...........................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.........................................d#.................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    File Type:Extensible storage engine DataBase, version 0x620, checksum 0x52f2e4c5, page size 16384, Windows version 10.0
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):786432
                                                                                                                                                                                    Entropy (8bit):0.2506927879454543
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:0Hl+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:0HWSB2nSB2RSjlK/+mLesOj1J2
                                                                                                                                                                                    MD5:A83BEC41E55D05CE038BDC7A1018DCAD
                                                                                                                                                                                    SHA1:41AE1956D9807AF9D55AE32E53835D32B669FDBF
                                                                                                                                                                                    SHA-256:40AEE4CD8D6D844DABCE7B418195283FD7C961DD0726497225C9C157EC71BA5B
                                                                                                                                                                                    SHA-512:6D042B6A2A44E7A56B32B11EB2FC7DFF238F8C4491659B054588D968B2BB5F65600F2767DE25C303B5DE3A722703E8EEF5B6DFBEC619B8D756230AE9C1FE0791
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:R...... ................e.f.3...w........................).....'....z.......z..h.(.....'....z....)..............3...w...........................................................................................................B...........@...................................................................................................... .....................................................................................................................................................................................................................................................'....z.....................'....z..........................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):16384
                                                                                                                                                                                    Entropy (8bit):0.07555734692185856
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:IAtJ7v+mEtl6EW5GNzNOKtloll3Vkttlmlnl:IAtJr+mZE0GFE3
                                                                                                                                                                                    MD5:301EB1441EF64B67B28B4FEC7DC4CF2F
                                                                                                                                                                                    SHA1:65B4C002D9302CC22A5AC4B92205193E412A2C0C
                                                                                                                                                                                    SHA-256:86AC0659194C5E57ACBEF2CB67FEEC036FC5AC44A6CE70D4672F8BB8D5DAC4FE
                                                                                                                                                                                    SHA-512:5E77FCA47BDCC57B6ABE632B8E8840BA4BB8F4F8F9ACEE982DDA8BC83C639E395D4644C3402642355D8FACE3464522D41DCA15F58A185121A752F14E55D47E16
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........................................3...w.......z..'....z..........'....z..'....z..j..'....z.....................'....z..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                    File Type:Microsoft Cabinet archive data, 61414 bytes, 1 file
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):61414
                                                                                                                                                                                    Entropy (8bit):7.995245868798237
                                                                                                                                                                                    Encrypted:true
                                                                                                                                                                                    SSDEEP:1536:EysgU6qmzixT64jYMZ8HbVPGfVDwm/xLZ9rP:wF6qmeo4eH1m9wmLvrP
                                                                                                                                                                                    MD5:ACAEDA60C79C6BCAC925EEB3653F45E0
                                                                                                                                                                                    SHA1:2AAAE490BCDACCC6172240FF1697753B37AC5578
                                                                                                                                                                                    SHA-256:6B0CECCF0103AFD89844761417C1D23ACC41F8AEBF3B7230765209B61EEE5658
                                                                                                                                                                                    SHA-512:FEAA6E7ED7DDA1583739B3E531AB5C562A222EE6ECD042690AE7DCFF966717C6E968469A7797265A11F6E899479AE0F3031E8CF5BEBE1492D5205E9C59690900
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:MSCF............,...................I.......;w........RSNj .authroot.stl..>.(.5..CK..8T....c_.d...A.K...+.d.H..*i.RJJ.IQIR..$t)Kd.-[..T\{..ne......<.w......A..B........c...wi......D....c.0D,L........fy....Rg...=........i,3.3..Z....~^ve<...TF.*...f.zy.,...m.@.0.0...m.3..I(..+..v#...(.2....e...L..*y..V.......~U...."<ke.....l.X:Dt..R<7.5\A7L0=..T.V...IDr..8<....r&...I-.^..b.b.".Af....E.._..r.>.`;,.Hob..S.....7'..\.R$.".g..+..64..@nP.....k3...B.`.G..@D.....L.....`^...#OpW.....!....`.....rf:.}.R.@....gR.#7....l..H.#...d.Qh..3..fCX....==#..M.l..~&....[.J9.\..Ww.....Tx.%....]..a4E...q.+...#.*a..x..O..V.t..Y1!.T..`U...-...< _@...|(.....0..3.`.LU...E0.Gu.4KN....5...?.....I.p..'..........N<.d.O..dH@c1t...[w/...T....cYK.X>.0..Z.....O>..9.3.#9X.%.b...5.YK.E.V.....`./.3.._..nN]..=..M.o.F.._..z....._...gY..!Z..?l....vp.l.:.d.Z..W.....~...N.._.k...&.....$......i.F.d.....D!e.....Y..,.E..m.;.1... $.F..O.F.o_}.uG....,.%.>,.Zx.......o....c../.;....g&.....

                                                                                                                                                                                    C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:modified
                                                                                                                                                                                    Size (bytes):328
                                                                                                                                                                                    Entropy (8bit):3.124456801251152
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6:kKyVpk8SN+SkQlPlEGYRMY9z+4KlDA3RUeYlUmlUR/t:I9kPlE99SNxAhUeYlUSA/t
                                                                                                                                                                                    MD5:70B33AF3E5D8CD74F67DB50884A8A843
                                                                                                                                                                                    SHA1:A315017EE23DAFF1E11651BD844E61D026C5592A
                                                                                                                                                                                    SHA-256:A3E355C0DE56B896F4348EA363F6A189014553E76E0D8EA9570FCBC0745F0F7C
                                                                                                                                                                                    SHA-512:4AEC4BE0871CEEEF8CF82282743E5768239946E17FF67813AD2A8DE47A0FCF31EEB9A365F9B81C5F5FAC6232B8FD385F78B407B141CEFEF1A8CC973423BF9DFC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:p...... ...............(....................................................... ........q.\].......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.7.1.e.1.5.c.5.d.c.4.d.7.1.:.0."...

                                                                                                                                                                                    C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):55
                                                                                                                                                                                    Entropy (8bit):4.306461250274409
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                                                                                                                    MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                                                                                                                    SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                                                                                                                    SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                                                                                                                    SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                                                                                                                                    C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                    File Type:Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
                                                                                                                                                                                    Category:modified
                                                                                                                                                                                    Size (bytes):7250
                                                                                                                                                                                    Entropy (8bit):3.1656561873025773
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:cEj+AbCEH+AbuEAc+AbhGEA+AbNEe+Ab/Ee+AbPE6w9+Ab1wTEU+AbN:cY+38+DJc+iGr+MZ+65+6tg+ECf+k
                                                                                                                                                                                    MD5:FC51C55256A49DF627F2FAE9FB9ECFA4
                                                                                                                                                                                    SHA1:E71C9548E61C94E09819590A75B83860B9A31550
                                                                                                                                                                                    SHA-256:CC1F122A9A20EE7774BB639A47401B7DF501F129DE46432CFD4717AFDA8D8AF3
                                                                                                                                                                                    SHA-512:8F4D57B2C54BAE32702036208DFF7FA607F621E9252D9EC4C8BE14CBBAC01B20F6238C69D0836E38A0E13DE8A34EB4558D967732AFD883D7BF3C263A0BF76DE0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....E.R.R.O.R.:. .M.p.W.D.E.n.a.b.l.e.(.T.R.U.E.). .f.a.i.l.e.d. .(.8.0.0.7.0.4.E.C.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.............-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.

                                                                                                                                                                                    C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20220129_060738_769.etl

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12288
                                                                                                                                                                                    Entropy (8bit):3.7647535863641495
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:kCXdu2o+0wK51u912YhmC6vI2lbSkfP4olT2rYFzFUMCV6JRefiY5EUMCjY5VUMM:fvlkA92cCjCOxCSCcCUCLCo
                                                                                                                                                                                    MD5:DF75CDBAB997D6A53699F1AB7BFF9803
                                                                                                                                                                                    SHA1:D32B7AD9E2EFBCF8B0255D5173DE6BFBAA0AE376
                                                                                                                                                                                    SHA-256:7841B26BD8062698D4347543D28C5398663CE316E92198968B396D87DC45EBFC
                                                                                                                                                                                    SHA-512:9F1BB1422DE62B83A225E023EF7BC03E75D540C1317E6D4B105089025FD1D8276AE118B9B09A37EA6D3F3C0235389DC4CF7151D6F5837E0444A4862417ACD1AA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.... ... ....................................... ...!...........................T...D...2........................B..............Zb... ... ..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................./_8..... ....................8.6.9.6.E.A.C.4.-.1.2.8.8.-.4.2.8.8.-.A.4.E.E.-.4.9.E.E.4.3.1.B.0.A.D.9...C.:.\.W.i.n.d.o.w.s.\.S.e.r.v.i.c.e.P.r.o.f.i.l.e.s.\.N.e.t.w.o.r.k.S.e.r.v.i.c.e.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.D.e.l.i.v.e.r.y.O.p.t.i.m.i.z.a.t.i.o.n.\.L.o.g.s.\.d.o.s.v.c...2.0.2.2.0.1.2.9._.0.6.0.7.3.8._.7.6.9...e.t.l.........P.P.T...D...2.......................................................................................................................................................................................................................................................................

                                                                                                                                                                                    Static File Info

                                                                                                                                                                                    General

                                                                                                                                                                                    File type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                    Entropy (8bit):6.980525357469701
                                                                                                                                                                                    TrID:
                                                                                                                                                                                    • Win32 Dynamic Link Library (generic) (1002004/3) 99.60%
                                                                                                                                                                                    • Generic Win/DOS Executable (2004/3) 0.20%
                                                                                                                                                                                    • DOS Executable Generic (2002/1) 0.20%
                                                                                                                                                                                    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                    File name:G.dll
                                                                                                                                                                                    File size:548864
                                                                                                                                                                                    MD5:630b6dad3884c5f5d7ed81c5bb29cdbb
                                                                                                                                                                                    SHA1:a613c00841a31bc27a0c9bdf4f210d6c6aceaac6
                                                                                                                                                                                    SHA256:d393bc3918eb1f83e3e3b481ada09a63931b366137e5a7c5542f32ac4ddad4bb
                                                                                                                                                                                    SHA512:bdc13049601a329d46fa28ad304b2cf2f46cea27dee58105dd58933340c338a975c71202094ad5b7107c31216698070956461ca2d49171859b583807dd94773e
                                                                                                                                                                                    SSDEEP:12288:B2AavzUBPSczbeeTLjvZyMwWd3DYr6i64/:OUBPSczbeeTnvNZDWA
                                                                                                                                                                                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......hs.a,..2,..2,..2...2&..2...27..2,..2...2...26..2...2...2...2...2...2-..2...2-..2...2-..2Rich,..2................PE..L...>..a...

                                                                                                                                                                                    File Icon

                                                                                                                                                                                    Icon Hash:74f0e4ecccdce0e4

                                                                                                                                                                                    Static PE Info

                                                                                                                                                                                    General

                                                                                                                                                                                    Entrypoint:0x10030d06
                                                                                                                                                                                    Entrypoint Section:.text
                                                                                                                                                                                    Digitally signed:false
                                                                                                                                                                                    Imagebase:0x10000000
                                                                                                                                                                                    Subsystem:windows gui
                                                                                                                                                                                    Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                                                                                                                                                                                    DLL Characteristics:
                                                                                                                                                                                    Time Stamp:0x61F3FA3E [Fri Jan 28 14:14:22 2022 UTC]
                                                                                                                                                                                    TLS Callbacks:
                                                                                                                                                                                    CLR (.Net) Version:
                                                                                                                                                                                    OS Version Major:4
                                                                                                                                                                                    OS Version Minor:0
                                                                                                                                                                                    File Version Major:4
                                                                                                                                                                                    File Version Minor:0
                                                                                                                                                                                    Subsystem Version Major:4
                                                                                                                                                                                    Subsystem Version Minor:0
                                                                                                                                                                                    Import Hash:f4d2f65566a93075f8824e97bf321580

                                                                                                                                                                                    Entrypoint Preview

                                                                                                                                                                                    Instruction
                                                                                                                                                                                    cmp dword ptr [esp+08h], 01h
                                                                                                                                                                                    jne 00007F4AF0A91687h
                                                                                                                                                                                    call 00007F4AF0A999E0h
                                                                                                                                                                                    push dword ptr [esp+04h]
                                                                                                                                                                                    mov ecx, dword ptr [esp+10h]
                                                                                                                                                                                    mov edx, dword ptr [esp+0Ch]
                                                                                                                                                                                    call 00007F4AF0A91572h
                                                                                                                                                                                    pop ecx
                                                                                                                                                                                    retn 000Ch
                                                                                                                                                                                    push eax
                                                                                                                                                                                    push dword ptr fs:[00000000h]
                                                                                                                                                                                    lea eax, dword ptr [esp+0Ch]
                                                                                                                                                                                    sub esp, dword ptr [esp+0Ch]
                                                                                                                                                                                    push ebx
                                                                                                                                                                                    push esi
                                                                                                                                                                                    push edi
                                                                                                                                                                                    mov dword ptr [eax], ebp
                                                                                                                                                                                    mov ebp, eax
                                                                                                                                                                                    mov eax, dword ptr [100545CCh]
                                                                                                                                                                                    xor eax, ebp
                                                                                                                                                                                    push eax
                                                                                                                                                                                    push dword ptr [ebp-04h]
                                                                                                                                                                                    mov dword ptr [ebp-04h], FFFFFFFFh
                                                                                                                                                                                    lea eax, dword ptr [ebp-0Ch]
                                                                                                                                                                                    mov dword ptr fs:[00000000h], eax
                                                                                                                                                                                    ret
                                                                                                                                                                                    push eax
                                                                                                                                                                                    push dword ptr fs:[00000000h]
                                                                                                                                                                                    lea eax, dword ptr [esp+0Ch]
                                                                                                                                                                                    sub esp, dword ptr [esp+0Ch]
                                                                                                                                                                                    push ebx
                                                                                                                                                                                    push esi
                                                                                                                                                                                    push edi
                                                                                                                                                                                    mov dword ptr [eax], ebp
                                                                                                                                                                                    mov ebp, eax
                                                                                                                                                                                    mov eax, dword ptr [100545CCh]
                                                                                                                                                                                    xor eax, ebp
                                                                                                                                                                                    push eax
                                                                                                                                                                                    mov dword ptr [ebp-10h], esp
                                                                                                                                                                                    push dword ptr [ebp-04h]
                                                                                                                                                                                    mov dword ptr [ebp-04h], FFFFFFFFh
                                                                                                                                                                                    lea eax, dword ptr [ebp-0Ch]
                                                                                                                                                                                    mov dword ptr fs:[00000000h], eax
                                                                                                                                                                                    ret
                                                                                                                                                                                    push eax
                                                                                                                                                                                    push dword ptr fs:[00000000h]
                                                                                                                                                                                    lea eax, dword ptr [esp+0Ch]
                                                                                                                                                                                    sub esp, dword ptr [esp+0Ch]
                                                                                                                                                                                    push ebx
                                                                                                                                                                                    push esi
                                                                                                                                                                                    push edi
                                                                                                                                                                                    mov dword ptr [eax], ebp
                                                                                                                                                                                    mov ebp, eax
                                                                                                                                                                                    mov eax, dword ptr [100545CCh]
                                                                                                                                                                                    xor eax, ebp
                                                                                                                                                                                    push eax
                                                                                                                                                                                    mov dword ptr [ebp-10h], eax
                                                                                                                                                                                    push dword ptr [ebp-04h]
                                                                                                                                                                                    mov dword ptr [ebp-04h], FFFFFFFFh
                                                                                                                                                                                    lea eax, dword ptr [ebp-0Ch]
                                                                                                                                                                                    mov dword ptr fs:[00000000h], eax
                                                                                                                                                                                    ret
                                                                                                                                                                                    push eax
                                                                                                                                                                                    push dword ptr fs:[00000000h]

                                                                                                                                                                                    Rich Headers

                                                                                                                                                                                    Programming Language:
                                                                                                                                                                                    • [RES] VS2005 build 50727
                                                                                                                                                                                    • [ C ] VS2005 build 50727
                                                                                                                                                                                    • [EXP] VS2005 build 50727
                                                                                                                                                                                    • [C++] VS2005 build 50727
                                                                                                                                                                                    • [ASM] VS2005 build 50727
                                                                                                                                                                                    • [LNK] VS2005 build 50727

                                                                                                                                                                                    Data Directories

                                                                                                                                                                                    NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x52d400x52.rdata
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IMPORT0x510340x104.rdata
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0x5a0000x25650.rsrc
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x800000x4e30.reloc
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x4bd900x40.rdata
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IAT0x460000x594.rdata
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x50fac0x40.rdata
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                    Sections

                                                                                                                                                                                    NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                    .text0x10000x445390x45000False0.469899937726data6.61746201386IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                    .rdata0x460000xcd920xd000False0.33779672476data5.22505682142IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                    .data0x530000x65800x3000False0.2626953125PGP symmetric key encrypted data -4.05344995258IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                    .rsrc0x5a0000x256500x26000False0.91111353824data7.81782767468IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                    .reloc0x800000x93620xa000False0.346728515625data4.18207580283IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                    Resources

                                                                                                                                                                                    NameRVASizeTypeLanguageCountry
                                                                                                                                                                                    DASHBOARD0x5ab040x21600dataChineseTaiwan
                                                                                                                                                                                    RT_CURSOR0x7c1040x134dataChineseTaiwan
                                                                                                                                                                                    RT_CURSOR0x7c2380xb4dataChineseTaiwan
                                                                                                                                                                                    RT_CURSOR0x7c2ec0x134AmigaOS bitmap fontChineseTaiwan
                                                                                                                                                                                    RT_CURSOR0x7c4200x134dataChineseTaiwan
                                                                                                                                                                                    RT_CURSOR0x7c5540x134dataChineseTaiwan
                                                                                                                                                                                    RT_CURSOR0x7c6880x134dataChineseTaiwan
                                                                                                                                                                                    RT_CURSOR0x7c7bc0x134dataChineseTaiwan
                                                                                                                                                                                    RT_CURSOR0x7c8f00x134dataChineseTaiwan
                                                                                                                                                                                    RT_CURSOR0x7ca240x134dataChineseTaiwan
                                                                                                                                                                                    RT_CURSOR0x7cb580x134dataChineseTaiwan
                                                                                                                                                                                    RT_CURSOR0x7cc8c0x134dataChineseTaiwan
                                                                                                                                                                                    RT_CURSOR0x7cdc00x134dataChineseTaiwan
                                                                                                                                                                                    RT_CURSOR0x7cef40x134AmigaOS bitmap fontChineseTaiwan
                                                                                                                                                                                    RT_CURSOR0x7d0280x134dataChineseTaiwan
                                                                                                                                                                                    RT_CURSOR0x7d15c0x134dataChineseTaiwan
                                                                                                                                                                                    RT_CURSOR0x7d2900x134dataChineseTaiwan
                                                                                                                                                                                    RT_BITMAP0x7d3c40xb8dataChineseTaiwan
                                                                                                                                                                                    RT_BITMAP0x7d47c0x144dataChineseTaiwan
                                                                                                                                                                                    RT_DIALOG0x7d5c00x148dataChineseTaiwan
                                                                                                                                                                                    RT_DIALOG0x7d7080x26adataChineseTaiwan
                                                                                                                                                                                    RT_DIALOG0x7d9740xe8dataChineseTaiwan
                                                                                                                                                                                    RT_DIALOG0x7da5c0x34dataChineseTaiwan
                                                                                                                                                                                    RT_STRING0x7da900x58dataChineseTaiwan
                                                                                                                                                                                    RT_STRING0x7dae80x82dataChineseTaiwan
                                                                                                                                                                                    RT_STRING0x7db6c0x2adataChineseTaiwan
                                                                                                                                                                                    RT_STRING0x7db980x192dataChineseTaiwan
                                                                                                                                                                                    RT_STRING0x7dd2c0x4e2dataChineseTaiwan
                                                                                                                                                                                    RT_STRING0x7e2100x31adataChineseTaiwan
                                                                                                                                                                                    RT_STRING0x7e52c0x2dcdataChineseTaiwan
                                                                                                                                                                                    RT_STRING0x7e8080x8adataChineseTaiwan
                                                                                                                                                                                    RT_STRING0x7e8940xacdataChineseTaiwan
                                                                                                                                                                                    RT_STRING0x7e9400xdedataChineseTaiwan
                                                                                                                                                                                    RT_STRING0x7ea200x4c4dataChineseTaiwan
                                                                                                                                                                                    RT_STRING0x7eee40x264dataChineseTaiwan
                                                                                                                                                                                    RT_STRING0x7f1480x2cdataChineseTaiwan
                                                                                                                                                                                    RT_STRING0x7f1740x42dataChineseTaiwan
                                                                                                                                                                                    RT_GROUP_CURSOR0x7f1b80x22Lotus unknown worksheet or configuration, revision 0x2ChineseTaiwan
                                                                                                                                                                                    RT_GROUP_CURSOR0x7f1dc0x14Lotus unknown worksheet or configuration, revision 0x1ChineseTaiwan
                                                                                                                                                                                    RT_GROUP_CURSOR0x7f1f00x14Lotus unknown worksheet or configuration, revision 0x1ChineseTaiwan
                                                                                                                                                                                    RT_GROUP_CURSOR0x7f2040x14Lotus unknown worksheet or configuration, revision 0x1ChineseTaiwan
                                                                                                                                                                                    RT_GROUP_CURSOR0x7f2180x14Lotus unknown worksheet or configuration, revision 0x1ChineseTaiwan
                                                                                                                                                                                    RT_GROUP_CURSOR0x7f22c0x14Lotus unknown worksheet or configuration, revision 0x1ChineseTaiwan
                                                                                                                                                                                    RT_GROUP_CURSOR0x7f2400x14Lotus unknown worksheet or configuration, revision 0x1ChineseTaiwan
                                                                                                                                                                                    RT_GROUP_CURSOR0x7f2540x14Lotus unknown worksheet or configuration, revision 0x1ChineseTaiwan
                                                                                                                                                                                    RT_GROUP_CURSOR0x7f2680x14Lotus unknown worksheet or configuration, revision 0x1ChineseTaiwan
                                                                                                                                                                                    RT_GROUP_CURSOR0x7f27c0x14Lotus unknown worksheet or configuration, revision 0x1ChineseTaiwan
                                                                                                                                                                                    RT_GROUP_CURSOR0x7f2900x14Lotus unknown worksheet or configuration, revision 0x1ChineseTaiwan
                                                                                                                                                                                    RT_GROUP_CURSOR0x7f2a40x14Lotus unknown worksheet or configuration, revision 0x1ChineseTaiwan
                                                                                                                                                                                    RT_GROUP_CURSOR0x7f2b80x14Lotus unknown worksheet or configuration, revision 0x1ChineseTaiwan
                                                                                                                                                                                    RT_GROUP_CURSOR0x7f2cc0x14Lotus unknown worksheet or configuration, revision 0x1ChineseTaiwan
                                                                                                                                                                                    RT_GROUP_CURSOR0x7f2e00x14Lotus unknown worksheet or configuration, revision 0x1ChineseTaiwan
                                                                                                                                                                                    RT_VERSION0x7f2f40x304dataChineseTaiwan
                                                                                                                                                                                    RT_MANIFEST0x7f5f80x56ASCII text, with CRLF line terminatorsEnglishUnited States

                                                                                                                                                                                    Imports

                                                                                                                                                                                    DLLImport
                                                                                                                                                                                    KERNEL32.dllFileTimeToSystemTime, FileTimeToLocalFileTime, GetFileAttributesA, GetFileTime, GetTickCount, RtlUnwind, GetSystemInfo, HeapReAlloc, GetCommandLineA, ExitProcess, ExitThread, CreateThread, RaiseException, HeapSize, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, Sleep, HeapDestroy, HeapCreate, GetStdHandle, GetOEMCP, GetFileType, GetStartupInfoA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, GetSystemTimeAsFileTime, GetACP, GetStringTypeA, GetStringTypeW, GetTimeZoneInformation, GetConsoleCP, GetConsoleMode, LCMapStringA, LCMapStringW, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, SetEnvironmentVariableA, GetCPInfo, CreateFileA, GetFullPathNameA, GetVolumeInformationA, FindFirstFileA, FindClose, GetCurrentProcess, DuplicateHandle, GetThreadLocale, GetFileSize, SetEndOfFile, UnlockFile, LockFile, FlushFileBuffers, SetFilePointer, WriteFile, ReadFile, InterlockedIncrement, TlsFree, DeleteCriticalSection, LocalReAlloc, TlsSetValue, TlsAlloc, InitializeCriticalSection, GlobalHandle, GlobalReAlloc, EnterCriticalSection, TlsGetValue, LeaveCriticalSection, LocalAlloc, GlobalFlags, FormatMessageA, LocalFree, InterlockedDecrement, MulDiv, GlobalGetAtomNameA, GlobalFindAtomA, lstrcmpW, GetVersionExA, WritePrivateProfileStringA, GlobalUnlock, GlobalFree, FreeResource, GetCurrentProcessId, GlobalAddAtomA, CreateEventA, SuspendThread, SetEvent, WaitForSingleObject, ResumeThread, SetThreadPriority, CloseHandle, GetCurrentThread, GetCurrentThreadId, ConvertDefaultLocale, GetModuleFileNameA, EnumResourceLanguagesA, GetLocaleInfoA, GlobalLock, lstrcmpA, GlobalAlloc, GlobalDeleteAtom, GetModuleHandleA, GetLastError, lstrlenA, CompareStringA, CompareStringW, MultiByteToWideChar, InterlockedExchange, GetVersion, WideCharToMultiByte, LockResource, FindResourceA, FindResourceW, LoadResource, SizeofResource, HeapFree, GetNativeSystemInfo, GetProcessHeap, HeapAlloc, FreeLibrary, GetProcAddress, LoadLibraryA, IsBadReadPtr, VirtualProtect, SetLastError, VirtualAlloc, VirtualFree, SetHandleCount, VirtualQuery
                                                                                                                                                                                    USER32.dllGetNextDlgGroupItem, MessageBeep, UnregisterClassA, RegisterClipboardFormatA, PostThreadMessageA, LoadCursorA, SetCapture, DestroyMenu, EndPaint, BeginPaint, GetWindowDC, ClientToScreen, GrayStringA, DrawTextExA, DrawTextA, TabbedTextOutA, ShowWindow, MoveWindow, SetWindowTextA, IsDialogMessageA, RegisterWindowMessageA, SendDlgItemMessageA, WinHelpA, GetCapture, GetClassLongA, GetClassNameA, SetPropA, GetPropA, RemovePropA, SetFocus, GetWindowTextLengthA, GetWindowTextA, GetForegroundWindow, InvalidateRgn, GetTopWindow, UnhookWindowsHookEx, GetMessageTime, GetMessagePos, MapWindowPoints, SetForegroundWindow, UpdateWindow, GetMenu, GetSubMenu, GetMenuItemID, GetMenuItemCount, CreateWindowExA, GetClassInfoExA, GetClassInfoA, RegisterClassA, GetSysColor, AdjustWindowRectEx, EqualRect, PtInRect, GetDlgCtrlID, DefWindowProcA, CallWindowProcA, OffsetRect, IntersectRect, SystemParametersInfoA, GetWindowPlacement, GetWindowRect, ReleaseDC, GetDC, CopyRect, SetWindowLongA, GetWindowLongA, GetSystemMetrics, DrawIcon, AppendMenuA, SendMessageA, GetWindow, SetWindowContextHelpId, MapDialogRect, SetWindowPos, GetDesktopWindow, SetActiveWindow, CreateDialogIndirectParamA, DestroyWindow, IsWindow, GetDlgItem, GetNextDlgTabItem, EndDialog, GetWindowThreadProcessId, InvalidateRect, SetRect, IsRectEmpty, CopyAcceleratorTableA, CharNextA, GetLastActivePopup, IsWindowEnabled, GetSysColorBrush, ReleaseCapture, GetSystemMenu, IsIconic, GetClientRect, EnableWindow, LoadIconA, CharUpperA, PostQuitMessage, PostMessageA, CheckMenuItem, EnableMenuItem, GetMenuState, ModifyMenuA, GetParent, GetFocus, LoadBitmapA, GetMenuCheckMarkDimensions, SetMenuItemBitmaps, ValidateRect, GetCursorPos, PeekMessageA, GetKeyState, IsWindowVisible, GetActiveWindow, DispatchMessageA, TranslateMessage, GetMessageA, CallNextHookEx, SetWindowsHookExA, SetCursor, MessageBoxA, IsChild
                                                                                                                                                                                    GDI32.dllExtSelectClipRgn, DeleteDC, GetStockObject, GetDeviceCaps, GetBkColor, GetTextColor, GetRgnBox, GetMapMode, ScaleWindowExtEx, SetWindowExtEx, ScaleViewportExtEx, SetViewportExtEx, OffsetViewportOrgEx, SetViewportOrgEx, SelectObject, Escape, ExtTextOutA, CreateBitmap, RectVisible, PtVisible, GetWindowExtEx, GetViewportExtEx, DeleteObject, SetMapMode, RestoreDC, SaveDC, GetObjectA, SetBkColor, SetTextColor, GetClipBox, CreateRectRgnIndirect, TextOutA
                                                                                                                                                                                    comdlg32.dllGetFileTitleA
                                                                                                                                                                                    WINSPOOL.DRVDocumentPropertiesA, OpenPrinterA, ClosePrinter
                                                                                                                                                                                    ADVAPI32.dllRegQueryValueA, RegSetValueExA, RegCreateKeyExA, RegCloseKey, RegOpenKeyA, RegEnumKeyA, RegDeleteKeyA, RegOpenKeyExA, RegQueryValueExA
                                                                                                                                                                                    COMCTL32.dllInitCommonControlsEx
                                                                                                                                                                                    SHLWAPI.dllPathFindFileNameA, PathStripToRootA, PathFindExtensionA, PathIsUNCA
                                                                                                                                                                                    WS2_32.dllrecv, connect, WSACleanup, socket, WSAStartup, htons, inet_addr, closesocket, send
                                                                                                                                                                                    oledlg.dll
                                                                                                                                                                                    ole32.dllStgOpenStorageOnILockBytes, CoGetClassObject, CoTaskMemAlloc, StgCreateDocfileOnILockBytes, CoTaskMemFree, CLSIDFromString, CLSIDFromProgID, CreateILockBytesOnHGlobal, CoRegisterMessageFilter, OleFlushClipboard, OleIsCurrentClipboard, CoRevokeClassObject, OleInitialize, CoFreeUnusedLibraries, OleUninitialize
                                                                                                                                                                                    OLEAUT32.dllSysAllocStringLen, VariantClear, VariantChangeType, VariantInit, SysStringLen, SysAllocStringByteLen, OleCreateFontIndirect, VariantTimeToSystemTime, SystemTimeToVariantTime, SafeArrayDestroy, SysAllocString, VariantCopy, SysFreeString

                                                                                                                                                                                    Exports

                                                                                                                                                                                    NameOrdinalAddress
                                                                                                                                                                                    DllRegisterServer10x10012860

                                                                                                                                                                                    Version Infos

                                                                                                                                                                                    DescriptionData
                                                                                                                                                                                    LegalCopyrightInnoversal. All rights reserved.
                                                                                                                                                                                    InternalNameFinalChatSocketCli.exe
                                                                                                                                                                                    FileVersion1.0.2.4
                                                                                                                                                                                    CompanyNameInnoversal
                                                                                                                                                                                    ProductNameChar room only
                                                                                                                                                                                    ProductVersion1.0.2.4
                                                                                                                                                                                    FileDescriptionChat room
                                                                                                                                                                                    OriginalFilenameFinalChatSocketCli.exe
                                                                                                                                                                                    Translation0x0404 0x03b6

                                                                                                                                                                                    Possible Origin

                                                                                                                                                                                    Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                    ChineseTaiwan
                                                                                                                                                                                    EnglishUnited States

                                                                                                                                                                                    Network Behavior

                                                                                                                                                                                    Network Port Distribution

                                                                                                                                                                                    TCP Packets

                                                                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                    Jan 28, 2022 22:07:53.350701094 CET4976880192.168.2.5160.16.102.168
                                                                                                                                                                                    Jan 28, 2022 22:07:53.655407906 CET8049768160.16.102.168192.168.2.5
                                                                                                                                                                                    Jan 28, 2022 22:07:53.655544996 CET4976880192.168.2.5160.16.102.168
                                                                                                                                                                                    Jan 28, 2022 22:07:54.820058107 CET4976880192.168.2.5160.16.102.168
                                                                                                                                                                                    Jan 28, 2022 22:07:55.124425888 CET8049768160.16.102.168192.168.2.5
                                                                                                                                                                                    Jan 28, 2022 22:07:55.139054060 CET8049768160.16.102.168192.168.2.5
                                                                                                                                                                                    Jan 28, 2022 22:07:55.139079094 CET8049768160.16.102.168192.168.2.5
                                                                                                                                                                                    Jan 28, 2022 22:07:55.139134884 CET4976880192.168.2.5160.16.102.168
                                                                                                                                                                                    Jan 28, 2022 22:07:55.139163017 CET4976880192.168.2.5160.16.102.168
                                                                                                                                                                                    Jan 28, 2022 22:08:00.040966034 CET4976880192.168.2.5160.16.102.168
                                                                                                                                                                                    Jan 28, 2022 22:08:00.345963001 CET8049768160.16.102.168192.168.2.5
                                                                                                                                                                                    Jan 28, 2022 22:08:00.346338034 CET4976880192.168.2.5160.16.102.168
                                                                                                                                                                                    Jan 28, 2022 22:08:00.351422071 CET4976880192.168.2.5160.16.102.168
                                                                                                                                                                                    Jan 28, 2022 22:08:00.694885015 CET8049768160.16.102.168192.168.2.5
                                                                                                                                                                                    Jan 28, 2022 22:08:01.515592098 CET8049768160.16.102.168192.168.2.5
                                                                                                                                                                                    Jan 28, 2022 22:08:01.517086029 CET4976880192.168.2.5160.16.102.168
                                                                                                                                                                                    Jan 28, 2022 22:08:04.515413046 CET8049768160.16.102.168192.168.2.5
                                                                                                                                                                                    Jan 28, 2022 22:08:04.515451908 CET8049768160.16.102.168192.168.2.5
                                                                                                                                                                                    Jan 28, 2022 22:08:04.516236067 CET4976880192.168.2.5160.16.102.168
                                                                                                                                                                                    Jan 28, 2022 22:09:43.295095921 CET4976880192.168.2.5160.16.102.168
                                                                                                                                                                                    Jan 28, 2022 22:09:43.295161963 CET4976880192.168.2.5160.16.102.168

                                                                                                                                                                                    HTTP Packets

                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                                                    0192.168.2.549768160.16.102.16880C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                    TimestampkBytes transferredDirectionData
                                                                                                                                                                                    Jan 28, 2022 22:07:54.820058107 CET1460OUTData Raw: 16 03 03 00 8a 01 00 00 86 03 03 61 f4 d9 ba 1a 18 24 e2 7f 56 04 14 e4 1a 5e 1b 58 9c bf 99 52 6d b8 e3 f3 4e 4e c8 9a aa 45 35 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f
                                                                                                                                                                                    Data Ascii: a$V^XRmNNE5&,+0/$#('=<5/7#
                                                                                                                                                                                    Jan 28, 2022 22:07:55.139054060 CET1462INData Raw: 16 03 03 00 41 02 00 00 3d 03 03 64 a5 00 8e d9 32 e1 96 07 00 15 84 a6 7a b2 3a 31 86 09 72 cb 10 19 f2 e4 b1 53 ff dd 9f 0f 8a 00 c0 30 00 00 15 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 23 00 00 00 17 00 00 16 03 03 03 cf 0b 00 03 cb 00 03 c8
                                                                                                                                                                                    Data Ascii: A=d2z:1rS0#00\*b0*H0w10UGB10ULondon10ULondon10UGlobal Security10UIT Department10Uexample.c
                                                                                                                                                                                    Jan 28, 2022 22:07:55.139079094 CET1462INData Raw: ae ea 13 e9 8d 42 b6 33 00 1d 38 f5 d4 da 42 d9 9a 16 03 03 00 04 0e 00 00 00
                                                                                                                                                                                    Data Ascii: B38B
                                                                                                                                                                                    Jan 28, 2022 22:08:00.040966034 CET1549OUTData Raw: 16 03 03 00 25 10 00 00 21 20 27 fa 92 52 51 48 f7 4a 68 af bf c9 7f ef ae 3a 01 f8 e5 36 7a 2d 45 2d 9e 4c 8b 42 b2 83 6c 62 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 6b 5d c7 c5 db 3b 28 bc bf 43 43 5a 77 cb 11 9b 79 61 db e1 ed
                                                                                                                                                                                    Data Ascii: %! 'RQHJh:6z-E-LBlb(k];(CCZwyaOes.U
                                                                                                                                                                                    Jan 28, 2022 22:08:00.345963001 CET1550INData Raw: 16 03 03 00 ba 04 00 00 b6 00 00 01 2c 00 b0 33 70 0a af c5 a3 25 d7 ea bb d3 9d ed ff 05 9b 49 49 f7 65 b7 07 4e 5c e9 59 03 73 46 73 5a d6 c4 b9 e8 7c 8c ca 0b 6d 47 ab 3f 58 3a 78 0f 5a fb 49 99 91 6d ba 2a 4f af 59 31 a8 d2 db 32 a6 4d 15 ff
                                                                                                                                                                                    Data Ascii: ,3p%IIeN\YsFsZ|mG?X:xZIm*OY12M,2}QM)T\PmBa`gw,ad `B>9((uFylsM]QuTo 0o4" i(t$5Zlg/mnV}{F @o?_!
                                                                                                                                                                                    Jan 28, 2022 22:08:00.351422071 CET1550OUTData Raw: 17 03 03 02 28 00 00 00 00 00 00 00 01 1c 02 2c 60 a9 ec ac 62 2f 43 94 e4 8b 94 5e fe 9e 07 2a 65 5a fc 90 b2 e7 cb 05 75 d6 17 99 54 a0 41 42 26 d7 fe 8e a0 3a 5c a6 d3 5e 77 fe 45 63 38 04 0a af ee 6e 45 ea eb 6a 41 02 52 99 88 a9 eb a8 12 ac
                                                                                                                                                                                    Data Ascii: (,`b/C^*eZuTAB&:\^wEc8nEjAR,@R`%#*2S&B)Tdc,yN7%^9'Bcf2H>DK:PfR#?9L*x<tUe7H-@NV|aT(].>B[S]3z](
                                                                                                                                                                                    Jan 28, 2022 22:08:01.515592098 CET1552INData Raw: 17 03 03 04 f4 74 96 24 de fa 35 19 1f 16 e0 d0 50 7a 5c 2d 56 0b 9d 36 e8 a7 49 dc 89 35 e9 c4 87 17 fd 9d 62 ad 96 35 60 e9 dd c1 bb 04 74 a7 ab 67 f0 5d 61 92 5e db 9c 00 39 8f e9 84 f2 6b 79 29 3b a0 be f8 00 94 59 f8 1e 98 8d f8 ca d8 79 4b
                                                                                                                                                                                    Data Ascii: t$5Pz\-V6I5b5`tg]a^9ky);YyK.W8C Mjk[|<+@I3b`ZLTDpr`5HAPg[xiJ2gG+2;#w?/sz9-2{=6)Pw,z]EVn#RIw0q<
                                                                                                                                                                                    Jan 28, 2022 22:08:04.515413046 CET1552INData Raw: 15 03 03 00 1a 74 96 24 de fa 35 19 20 9c 79 83 5e 64 06 4a db f4 3e 1f 06 b1 bd b3 5c 06 ae
                                                                                                                                                                                    Data Ascii: t$5 y^dJ>\


                                                                                                                                                                                    Statistics

                                                                                                                                                                                    CPU Usage

                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                    Memory Usage

                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                    High Level Behavior Distribution

                                                                                                                                                                                    Click to dive into process behavior distribution

                                                                                                                                                                                    Behavior

                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                    System Behavior

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:0
                                                                                                                                                                                    Start time:22:07:20
                                                                                                                                                                                    Start date:28/01/2022
                                                                                                                                                                                    Path:C:\Windows\System32\loaddll32.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:loaddll32.exe "C:\Users\user\Desktop\G.dll"
                                                                                                                                                                                    Imagebase:0xa20000
                                                                                                                                                                                    File size:116736 bytes
                                                                                                                                                                                    MD5 hash:7DEB5DB86C0AC789123DEC286286B938
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000002.261493646.0000000002D80000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000002.261522396.0000000002DB1000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:1
                                                                                                                                                                                    Start time:22:07:20
                                                                                                                                                                                    Start date:28/01/2022
                                                                                                                                                                                    Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\G.dll",#1
                                                                                                                                                                                    Imagebase:0x150000
                                                                                                                                                                                    File size:232960 bytes
                                                                                                                                                                                    MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:2
                                                                                                                                                                                    Start time:22:07:21
                                                                                                                                                                                    Start date:28/01/2022
                                                                                                                                                                                    Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:regsvr32.exe /s C:\Users\user\Desktop\G.dll
                                                                                                                                                                                    Imagebase:0x850000
                                                                                                                                                                                    File size:20992 bytes
                                                                                                                                                                                    MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000002.252624792.0000000004161000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000002.252573847.0000000004130000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:3
                                                                                                                                                                                    Start time:22:07:21
                                                                                                                                                                                    Start date:28/01/2022
                                                                                                                                                                                    Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:rundll32.exe "C:\Users\user\Desktop\G.dll",#1
                                                                                                                                                                                    Imagebase:0x1a0000
                                                                                                                                                                                    File size:61952 bytes
                                                                                                                                                                                    MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.253283949.0000000004681000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.253256451.0000000004650000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.253348428.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:4
                                                                                                                                                                                    Start time:22:07:21
                                                                                                                                                                                    Start date:28/01/2022
                                                                                                                                                                                    Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:rundll32.exe C:\Users\user\Desktop\G.dll,DllRegisterServer
                                                                                                                                                                                    Imagebase:0x1a0000
                                                                                                                                                                                    File size:61952 bytes
                                                                                                                                                                                    MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.274576456.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.276875884.0000000005861000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.274675979.00000000054F0000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.274922446.0000000005621000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.276956910.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.276851297.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.275830029.0000000005801000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.274491459.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.277008171.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.274638425.0000000005441000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.274516629.0000000004EF1000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.275452087.00000000057D0000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.276976546.0000000005A31000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.276938225.00000000058C1000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.276919244.0000000005890000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:5
                                                                                                                                                                                    Start time:22:07:22
                                                                                                                                                                                    Start date:28/01/2022
                                                                                                                                                                                    Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\G.dll",DllRegisterServer
                                                                                                                                                                                    Imagebase:0x1a0000
                                                                                                                                                                                    File size:61952 bytes
                                                                                                                                                                                    MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:6
                                                                                                                                                                                    Start time:22:07:22
                                                                                                                                                                                    Start date:28/01/2022
                                                                                                                                                                                    Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\G.dll",DllRegisterServer
                                                                                                                                                                                    Imagebase:0x1a0000
                                                                                                                                                                                    File size:61952 bytes
                                                                                                                                                                                    MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.271372941.00000000032A0000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.272139717.0000000005341000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.271889554.0000000004FC0000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.272090559.00000000052E1000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.272206669.00000000054B1000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.272121589.0000000005310000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.272067370.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.272183835.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.271716926.0000000004F11000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.271915479.0000000004FF1000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.272014124.0000000005281000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.271693542.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.271987224.0000000005250000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.271513878.00000000049A1000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.272247152.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Author: Joe Security
                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:7
                                                                                                                                                                                    Start time:22:07:26
                                                                                                                                                                                    Start date:28/01/2022
                                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                                    Imagebase:0x7ff797770000
                                                                                                                                                                                    File size:51288 bytes
                                                                                                                                                                                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:8
                                                                                                                                                                                    Start time:22:07:26
                                                                                                                                                                                    Start date:28/01/2022
                                                                                                                                                                                    Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\G.dll",DllRegisterServer
                                                                                                                                                                                    Imagebase:0x7ff797770000
                                                                                                                                                                                    File size:61952 bytes
                                                                                                                                                                                    MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:9
                                                                                                                                                                                    Start time:22:07:30
                                                                                                                                                                                    Start date:28/01/2022
                                                                                                                                                                                    Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Hqelimm\rmkavwi.ypm",YOtq
                                                                                                                                                                                    Imagebase:0x1a0000
                                                                                                                                                                                    File size:61952 bytes
                                                                                                                                                                                    MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.275329419.0000000004B41000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.275561648.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.274906583.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:10
                                                                                                                                                                                    Start time:22:07:33
                                                                                                                                                                                    Start date:28/01/2022
                                                                                                                                                                                    Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Hqelimm\rmkavwi.ypm",DllRegisterServer
                                                                                                                                                                                    Imagebase:0x1a0000
                                                                                                                                                                                    File size:61952 bytes
                                                                                                                                                                                    MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.771427491.00000000044D1000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.771965666.0000000004EB1000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.772505137.0000000005391000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.771607352.00000000049F1000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.772451917.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.772785811.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.772550066.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.771696556.0000000004BC0000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.772088368.0000000004FA1000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.772195967.00000000050C1000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.772607036.0000000005411000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.771329130.00000000044A0000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.771770201.0000000004CF1000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.772052651.0000000004F70000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.770804161.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.771574854.00000000049C0000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.771910511.0000000004E80000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.771839455.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.772278952.00000000051A1000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.772140071.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.770959380.0000000002A61000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.772251780.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                    • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.771878250.0000000004E51000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:11
                                                                                                                                                                                    Start time:22:07:36
                                                                                                                                                                                    Start date:28/01/2022
                                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
                                                                                                                                                                                    Imagebase:0x7ff797770000
                                                                                                                                                                                    File size:51288 bytes
                                                                                                                                                                                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:12
                                                                                                                                                                                    Start time:22:07:38
                                                                                                                                                                                    Start date:28/01/2022
                                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
                                                                                                                                                                                    Imagebase:0x7ff797770000
                                                                                                                                                                                    File size:51288 bytes
                                                                                                                                                                                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:13
                                                                                                                                                                                    Start time:22:07:39
                                                                                                                                                                                    Start date:28/01/2022
                                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:C:\Windows\System32\svchost.exe -k NetworkService -p
                                                                                                                                                                                    Imagebase:0x7ff797770000
                                                                                                                                                                                    File size:51288 bytes
                                                                                                                                                                                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:14
                                                                                                                                                                                    Start time:22:07:39
                                                                                                                                                                                    Start date:28/01/2022
                                                                                                                                                                                    Path:C:\Windows\System32\SgrmBroker.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:C:\Windows\system32\SgrmBroker.exe
                                                                                                                                                                                    Imagebase:0x7ff745120000
                                                                                                                                                                                    File size:163336 bytes
                                                                                                                                                                                    MD5 hash:D3170A3F3A9626597EEE1888686E3EA6
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:15
                                                                                                                                                                                    Start time:22:07:40
                                                                                                                                                                                    Start date:28/01/2022
                                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
                                                                                                                                                                                    Imagebase:0x7ff797770000
                                                                                                                                                                                    File size:51288 bytes
                                                                                                                                                                                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:21
                                                                                                                                                                                    Start time:22:07:57
                                                                                                                                                                                    Start date:28/01/2022
                                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                                                                                                                    Imagebase:0x7ff797770000
                                                                                                                                                                                    File size:51288 bytes
                                                                                                                                                                                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:23
                                                                                                                                                                                    Start time:22:08:09
                                                                                                                                                                                    Start date:28/01/2022
                                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                                                                                                                    Imagebase:0x7ff797770000
                                                                                                                                                                                    File size:51288 bytes
                                                                                                                                                                                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:26
                                                                                                                                                                                    Start time:22:08:27
                                                                                                                                                                                    Start date:28/01/2022
                                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                                                                                                                    Imagebase:0x7ff797770000
                                                                                                                                                                                    File size:51288 bytes
                                                                                                                                                                                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:28
                                                                                                                                                                                    Start time:22:08:41
                                                                                                                                                                                    Start date:28/01/2022
                                                                                                                                                                                    Path:C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                                                                                                                                                                                    Imagebase:0x7ff679ff0000
                                                                                                                                                                                    File size:455656 bytes
                                                                                                                                                                                    MD5 hash:A267555174BFA53844371226F482B86B
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:29
                                                                                                                                                                                    Start time:22:08:41
                                                                                                                                                                                    Start date:28/01/2022
                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                    Imagebase:0x7ff7ecfc0000
                                                                                                                                                                                    File size:625664 bytes
                                                                                                                                                                                    MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:35
                                                                                                                                                                                    Start time:22:09:45
                                                                                                                                                                                    Start date:28/01/2022
                                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                                                                                                                    Imagebase:0x7ff797770000
                                                                                                                                                                                    File size:51288 bytes
                                                                                                                                                                                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:37
                                                                                                                                                                                    Start time:22:10:05
                                                                                                                                                                                    Start date:28/01/2022
                                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                                                                                                                    Imagebase:0x7ff797770000
                                                                                                                                                                                    File size:51288 bytes
                                                                                                                                                                                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language

                                                                                                                                                                                    Disassembly

                                                                                                                                                                                    Reset < >

                                                                                                                                                                                      Execution Graph

                                                                                                                                                                                      Execution Coverage:37.5%
                                                                                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                      Signature Coverage:9%
                                                                                                                                                                                      Total number of Nodes:678
                                                                                                                                                                                      Total number of Limit Nodes:21
                                                                                                                                                                                      execution_graph 11011 10019a07 11012 10019a13 __mtinitlocknum 11011->11012 11020 1001f9fc 11012->11020 11014 10019a21 11023 1001f31c 11014->11023 11016 10019a2c 11017 10019a3b RegisterClassA 11016->11017 11019 10019a36 __mtinitlocknum 11016->11019 11027 10019a63 11017->11027 11033 10020c26 __EH_prolog3 11020->11033 11022 1001fa0b 11022->11014 11024 1001f323 11023->11024 11026 1001f328 11023->11026 11025 100201f1 _Error_objects RaiseException 11024->11025 11025->11026 11026->11016 11028 10019a99 11027->11028 11029 10019a69 11027->11029 11028->11019 11030 10019a78 GetLastError 11029->11030 11031 10019a82 11029->11031 11030->11031 11031->11028 11032 10019a92 SetLastError 11031->11032 11032->11028 11036 10020c40 11033->11036 11034 100201f1 _Error_objects RaiseException 11034->11036 11035 10020c80 11039 10020c93 11035->11039 11040 10020ca6 11035->11040 11036->11034 11036->11035 11037 1002094b _Error_objects 2 API calls 11036->11037 11038 1002083b _Error_objects 11 API calls 11036->11038 11037->11036 11038->11036 11041 100209ed _Error_objects 10 API calls 11039->11041 11040->11022 11041->11040 10246 10020c26 __EH_prolog3 10249 10020c40 10246->10249 10248 10020c80 10252 10020c93 10248->10252 10253 10020ca6 10248->10253 10249->10248 10255 1002083b EnterCriticalSection 10249->10255 10269 100201f1 10249->10269 10272 1002094b TlsAlloc 10249->10272 10275 100209ed __EH_prolog3_catch EnterCriticalSection 10252->10275 10256 1002085a 10255->10256 10257 10020916 LeaveCriticalSection 10256->10257 10259 10020893 10256->10259 10260 100208a8 GlobalHandle GlobalUnlock 10256->10260 10257->10249 10262 1002089b GlobalAlloc 10259->10262 10261 10014460 10260->10261 10263 100208c5 GlobalReAlloc 10261->10263 10264 100208cf 10262->10264 10263->10264 10265 100208f7 GlobalLock 10264->10265 10266 100208da GlobalHandle GlobalLock 10264->10266 10267 100208e8 LeaveCriticalSection 10264->10267 10292 10030030 10265->10292 10266->10267 10267->10265 10297 10033135 10269->10297 10271 1002020a 10273 10020977 10272->10273 10274 1002097c InitializeCriticalSection 10272->10274 10273->10274 10274->10249 10276 10020a18 10275->10276 10280 10020afc LeaveCriticalSection 10275->10280 10278 10020a21 TlsGetValue 10276->10278 10276->10280 10283 10020a2f 10278->10283 10279 10020b1f 10279->10253 10280->10279 10281 10020aa4 10285 10020ab0 LocalReAlloc 10281->10285 10282 10020a49 10284 10020a53 LocalAlloc 10282->10284 10283->10280 10283->10281 10283->10282 10286 10020abc 10284->10286 10285->10286 10287 10020ac0 LeaveCriticalSection 10286->10287 10288 10020ace 10286->10288 10300 100201bd 10287->10300 10290 10030030 _memset __VEC_memzero 10288->10290 10291 10020ae7 TlsSetValue 10290->10291 10291->10280 10293 100300a5 10292->10293 10294 1003003c 10292->10294 10293->10257 10295 10030057 __VEC_memzero 10294->10295 10296 1003005c 10294->10296 10295->10296 10296->10257 10298 10033168 RaiseException 10297->10298 10299 1003315c 10297->10299 10298->10271 10299->10298 10301 10033135 __CxxThrowException@8 RaiseException 10300->10301 10302 100201d6 10301->10302 10237 10035042 TlsGetValue 10238 10035076 GetModuleHandleA 10237->10238 10239 10035055 10237->10239 10241 10035085 GetProcAddress 10238->10241 10242 1003509f 10238->10242 10239->10238 10240 1003505f TlsGetValue 10239->10240 10243 1003506a 10240->10243 10245 1003506e 10241->10245 10243->10238 10243->10245 10244 10035095 RtlEncodePointer 10244->10242 10245->10242 10245->10244 10303 10030d06 10304 10030d12 10303->10304 10305 10030d0d 10303->10305 10309 10030c10 10304->10309 10321 1003906d 10305->10321 10308 10030d23 10310 10030c1c __mtinitlocknum 10309->10310 10312 10030cb9 __mtinitlocknum 10310->10312 10314 10030c69 10310->10314 10325 10030a37 10310->10325 10312->10308 10314->10312 10373 100125c0 10314->10373 10316 10030c99 10316->10312 10317 10030a37 __CRT_INIT@12 98 API calls 10316->10317 10317->10312 10318 100125c0 ___DllMainCRTStartup 85 API calls 10319 10030c90 10318->10319 10320 10030a37 __CRT_INIT@12 98 API calls 10319->10320 10320->10316 10322 10039090 10321->10322 10323 1003909d GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter 10321->10323 10322->10323 10324 10039094 10322->10324 10323->10324 10324->10304 10326 10030b61 10325->10326 10327 10030a4a GetProcessHeap HeapAlloc 10325->10327 10328 10030b67 10326->10328 10329 10030b9c 10326->10329 10330 10030a67 10327->10330 10331 10030a6e GetVersionExA 10327->10331 10328->10330 10337 10030b86 10328->10337 10449 100310be _doexit 10328->10449 10332 10030ba1 10329->10332 10333 10030bfa 10329->10333 10330->10314 10334 10030a89 GetProcessHeap HeapFree 10331->10334 10335 10030a7e GetProcessHeap HeapFree 10331->10335 10450 10035135 TlsGetValue 10332->10450 10333->10330 10492 10035425 10333->10492 10338 10030ab5 10334->10338 10335->10330 10337->10330 10344 100389ee __ioterm 50 API calls 10337->10344 10394 10036624 HeapCreate 10338->10394 10346 10030b90 10344->10346 10349 10035178 __mtterm 52 API calls 10346->10349 10347 10030aeb 10347->10330 10352 10030b07 __RTC_Initialize GetCommandLineA ___crtGetEnvironmentStringsA 10347->10352 10353 10030afd __heap_term 10347->10353 10348 10030bbe 10461 100350ae TlsGetValue 10348->10461 10350 10030b95 __heap_term 10349->10350 10350->10330 10402 100387ae 10352->10402 10353->10330 10356 10030b26 10357 10030b31 __setargv 10356->10357 10358 10030b2a 10356->10358 10364 10030b5a 10357->10364 10365 10030b3a 10357->10365 10419 10035178 10358->10419 10359 10030bd7 10468 100351b5 10359->10468 10360 10030bee 10479 1002fa69 10360->10479 10444 100389ee 10364->10444 10430 10038a3a 10365->10430 10366 10030bf4 10366->10330 10369 10030bde GetCurrentThreadId 10369->10330 10372 10030b43 __cinit 10372->10330 10372->10364 10898 10006a90 10373->10898 10376 1001265a _printf 10393 10012839 10376->10393 10377 1001261c FindResourceW LoadResource SizeofResource 10380 10006a90 ___DllMainCRTStartup 49 API calls 10377->10380 10382 10012744 ___DllMainCRTStartup 10380->10382 10381 1001284d 10381->10316 10381->10318 10383 100127b7 VirtualAlloc 10382->10383 10384 1001279b VirtualAllocExNuma 10382->10384 10385 100127da 10383->10385 10384->10385 10903 1002fb00 10385->10903 10388 1002f9a6 _malloc 49 API calls 10389 100127fa 10388->10389 10907 10002970 10389->10907 10391 10012810 10910 100026a0 10391->10910 10913 1002f81e 10393->10913 10395 10036647 10394->10395 10396 10036644 10394->10396 10397 10036656 10395->10397 10398 1003667a 10395->10398 10396->10347 10503 10035aca HeapAlloc 10397->10503 10398->10347 10401 10036665 HeapDestroy 10401->10396 10505 10032b38 10402->10505 10404 100387ba GetStartupInfoA 10405 10035840 __calloc_crt 49 API calls 10404->10405 10413 100387db 10405->10413 10406 100389e5 __mtinitlocknum 10406->10356 10407 10038962 GetStdHandle 10412 1003892c 10407->10412 10408 100389c7 SetHandleCount 10408->10406 10409 10035840 __calloc_crt 49 API calls 10409->10413 10410 10038974 GetFileType 10410->10412 10411 100388af 10411->10412 10414 100388e3 10411->10414 10415 100388d8 GetFileType 10411->10415 10412->10407 10412->10408 10412->10410 10418 1003898b 10412->10418 10413->10406 10413->10409 10413->10411 10413->10412 10414->10406 10414->10411 10506 10039358 10414->10506 10415->10411 10415->10414 10416 10039358 ___crtInitCritSecAndSpinCount 12 API calls 10416->10418 10418->10406 10418->10412 10418->10416 10420 10035182 10419->10420 10423 1003518e 10419->10423 10421 100350ae __decode_pointer 4 API calls 10420->10421 10421->10423 10422 100351a2 TlsFree 10427 100351b0 10422->10427 10423->10422 10423->10427 10424 10035986 DeleteCriticalSection 10426 1002fa69 __mtinitlocknum 49 API calls 10424->10426 10425 1003599e 10428 100359b0 DeleteCriticalSection 10425->10428 10429 10030b2f 10425->10429 10426->10427 10427->10424 10427->10425 10428->10425 10429->10353 10431 10038a47 10430->10431 10434 10038a4c _strlen 10430->10434 10526 1003a9a8 10431->10526 10433 10035840 __calloc_crt 49 API calls 10438 10038a7f _strlen 10433->10438 10434->10433 10437 10030b3f 10434->10437 10435 10038ada 10436 1002fa69 __mtinitlocknum 49 API calls 10435->10436 10436->10437 10437->10364 10437->10372 10438->10435 10438->10437 10439 10035840 __calloc_crt 49 API calls 10438->10439 10440 10038aff 10438->10440 10443 10038ac4 __invoke_watson 10438->10443 10530 10031119 10438->10530 10439->10438 10441 1002fa69 __mtinitlocknum 49 API calls 10440->10441 10441->10437 10443->10438 10445 100389f5 10444->10445 10446 10038a37 10445->10446 10447 10038a09 DeleteCriticalSection 10445->10447 10448 1002fa69 __mtinitlocknum 49 API calls 10445->10448 10446->10358 10447->10445 10448->10445 10449->10337 10451 10035145 10450->10451 10452 10030ba6 10450->10452 10453 100350ae __decode_pointer 4 API calls 10451->10453 10455 10035840 10452->10455 10454 10035150 TlsSetValue 10453->10454 10454->10452 10458 10035844 10455->10458 10457 10030bb2 10457->10330 10457->10348 10458->10457 10459 10035864 Sleep 10458->10459 10679 10030678 10458->10679 10460 10035879 10459->10460 10460->10457 10460->10458 10462 100350e2 GetModuleHandleA 10461->10462 10463 100350c1 10461->10463 10465 100350f1 GetProcAddress 10462->10465 10467 10030bd0 10462->10467 10463->10462 10464 100350cb TlsGetValue 10463->10464 10466 100350d6 10464->10466 10465->10467 10466->10462 10466->10467 10467->10359 10467->10360 10690 10032b38 10468->10690 10470 100351c1 GetModuleHandleA 10471 100351e3 GetProcAddress GetProcAddress 10470->10471 10472 10035207 InterlockedIncrement 10470->10472 10471->10472 10473 10035a99 __lock 45 API calls 10472->10473 10474 1003522e 10473->10474 10691 1003ab06 InterlockedIncrement 10474->10691 10476 1003524d 10703 10035260 10476->10703 10478 1003525a __mtinitlocknum 10478->10369 10481 1002fa75 __mtinitlocknum 10479->10481 10480 1002faee __dosmaperr __mtinitlocknum 10480->10366 10481->10480 10482 1002fab4 10481->10482 10484 10035a99 __lock 47 API calls 10481->10484 10482->10480 10483 1002fac9 RtlFreeHeap 10482->10483 10483->10480 10485 1002fadb 10483->10485 10488 1002fa8c ___sbh_find_block 10484->10488 10486 100311f4 __cftog_l 47 API calls 10485->10486 10487 1002fae0 GetLastError 10486->10487 10487->10480 10491 1002faa6 10488->10491 10707 10035b3d 10488->10707 10713 1002fabf 10491->10713 10493 1003542e 10492->10493 10502 10035479 10492->10502 10496 10035437 TlsGetValue 10493->10496 10497 1003545a 10493->10497 10494 10035484 TlsSetValue 10495 1003548d 10494->10495 10495->10330 10496->10497 10498 1003544a TlsGetValue 10496->10498 10499 100350ae __decode_pointer 4 API calls 10497->10499 10498->10497 10500 10035470 10499->10500 10717 10035304 10500->10717 10502->10494 10502->10495 10504 10035ae6 10503->10504 10504->10398 10504->10401 10505->10404 10507 10039364 __mtinitlocknum 10506->10507 10508 100350ae __decode_pointer 4 API calls 10507->10508 10509 10039374 10508->10509 10510 100393c8 __mtinitlocknum 10509->10510 10511 10039396 10509->10511 10512 10039389 __invoke_watson 10509->10512 10510->10414 10513 100393bd 10511->10513 10514 1003939c GetModuleHandleA 10511->10514 10512->10511 10517 10035042 TlsGetValue 10513->10517 10514->10513 10515 100393ab GetProcAddress 10514->10515 10515->10513 10518 10035076 GetModuleHandleA 10517->10518 10519 10035055 10517->10519 10521 10035085 GetProcAddress 10518->10521 10522 1003509f 10518->10522 10519->10518 10520 1003505f TlsGetValue 10519->10520 10523 1003506a 10520->10523 10525 1003506e 10521->10525 10522->10510 10523->10518 10523->10525 10524 10035095 RtlEncodePointer 10524->10522 10525->10522 10525->10524 10527 1003a9b8 10526->10527 10528 1003a9b1 10526->10528 10527->10434 10537 1003a80e 10528->10537 10531 10031126 10530->10531 10532 1003112e 10530->10532 10531->10532 10535 10031155 10531->10535 10533 100311f4 __cftog_l 49 API calls 10532->10533 10534 10031133 10533->10534 10534->10438 10535->10534 10536 100311f4 __cftog_l 49 API calls 10535->10536 10536->10534 10538 1003a81a __mtinitlocknum 10537->10538 10565 100352ec 10538->10565 10540 1003a823 10541 1003a82d getSystemCP 10540->10541 10542 1003a844 10541->10542 10545 1003a96d __mtinitlocknum 10541->10545 10570 10035800 10542->10570 10545->10527 10546 1003a859 __setmbcp_nolock 10547 1003a97a 10546->10547 10548 1003a87e InterlockedDecrement 10546->10548 10547->10545 10552 1003a98d 10547->10552 10553 1002fa69 __mtinitlocknum 49 API calls 10547->10553 10549 1003a89f InterlockedIncrement 10548->10549 10550 1003a88e 10548->10550 10549->10545 10551 1003a8b5 10549->10551 10550->10549 10555 1002fa69 __mtinitlocknum 49 API calls 10550->10555 10551->10545 10575 10035a99 10551->10575 10584 100311f4 10552->10584 10553->10552 10556 1003a89e 10555->10556 10556->10549 10559 1003a8c9 InterlockedDecrement 10560 1003a945 10559->10560 10561 1003a958 InterlockedIncrement 10559->10561 10560->10561 10563 1002fa69 __mtinitlocknum 49 API calls 10560->10563 10581 1003a96f 10561->10581 10564 1003a957 10563->10564 10564->10561 10587 10035269 GetLastError 10565->10587 10567 100352f2 10568 10035300 10567->10568 10569 100352f8 __amsg_exit 10567->10569 10568->10540 10569->10568 10572 10035804 10570->10572 10573 1003583b 10572->10573 10574 1003581c Sleep 10572->10574 10602 1002f9a6 10572->10602 10573->10545 10573->10546 10574->10572 10576 10035abf EnterCriticalSection 10575->10576 10577 10035aac 10575->10577 10576->10559 10651 100359d6 10577->10651 10579 10035ab2 10579->10576 10580 10035ab7 __amsg_exit 10579->10580 10580->10576 10678 100359c1 LeaveCriticalSection 10581->10678 10583 1003a976 10583->10545 10585 10035269 __getptd_noexit 49 API calls 10584->10585 10586 100311f9 10585->10586 10586->10545 10588 10035135 ___set_flsgetvalue 6 API calls 10587->10588 10589 10035278 TlsGetValue 10588->10589 10590 1003528c 10589->10590 10591 100352e0 SetLastError 10590->10591 10592 10035840 __calloc_crt 45 API calls 10590->10592 10591->10567 10593 1003529e 10592->10593 10593->10591 10594 100350ae __decode_pointer 4 API calls 10593->10594 10595 100352b8 10594->10595 10596 100352d7 10595->10596 10597 100352bf 10595->10597 10599 1002fa69 __mtinitlocknum 45 API calls 10596->10599 10598 100351b5 __getptd_noexit 45 API calls 10597->10598 10600 100352c7 GetCurrentThreadId 10598->10600 10601 100352dd 10599->10601 10600->10591 10601->10591 10603 1002fa53 10602->10603 10608 1002f9b4 10602->10608 10604 100368d5 __calloc_impl 4 API calls 10603->10604 10605 1002fa59 10604->10605 10607 100311f4 __cftog_l 47 API calls 10605->10607 10610 1002fa5f 10607->10610 10612 1002fa17 HeapAlloc 10608->10612 10613 1002fa4a 10608->10613 10614 1002fa3e 10608->10614 10617 1002fa3c 10608->10617 10619 10036892 10608->10619 10626 1002f957 10608->10626 10634 100368d5 10608->10634 10610->10572 10612->10608 10613->10572 10615 100311f4 __cftog_l 47 API calls 10614->10615 10615->10617 10618 100311f4 __cftog_l 47 API calls 10617->10618 10618->10613 10637 1003da11 10619->10637 10621 10036899 10622 100368b4 __NMSG_WRITE __NMSG_WRITE 10621->10622 10623 1003da11 __FF_MSGBANNER 47 API calls 10621->10623 10624 1002f9ce __NMSG_WRITE 10622->10624 10625 100368a6 10623->10625 10624->10608 10625->10622 10625->10624 10627 1002f963 __mtinitlocknum 10626->10627 10628 1002f994 __mtinitlocknum 10627->10628 10629 10035a99 __lock 49 API calls 10627->10629 10628->10608 10630 1002f979 10629->10630 10642 100362e6 10630->10642 10635 100350ae __decode_pointer 4 API calls 10634->10635 10636 100368e0 10635->10636 10636->10608 10638 1003da1c 10637->10638 10639 1003da26 10638->10639 10640 100311f4 __cftog_l 49 API calls 10638->10640 10639->10621 10641 1003da3f 10640->10641 10641->10621 10644 10036312 10642->10644 10643 100363bb ___sbh_alloc_new_group 10646 1002f984 10643->10646 10644->10643 10645 100363a6 ___sbh_alloc_new_region 10644->10645 10644->10646 10645->10643 10645->10646 10647 1002f99d 10646->10647 10650 100359c1 LeaveCriticalSection 10647->10650 10649 1002f9a4 10649->10628 10650->10649 10652 100359e2 __mtinitlocknum 10651->10652 10653 10035a08 10652->10653 10654 10036892 __FF_MSGBANNER 48 API calls 10652->10654 10656 10035800 __malloc_crt 48 API calls 10653->10656 10660 10035a18 __mtinitlocknum 10653->10660 10655 100359f7 __NMSG_WRITE 10654->10655 10655->10653 10657 10035a23 10656->10657 10658 10035a2a 10657->10658 10659 10035a39 10657->10659 10661 100311f4 __cftog_l 48 API calls 10658->10661 10662 10035a99 __lock 48 API calls 10659->10662 10660->10579 10661->10660 10663 10035a40 10662->10663 10664 10035a74 10663->10664 10665 10035a48 10663->10665 10666 1002fa69 __mtinitlocknum 48 API calls 10664->10666 10667 10039358 ___crtInitCritSecAndSpinCount 12 API calls 10665->10667 10669 10035a65 10666->10669 10668 10035a53 10667->10668 10668->10669 10670 1002fa69 __mtinitlocknum 48 API calls 10668->10670 10674 10035a90 10669->10674 10672 10035a5f 10670->10672 10673 100311f4 __cftog_l 48 API calls 10672->10673 10673->10669 10677 100359c1 LeaveCriticalSection 10674->10677 10676 10035a97 10676->10660 10677->10676 10678->10583 10680 10030684 __mtinitlocknum 10679->10680 10681 1003069c 10680->10681 10687 100306bb 10680->10687 10682 100311f4 __cftog_l 48 API calls 10681->10682 10686 100306a1 __mtinitlocknum 10682->10686 10683 1003072d HeapAlloc 10683->10687 10684 100368d5 __calloc_impl 4 API calls 10684->10687 10685 10035a99 __lock 48 API calls 10685->10687 10686->10458 10687->10683 10687->10684 10687->10685 10687->10686 10688 100362e6 ___sbh_alloc_block 2 API calls 10687->10688 10689 10030030 _memset __VEC_memzero 10687->10689 10688->10687 10689->10687 10690->10470 10692 1003ab21 InterlockedIncrement 10691->10692 10693 1003ab24 10691->10693 10692->10693 10694 1003ab31 10693->10694 10695 1003ab2e InterlockedIncrement 10693->10695 10696 1003ab3b InterlockedIncrement 10694->10696 10697 1003ab3e 10694->10697 10695->10694 10696->10697 10698 1003ab48 InterlockedIncrement 10697->10698 10700 1003ab4b 10697->10700 10698->10700 10699 1003ab60 InterlockedIncrement 10699->10700 10700->10699 10701 1003ab70 InterlockedIncrement 10700->10701 10702 1003ab79 InterlockedIncrement 10700->10702 10701->10700 10702->10476 10706 100359c1 LeaveCriticalSection 10703->10706 10705 10035267 10705->10478 10706->10705 10708 10035b7a 10707->10708 10712 10035e1c ___sbh_free_block 10707->10712 10709 10035d66 VirtualFree 10708->10709 10708->10712 10710 10035dca 10709->10710 10711 10035dd9 VirtualFree HeapFree 10710->10711 10710->10712 10711->10712 10712->10491 10716 100359c1 LeaveCriticalSection 10713->10716 10715 1002fac6 10715->10482 10716->10715 10718 10035310 __mtinitlocknum 10717->10718 10719 10035328 10718->10719 10720 1002fa69 __mtinitlocknum 49 API calls 10718->10720 10722 10035404 __mtinitlocknum 10718->10722 10721 10035336 10719->10721 10723 1002fa69 __mtinitlocknum 49 API calls 10719->10723 10720->10719 10724 10035344 10721->10724 10725 1002fa69 __mtinitlocknum 49 API calls 10721->10725 10722->10502 10723->10721 10726 10035352 10724->10726 10727 1002fa69 __mtinitlocknum 49 API calls 10724->10727 10725->10724 10728 10035360 10726->10728 10729 1002fa69 __mtinitlocknum 49 API calls 10726->10729 10727->10726 10730 1003536e 10728->10730 10731 1002fa69 __mtinitlocknum 49 API calls 10728->10731 10729->10728 10732 1003537f 10730->10732 10733 1002fa69 __mtinitlocknum 49 API calls 10730->10733 10731->10730 10734 10035a99 __lock 49 API calls 10732->10734 10733->10732 10735 10035387 10734->10735 10736 10035393 InterlockedDecrement 10735->10736 10742 100353ac 10735->10742 10737 1003539e 10736->10737 10736->10742 10740 1002fa69 __mtinitlocknum 49 API calls 10737->10740 10737->10742 10740->10742 10741 10035a99 __lock 49 API calls 10743 100353c0 10741->10743 10751 10035410 10742->10751 10744 100353f1 10743->10744 10754 1003ab8c 10743->10754 10797 1003541c 10744->10797 10748 1002fa69 __mtinitlocknum 49 API calls 10748->10722 10800 100359c1 LeaveCriticalSection 10751->10800 10753 100353b9 10753->10741 10755 1003ab95 InterlockedDecrement 10754->10755 10756 100353d5 10754->10756 10757 1003abab InterlockedDecrement 10755->10757 10758 1003abae 10755->10758 10756->10744 10768 1003a9c6 10756->10768 10757->10758 10759 1003abbb 10758->10759 10760 1003abb8 InterlockedDecrement 10758->10760 10761 1003abc5 InterlockedDecrement 10759->10761 10762 1003abc8 10759->10762 10760->10759 10761->10762 10763 1003abd2 InterlockedDecrement 10762->10763 10765 1003abd5 10762->10765 10763->10765 10764 1003abea InterlockedDecrement 10764->10765 10765->10764 10766 1003ac03 InterlockedDecrement 10765->10766 10767 1003abfa InterlockedDecrement 10765->10767 10766->10756 10767->10765 10769 1003aa47 10768->10769 10772 1003a9da 10768->10772 10770 1002fa69 __mtinitlocknum 49 API calls 10769->10770 10771 1003aa94 10769->10771 10773 1003aa68 10770->10773 10784 1003aabb 10771->10784 10809 1003f2a8 10771->10809 10772->10769 10779 1002fa69 __mtinitlocknum 49 API calls 10772->10779 10780 1003aa10 10772->10780 10775 1002fa69 __mtinitlocknum 49 API calls 10773->10775 10781 1003aa7b 10775->10781 10777 1003aafa 10783 1002fa69 __mtinitlocknum 49 API calls 10777->10783 10778 1002fa69 __mtinitlocknum 49 API calls 10778->10784 10785 1003aa03 ___free_lconv_mon 10779->10785 10786 1002fa69 __mtinitlocknum 49 API calls 10780->10786 10796 1003aa2f 10780->10796 10787 1002fa69 __mtinitlocknum 49 API calls 10781->10787 10782 1002fa69 __mtinitlocknum 49 API calls 10788 1003aa3c 10782->10788 10789 1003ab00 10783->10789 10784->10777 10792 1002fa69 49 API calls __mtinitlocknum 10784->10792 10785->10780 10790 1003aa24 10786->10790 10791 1003aa89 10787->10791 10793 1002fa69 __mtinitlocknum 49 API calls 10788->10793 10789->10744 10801 1003f438 10790->10801 10795 1002fa69 __mtinitlocknum 49 API calls 10791->10795 10792->10784 10793->10769 10795->10771 10796->10782 10897 100359c1 LeaveCriticalSection 10797->10897 10799 100353fe 10799->10748 10800->10753 10802 1003f441 10801->10802 10808 1003f475 10801->10808 10803 1003f451 10802->10803 10804 1002fa69 __mtinitlocknum 49 API calls 10802->10804 10805 1003f463 10803->10805 10806 1002fa69 __mtinitlocknum 49 API calls 10803->10806 10804->10803 10807 1002fa69 __mtinitlocknum 49 API calls 10805->10807 10805->10808 10806->10805 10807->10808 10808->10796 10810 1003aab4 10809->10810 10811 1003f2b5 10809->10811 10810->10778 10812 1002fa69 __mtinitlocknum 49 API calls 10811->10812 10813 1003f2bd 10812->10813 10814 1002fa69 __mtinitlocknum 49 API calls 10813->10814 10815 1003f2c5 10814->10815 10816 1002fa69 __mtinitlocknum 49 API calls 10815->10816 10817 1003f2cd 10816->10817 10818 1002fa69 __mtinitlocknum 49 API calls 10817->10818 10819 1003f2d5 10818->10819 10820 1002fa69 __mtinitlocknum 49 API calls 10819->10820 10821 1003f2dd 10820->10821 10822 1002fa69 __mtinitlocknum 49 API calls 10821->10822 10823 1003f2e5 10822->10823 10824 1002fa69 __mtinitlocknum 49 API calls 10823->10824 10825 1003f2ec 10824->10825 10826 1002fa69 __mtinitlocknum 49 API calls 10825->10826 10827 1003f2f4 10826->10827 10828 1002fa69 __mtinitlocknum 49 API calls 10827->10828 10829 1003f2fc 10828->10829 10830 1002fa69 __mtinitlocknum 49 API calls 10829->10830 10831 1003f304 10830->10831 10832 1002fa69 __mtinitlocknum 49 API calls 10831->10832 10833 1003f30c 10832->10833 10834 1002fa69 __mtinitlocknum 49 API calls 10833->10834 10835 1003f314 10834->10835 10836 1002fa69 __mtinitlocknum 49 API calls 10835->10836 10837 1003f31c 10836->10837 10838 1002fa69 __mtinitlocknum 49 API calls 10837->10838 10839 1003f324 10838->10839 10840 1002fa69 __mtinitlocknum 49 API calls 10839->10840 10841 1003f32c 10840->10841 10842 1002fa69 __mtinitlocknum 49 API calls 10841->10842 10843 1003f334 10842->10843 10844 1002fa69 __mtinitlocknum 49 API calls 10843->10844 10845 1003f33f 10844->10845 10846 1002fa69 __mtinitlocknum 49 API calls 10845->10846 10847 1003f347 10846->10847 10848 1002fa69 __mtinitlocknum 49 API calls 10847->10848 10849 1003f34f 10848->10849 10850 1002fa69 __mtinitlocknum 49 API calls 10849->10850 10851 1003f357 10850->10851 10852 1002fa69 __mtinitlocknum 49 API calls 10851->10852 10853 1003f35f 10852->10853 10854 1002fa69 __mtinitlocknum 49 API calls 10853->10854 10855 1003f367 10854->10855 10856 1002fa69 __mtinitlocknum 49 API calls 10855->10856 10857 1003f36f 10856->10857 10858 1002fa69 __mtinitlocknum 49 API calls 10857->10858 10859 1003f377 10858->10859 10860 1002fa69 __mtinitlocknum 49 API calls 10859->10860 10861 1003f37f 10860->10861 10862 1002fa69 __mtinitlocknum 49 API calls 10861->10862 10863 1003f387 10862->10863 10864 1002fa69 __mtinitlocknum 49 API calls 10863->10864 10865 1003f38f 10864->10865 10866 1002fa69 __mtinitlocknum 49 API calls 10865->10866 10867 1003f397 10866->10867 10868 1002fa69 __mtinitlocknum 49 API calls 10867->10868 10869 1003f39f 10868->10869 10870 1002fa69 __mtinitlocknum 49 API calls 10869->10870 10871 1003f3a7 10870->10871 10872 1002fa69 __mtinitlocknum 49 API calls 10871->10872 10873 1003f3af 10872->10873 10874 1002fa69 __mtinitlocknum 49 API calls 10873->10874 10875 1003f3b7 10874->10875 10876 1002fa69 __mtinitlocknum 49 API calls 10875->10876 10877 1003f3c5 10876->10877 10878 1002fa69 __mtinitlocknum 49 API calls 10877->10878 10879 1003f3d0 10878->10879 10880 1002fa69 __mtinitlocknum 49 API calls 10879->10880 10881 1003f3db 10880->10881 10882 1002fa69 __mtinitlocknum 49 API calls 10881->10882 10883 1003f3e6 10882->10883 10884 1002fa69 __mtinitlocknum 49 API calls 10883->10884 10885 1003f3f1 10884->10885 10886 1002fa69 __mtinitlocknum 49 API calls 10885->10886 10887 1003f3fc 10886->10887 10888 1002fa69 __mtinitlocknum 49 API calls 10887->10888 10889 1003f407 10888->10889 10890 1002fa69 __mtinitlocknum 49 API calls 10889->10890 10891 1003f412 10890->10891 10892 1002fa69 __mtinitlocknum 49 API calls 10891->10892 10893 1003f41d 10892->10893 10894 1002fa69 __mtinitlocknum 49 API calls 10893->10894 10895 1003f428 10894->10895 10896 1002fa69 __mtinitlocknum 49 API calls 10895->10896 10896->10810 10897->10799 10899 1002f9a6 _malloc 49 API calls 10898->10899 10900 10006aa1 10899->10900 10901 10006aad 10900->10901 10902 1002fa69 __mtinitlocknum 49 API calls 10900->10902 10901->10376 10901->10377 10902->10901 10904 1002fb18 10903->10904 10905 100127eb 10904->10905 10906 1002fb3f __VEC_memcpy 10904->10906 10905->10388 10906->10905 10908 1002f9a6 _malloc 49 API calls 10907->10908 10909 10002990 10908->10909 10909->10391 10921 10002280 10910->10921 10914 1002f826 10913->10914 10915 1002f828 IsDebuggerPresent 10913->10915 10914->10381 10990 1003d86b 10915->10990 10918 100357c7 SetUnhandledExceptionFilter UnhandledExceptionFilter 10919 100357e4 __cftog_l 10918->10919 10920 100357ec GetCurrentProcess TerminateProcess 10918->10920 10919->10920 10920->10381 10954 10001990 10921->10954 10924 100022a9 10924->10393 10925 100022c3 SetLastError 10925->10924 10926 100022d5 10927 10001990 ___DllMainCRTStartup SetLastError 10926->10927 10928 100022ee 10927->10928 10928->10924 10929 10002310 SetLastError 10928->10929 10930 10002322 10928->10930 10929->10924 10931 10002331 SetLastError 10930->10931 10932 10002343 10930->10932 10931->10924 10933 1000234e SetLastError 10932->10933 10935 10002360 GetNativeSystemInfo 10932->10935 10933->10924 10936 10002414 SetLastError 10935->10936 10937 10002426 VirtualAlloc 10935->10937 10936->10924 10938 10002472 GetProcessHeap HeapAlloc 10937->10938 10939 10002447 VirtualAlloc 10937->10939 10940 100024ac 10938->10940 10941 1000248c VirtualFree SetLastError 10938->10941 10939->10938 10942 10002463 SetLastError 10939->10942 10943 10001990 ___DllMainCRTStartup SetLastError 10940->10943 10941->10924 10942->10924 10944 1000250e 10943->10944 10945 1000251c VirtualAlloc 10944->10945 10951 10002512 10944->10951 10946 1000254b ___DllMainCRTStartup 10945->10946 10957 100019c0 10946->10957 10949 1000257f 10949->10951 10967 10001cb0 10949->10967 10973 10002840 10951->10973 10952 100025e8 10952->10924 10952->10951 10953 1000264f SetLastError 10952->10953 10953->10951 10955 100019ab 10954->10955 10956 1000199f SetLastError 10954->10956 10955->10924 10955->10925 10955->10926 10956->10955 10958 100019f0 10957->10958 10959 10001a83 10958->10959 10960 10001a2c VirtualAlloc 10958->10960 10966 10001aa0 ___DllMainCRTStartup 10958->10966 10961 10001990 ___DllMainCRTStartup SetLastError 10959->10961 10962 10001a50 10960->10962 10963 10001a57 10960->10963 10964 10001a9c 10961->10964 10962->10966 10963->10958 10965 10001aa4 VirtualAlloc 10964->10965 10964->10966 10965->10966 10966->10949 10971 10001cf8 ___DllMainCRTStartup 10967->10971 10968 10001e01 10969 10001b80 ___DllMainCRTStartup 2 API calls 10968->10969 10972 10001ddd 10969->10972 10971->10968 10971->10972 10980 10001b80 10971->10980 10972->10952 10974 10002855 10973->10974 10976 1000285a 10973->10976 10974->10924 10975 100028e4 10977 100028f0 VirtualFree 10975->10977 10978 10002904 GetProcessHeap HeapFree 10975->10978 10976->10975 10987 10001860 10976->10987 10977->10978 10978->10974 10981 10001b9c 10980->10981 10983 10001b92 10980->10983 10982 10001baa 10981->10982 10985 10001c04 VirtualProtect 10981->10985 10982->10983 10986 10001be2 VirtualFree 10982->10986 10983->10971 10985->10983 10986->10983 10988 10001869 VirtualFree 10987->10988 10989 1000187a 10987->10989 10988->10989 10989->10975 10990->10918

                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                      Function 100125C0 Relevance: 45.7, APIs: 7, Strings: 19, Instructions: 165memoryCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 10006A90: _malloc.LIBCMT ref: 10006A9C
                                                                                                                                                                                      • _printf.LIBCMT ref: 1001265F
                                                                                                                                                                                      • FindResourceW.KERNELBASE(00000000,00001705,DASHBOARD), ref: 1001268A
                                                                                                                                                                                      • LoadResource.KERNEL32(00000000,00000000), ref: 1001269B
                                                                                                                                                                                      • SizeofResource.KERNEL32(00000000,00000000), ref: 100126AC
                                                                                                                                                                                      • VirtualAllocExNuma.KERNELBASE(000000FF,00000000,00000000,00003000,00000040,00000000), ref: 100127AC
                                                                                                                                                                                      • VirtualAlloc.KERNEL32(00000000,00000000,-100510CC,00000040), ref: 100127D1
                                                                                                                                                                                      • _malloc.LIBCMT ref: 100127F5
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Resource$AllocVirtual_malloc$FindLoadNumaSizeof_printf
                                                                                                                                                                                      • String ID: .$.$2$3$6p2Z6a6CZ&M>ZR$a@Y$xnQ?<XBeh<22mz&0$DASHBOARD$d$d$e$kre3.l$l$l$l$l$l$l$l$n$ndldl
                                                                                                                                                                                      • API String ID: 572389289-2839844625
                                                                                                                                                                                      • Opcode ID: adac8d752e0c47dc141f46a7132d7a35c557a18b7d00a43f57a8df52d4076e8d
                                                                                                                                                                                      • Instruction ID: 8f66a7c676ce8d0fa2ca8bd8519024a549b55f77dd79b918ae70bd0eec3b217e
                                                                                                                                                                                      • Opcode Fuzzy Hash: adac8d752e0c47dc141f46a7132d7a35c557a18b7d00a43f57a8df52d4076e8d
                                                                                                                                                                                      • Instruction Fuzzy Hash: FB613EB5D10218EBEB00DFA0DC95B9EBBB5FF08344F10911CE504AB390E7B66548CB6A
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10002280 Relevance: 22.8, APIs: 15, Instructions: 331COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 34 10002280-100022a7 call 10001990 37 100022b0-100022c1 34->37 38 100022a9-100022ab 34->38 40 100022c3-100022d0 SetLastError 37->40 41 100022d5-100022f0 call 10001990 37->41 39 1000269a-1000269d 38->39 40->39 44 100022f2-100022f4 41->44 45 100022f9-1000230e 41->45 44->39 46 10002310-1000231d SetLastError 45->46 47 10002322-1000232f 45->47 46->39 48 10002331-1000233e SetLastError 47->48 49 10002343-1000234c 47->49 48->39 50 10002360-10002381 49->50 51 1000234e-1000235b SetLastError 49->51 52 10002395-1000239f 50->52 51->39 53 100023a1-100023a8 52->53 54 100023d7-10002412 GetNativeSystemInfo 52->54 55 100023b8-100023c4 53->55 56 100023aa-100023b6 53->56 57 10002414-10002421 SetLastError 54->57 58 10002426-10002445 VirtualAlloc 54->58 59 100023c7-100023cd 55->59 56->59 57->39 60 10002472-1000248a GetProcessHeap HeapAlloc 58->60 61 10002447-10002461 VirtualAlloc 58->61 64 100023d5 59->64 65 100023cf-100023d2 59->65 62 100024ac-10002510 call 10001990 60->62 63 1000248c-100024a7 VirtualFree SetLastError 60->63 61->60 66 10002463-1000246d SetLastError 61->66 70 10002512 62->70 71 1000251c-10002581 VirtualAlloc call 10001810 call 100019c0 62->71 63->39 64->52 65->64 66->39 72 1000268c-10002698 call 10002840 70->72 79 10002583 71->79 80 1000258d-1000259e 71->80 72->39 79->72 81 100025a0-100025b6 call 10001eb0 80->81 82 100025b8-100025bb 80->82 83 100025c2-100025d0 call 10001ff0 81->83 82->83 88 100025d2 83->88 89 100025dc-100025ea call 10001cb0 83->89 88->72 92 100025f6-10002604 call 10001e30 89->92 93 100025ec 89->93 96 10002606 92->96 97 1000260d-10002616 92->97 93->72 96->72 98 10002618-1000261f 97->98 99 1000267d-10002680 97->99 101 10002621-10002642 98->101 102 1000266a-10002678 98->102 100 10002687-1000268a 99->100 100->39 104 10002646-1000264d 101->104 103 1000267b 102->103 103->100 105 1000265e-10002668 104->105 106 1000264f-1000265a SetLastError 104->106 105->103 106->72
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 10001990: SetLastError.KERNEL32(0000000D,?,?,100022A5,10012839,00000040), ref: 100019A1
                                                                                                                                                                                      • SetLastError.KERNEL32(000000C1,10012839,00000040), ref: 100022C8
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ErrorLast
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1452528299-0
                                                                                                                                                                                      • Opcode ID: 0e09b11d72102b2f53da7248ccc42e4e27664b89a2cf1ce4a90d5e07d10becff
                                                                                                                                                                                      • Instruction ID: 346a8eef4056a92d897d0963d9e5b5a8ca828aef95f805bf3d5880fe5d8ad0e4
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0e09b11d72102b2f53da7248ccc42e4e27664b89a2cf1ce4a90d5e07d10becff
                                                                                                                                                                                      • Instruction Fuzzy Hash: 18E14974A00209DFEB48CF94C990AAEB7F6FF88340F208559E905AB359DB75AD42CF50
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10006A90 Relevance: 18.4, APIs: 1, Instructions: 16933COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 107 10006a90-10006aab call 1002f9a6 110 10006ab7-10012570 107->110 111 10006aad-10006ab2 107->111 113 10012584-1001258b 110->113 112 100125b4-100125b8 111->112 114 10012597-1001259b call 1002fa69 113->114 115 1001258d-10012595 113->115 118 100125a0-100125a9 114->118 115->113 119 100125ab-100125ad 118->119 120 100125af 118->120 119->112 120->112
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • _malloc.LIBCMT ref: 10006A9C
                                                                                                                                                                                        • Part of subcall function 1002F9A6: __FF_MSGBANNER.LIBCMT ref: 1002F9C9
                                                                                                                                                                                        • Part of subcall function 1002F9A6: __NMSG_WRITE.LIBCMT ref: 1002F9D0
                                                                                                                                                                                        • Part of subcall function 1002F9A6: HeapAlloc.KERNEL32(00000000,-0000000E,00000001,00000000,00000000,?,1003580D,?,00000001,00000001,10035A23,00000018,10050CC8,0000000C,10035AB2,00000001), ref: 1002FA1E
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AllocHeap_malloc
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3293231637-0
                                                                                                                                                                                      • Opcode ID: ab67eba576b62ed2242e6049fa4a9f00a0283ae289beaf397465af8560d1c9fc
                                                                                                                                                                                      • Instruction ID: 7622b3071c216813c8acba396ad13572c3e9674cac4916c3917d4934f1ce5c91
                                                                                                                                                                                      • Opcode Fuzzy Hash: ab67eba576b62ed2242e6049fa4a9f00a0283ae289beaf397465af8560d1c9fc
                                                                                                                                                                                      • Instruction Fuzzy Hash: BF844072D0002ECFCF08DFECCA959EEFBB5FF68204B169259D425BB294C6356A11CA54
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002083B Relevance: 16.6, APIs: 11, Instructions: 103memoryCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(100575E0,?,?,?,?,100575C4,10020C7A,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139,00000004), ref: 1002084A
                                                                                                                                                                                      • GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,100575C4,10020C7A,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139), ref: 100208A0
                                                                                                                                                                                      • GlobalHandle.KERNEL32(0149C8B8), ref: 100208A9
                                                                                                                                                                                      • GlobalUnlock.KERNEL32(00000000,?,?,?,?,100575C4,10020C7A,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139,00000004), ref: 100208B2
                                                                                                                                                                                      • GlobalReAlloc.KERNEL32 ref: 100208C9
                                                                                                                                                                                      • GlobalHandle.KERNEL32(0149C8B8), ref: 100208DB
                                                                                                                                                                                      • GlobalLock.KERNEL32 ref: 100208E2
                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?,?,?,?,?,100575C4,10020C7A,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139,00000004), ref: 100208EC
                                                                                                                                                                                      • GlobalLock.KERNEL32 ref: 100208F8
                                                                                                                                                                                      • _memset.LIBCMT ref: 10020911
                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?), ref: 1002093D
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock_memset
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 496899490-0
                                                                                                                                                                                      • Opcode ID: 23a5f943a2514d5899e1dc1f035ea6f74369b98ac7016ed06c6f01df95d95d17
                                                                                                                                                                                      • Instruction ID: dc14c853345dee55639cdae2a1fd03b11c2696e398e705256622f09b1856cd91
                                                                                                                                                                                      • Opcode Fuzzy Hash: 23a5f943a2514d5899e1dc1f035ea6f74369b98ac7016ed06c6f01df95d95d17
                                                                                                                                                                                      • Instruction Fuzzy Hash: 08319C75600715AFE324CF24DD88A1AB7EAEB49241B01492AF996C3662EB71F8448B50
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002FA69 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __lock.LIBCMT ref: 1002FA87
                                                                                                                                                                                        • Part of subcall function 10035A99: __mtinitlocknum.LIBCMT ref: 10035AAD
                                                                                                                                                                                        • Part of subcall function 10035A99: __amsg_exit.LIBCMT ref: 10035AB9
                                                                                                                                                                                        • Part of subcall function 10035A99: EnterCriticalSection.KERNEL32(00000001,00000001,?,10035387,0000000D,10050C60,00000008,10035479,00000001,?,?,00000001,?,?,10030C69,00000001), ref: 10035AC1
                                                                                                                                                                                      • ___sbh_find_block.LIBCMT ref: 1002FA92
                                                                                                                                                                                      • ___sbh_free_block.LIBCMT ref: 1002FAA1
                                                                                                                                                                                      • RtlFreeHeap.NTDLL(00000000,?,10050988,0000000C,100352DD,00000000,?,1003580D,?,00000001,00000001,10035A23,00000018,10050CC8,0000000C,10035AB2), ref: 1002FAD1
                                                                                                                                                                                      • GetLastError.KERNEL32(?,1003580D,?,00000001,00000001,10035A23,00000018,10050CC8,0000000C,10035AB2,00000001,00000001,?,10035387,0000000D,10050C60), ref: 1002FAE2
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2714421763-0
                                                                                                                                                                                      • Opcode ID: dc462893557a6a2c1efb59ab9fc79b5cbceadcecec0e23dee2ff352f2dee75c2
                                                                                                                                                                                      • Instruction ID: c59143bfe651e608972d8f734a12067a167937505bca417355bd9d82aad263b9
                                                                                                                                                                                      • Opcode Fuzzy Hash: dc462893557a6a2c1efb59ab9fc79b5cbceadcecec0e23dee2ff352f2dee75c2
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3D012BB5904316AEEB11DFB0EC05B9D7BB4EF013D2F50412DF008AE091DB35A840DB92
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10001B80 Relevance: 3.1, APIs: 2, Instructions: 98COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 171 10001b80-10001b90 172 10001b92-10001b97 171->172 173 10001b9c-10001ba8 171->173 174 10001c9c-10001c9f 172->174 175 10001c04-10001c66 173->175 176 10001baa-10001bb5 173->176 179 10001c74-10001c91 VirtualProtect 175->179 180 10001c68-10001c71 175->180 177 10001bb7-10001bbe 176->177 178 10001bfa-10001bff 176->178 181 10001bc0-10001bce 177->181 182 10001be2-10001bf4 VirtualFree 177->182 178->174 183 10001c93-10001c95 179->183 184 10001c97 179->184 180->179 181->182 185 10001bd0-10001be0 181->185 182->178 183->174 184->174 185->178 185->182
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • VirtualFree.KERNELBASE(00000000,?,00004000,?,10001E18,00000001,00000000,?,100025E8,?,?,?,?,100025E8,00000000,00000000), ref: 10001BF4
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: FreeVirtual
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1263568516-0
                                                                                                                                                                                      • Opcode ID: dd38d51ca3a6b672f32aeaf0fb246c4496e8ccb210392943b19121075d5be09d
                                                                                                                                                                                      • Instruction ID: 749d9464b473a0839557e7d3f54d457581c14e70089049c47b2cfbba366a5d19
                                                                                                                                                                                      • Opcode Fuzzy Hash: dd38d51ca3a6b672f32aeaf0fb246c4496e8ccb210392943b19121075d5be09d
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5841B9746002099FEB48CF58C490FA9B7B2FB88350F14C659E81A9F395D731EE41CB84
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10036624 Relevance: 3.0, APIs: 2, Instructions: 28memoryCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 186 10036624-10036642 HeapCreate 187 10036647-10036654 call 100365c9 186->187 188 10036644-10036646 186->188 191 10036656-10036663 call 10035aca 187->191 192 1003667a-1003667d 187->192 191->192 195 10036665-10036678 HeapDestroy 191->195 195->188
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • HeapCreate.KERNELBASE(00000000,00001000,00000000,10030AEB,00000001,?,?,00000001,?,?,10030C69,00000001,?,?,10050A28,0000000C), ref: 10036635
                                                                                                                                                                                      • HeapDestroy.KERNEL32(?,?,00000001,?,?,10030C69,00000001,?,?,10050A28,0000000C,10030D23,?), ref: 1003666B
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Heap$CreateDestroy
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3296620671-0
                                                                                                                                                                                      • Opcode ID: d3c419273cfe47b5decc93e2e70dd510a49122bb40b3ad2795d27682d43cbdf9
                                                                                                                                                                                      • Instruction ID: 5adf962be877c1470e25a5b203e63be93066c2f5666ac54c72bc9e0dfe65a95a
                                                                                                                                                                                      • Opcode Fuzzy Hash: d3c419273cfe47b5decc93e2e70dd510a49122bb40b3ad2795d27682d43cbdf9
                                                                                                                                                                                      • Instruction Fuzzy Hash: 22E06D706103519EFB139B30CE8A33539F8FB5878BF008869F405C80A0FBA08840AA15
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100019C0 Relevance: 2.6, APIs: 2, Instructions: 115memoryCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 196 100019c0-100019ee 197 10001a02-10001a0e 196->197 198 10001a14-10001a1b 197->198 199 10001b06 197->199 200 10001a83-10001a9e call 10001990 198->200 201 10001a1d-10001a2a 198->201 202 10001b0b-10001b0e 199->202 211 10001aa0-10001aa2 200->211 212 10001aa4-10001ac9 VirtualAlloc 200->212 203 10001a2c-10001a4e VirtualAlloc 201->203 204 10001a7e 201->204 206 10001a50-10001a52 203->206 207 10001a57-10001a7b call 100017c0 203->207 204->197 206->202 207->204 211->202 214 10001acb-10001acd 212->214 215 10001acf-10001afe call 10001810 212->215 214->202 215->199
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • VirtualAlloc.KERNEL32(4D8B0000,00000000,00001000,00000004,?,1000257F,00000000), ref: 10001A41
                                                                                                                                                                                      • VirtualAlloc.KERNELBASE(4D8B0000,8B118BBC,00001000,00000004,10012839,8B118BBC,?,1000257F,00000000,10012839,?), ref: 10001ABC
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AllocVirtual
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 4275171209-0
                                                                                                                                                                                      • Opcode ID: 095274eb58cefc7da223eb8c3e93af1acb0495bf3fbc764276b25f8f0a8074d8
                                                                                                                                                                                      • Instruction ID: bcee95509f27266f5ca249dd7f6d6a0ca5035efccc592cd1fda7edfbe35d51d4
                                                                                                                                                                                      • Opcode Fuzzy Hash: 095274eb58cefc7da223eb8c3e93af1acb0495bf3fbc764276b25f8f0a8074d8
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0D51D9B4A0010AEFDB04CF94C991AAEB7F5FF48344F248599E905AB345D770EE91CBA1
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                      Function 10012C30 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 156networkCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • _memset.LIBCMT ref: 10012C6C
                                                                                                                                                                                      • connect.WS2_32(?,?,00000010), ref: 10012CA7
                                                                                                                                                                                      • send.WS2_32(?,?,00000064,00000000), ref: 10012D06
                                                                                                                                                                                      • recv.WS2_32(000000FF,?,00000064,00000000), ref: 10012D9D
                                                                                                                                                                                        • Part of subcall function 1001DDF4: IsWindow.USER32(?), ref: 1001DE03
                                                                                                                                                                                        • Part of subcall function 1001DECA: EnableWindow.USER32(?,10046640), ref: 1001DED7
                                                                                                                                                                                        • Part of subcall function 1001DD46: GetDlgItem.USER32 ref: 1001DD53
                                                                                                                                                                                        • Part of subcall function 1001DDF4: SetWindowTextA.USER32(?,00000064), ref: 1001DE2B
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Window$EnableItemText_memsetconnectrecvsend
                                                                                                                                                                                      • String ID: Connected$Disconnected$Wait...
                                                                                                                                                                                      • API String ID: 119675363-2304371739
                                                                                                                                                                                      • Opcode ID: 5b08e9dbcbe72183f65bc00083dd8b9667ad7d5dfeacba7cbb0734b26863e533
                                                                                                                                                                                      • Instruction ID: 809deafcd8a1ebdff950075e8a5ab3cba01c3ccaf73ffb16f134ff4a091f78a6
                                                                                                                                                                                      • Opcode Fuzzy Hash: 5b08e9dbcbe72183f65bc00083dd8b9667ad7d5dfeacba7cbb0734b26863e533
                                                                                                                                                                                      • Instruction Fuzzy Hash: 88513DB4A002189BDB14EBA8CC95BEEB7B1FF48308F104169E5066F2C2DF75A991CF44
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10014B71 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70libraryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • _strcpy_s.LIBCMT ref: 10014B9E
                                                                                                                                                                                        • Part of subcall function 100311F4: __getptd_noexit.LIBCMT ref: 100311F4
                                                                                                                                                                                      • __snprintf_s.LIBCMT ref: 10014BD7
                                                                                                                                                                                        • Part of subcall function 1003119A: __vsnprintf_s_l.LIBCMT ref: 100311AF
                                                                                                                                                                                      • GetLocaleInfoA.KERNEL32(00000800,00000003,?,00000004), ref: 10014C02
                                                                                                                                                                                      • LoadLibraryA.KERNEL32(?), ref: 10014C25
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: InfoLibraryLoadLocale__getptd_noexit__snprintf_s__vsnprintf_s_l_strcpy_s
                                                                                                                                                                                      • String ID: LOC
                                                                                                                                                                                      • API String ID: 3864805678-519433814
                                                                                                                                                                                      • Opcode ID: 993ef955d11e1d056c0da4e243e940ae0abcf9c49e17b7ca6a81ba24efbb4c92
                                                                                                                                                                                      • Instruction ID: c6b9acf05ba5f485c5c472c95a6cc1a1d49ea65b07ecc8430683ae88ba63382e
                                                                                                                                                                                      • Opcode Fuzzy Hash: 993ef955d11e1d056c0da4e243e940ae0abcf9c49e17b7ca6a81ba24efbb4c92
                                                                                                                                                                                      • Instruction Fuzzy Hash: B011E471900118AFDB11DB64CC86BDD73B8EF09315F1241A1F7059F0A1EEB0E9859AD1
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002F81E Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • IsDebuggerPresent.KERNEL32 ref: 100357B5
                                                                                                                                                                                      • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 100357CA
                                                                                                                                                                                      • UnhandledExceptionFilter.KERNEL32(10049C70), ref: 100357D5
                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(C0000409), ref: 100357F1
                                                                                                                                                                                      • TerminateProcess.KERNEL32(00000000), ref: 100357F8
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2579439406-0
                                                                                                                                                                                      • Opcode ID: 8c939c2efb241c6fb0af2f27818b77021c2f68401b871af98be5750efaca2114
                                                                                                                                                                                      • Instruction ID: 3237c6aacfb12be4d9d12df29f826ae8d0614ddfd4a103b53015e2b6a0b2c6c3
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8c939c2efb241c6fb0af2f27818b77021c2f68401b871af98be5750efaca2114
                                                                                                                                                                                      • Instruction Fuzzy Hash: B021FFB4801320CFFB11DF68EDC56483BB4FB88315F50606AE90D87A71E7B16A80AF56
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002DB49 Relevance: 28.9, APIs: 19, Instructions: 423stringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: String$Variant$ClearFree_memset$ChangeException@8H_prolog3ThrowTypelstrlen
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 4128688680-0
                                                                                                                                                                                      • Opcode ID: 6192f18373e1637f38ae635fdb485c2c49157f7b8aa44aff1f0335ddf822a966
                                                                                                                                                                                      • Instruction ID: 42fa242583032f4c72b1ee8c19c4a820194bcb4b4a787a5525753aa98076571e
                                                                                                                                                                                      • Opcode Fuzzy Hash: 6192f18373e1637f38ae635fdb485c2c49157f7b8aa44aff1f0335ddf822a966
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5EF18A7490025ADFDF11DFA8D880AEEBBB4FF05300F90406AE951AB2A1D774AE56CF50
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10018B59 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 77libraryloaderCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(USER32,00000000,00000000,74ED5D80,10018CA5,?,?,?,?,?,?,?,1001AB36,00000000,00000002,00000028), ref: 10018B82
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 10018B9E
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 10018BAF
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 10018BC0
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 10018BD1
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 10018BE2
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 10018BF3
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,EnumDisplayDevicesA), ref: 10018C04
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AddressProc$HandleModule
                                                                                                                                                                                      • String ID: EnumDisplayDevicesA$EnumDisplayMonitors$GetMonitorInfoA$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32
                                                                                                                                                                                      • API String ID: 667068680-68207542
                                                                                                                                                                                      • Opcode ID: ef20b1205fbe14ac9d2a40522549883dc0a7ccf4399eb4921ca3be0b95f38340
                                                                                                                                                                                      • Instruction ID: 77f58ff47d83721d02e0aa712f7cb6554a3c60b1de10c844b6b889dbd48dd915
                                                                                                                                                                                      • Opcode Fuzzy Hash: ef20b1205fbe14ac9d2a40522549883dc0a7ccf4399eb4921ca3be0b95f38340
                                                                                                                                                                                      • Instruction Fuzzy Hash: 40213071902121AAE751DF25ADC046DBAEAF349280F61093FF10CD6560D7309AC6AFA9
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1001AA48 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 176windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 1001DDC0: GetWindowLongA.USER32 ref: 1001DDCB
                                                                                                                                                                                      • GetParent.USER32(?), ref: 1001AA75
                                                                                                                                                                                      • SendMessageA.USER32(00000000,0000036B,00000000,00000000), ref: 1001AA98
                                                                                                                                                                                      • GetWindowRect.USER32 ref: 1001AAB2
                                                                                                                                                                                      • GetWindowLongA.USER32 ref: 1001AAC8
                                                                                                                                                                                      • CopyRect.USER32 ref: 1001AB15
                                                                                                                                                                                      • CopyRect.USER32 ref: 1001AB1F
                                                                                                                                                                                      • GetWindowRect.USER32 ref: 1001AB28
                                                                                                                                                                                      • CopyRect.USER32 ref: 1001AB44
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Rect$Window$Copy$Long$MessageParentSend
                                                                                                                                                                                      • String ID: (
                                                                                                                                                                                      • API String ID: 808654186-3887548279
                                                                                                                                                                                      • Opcode ID: 058a394f33d0b4ea0f3338ceab01116baeabbc1ca71f5aa138c65239db7cf94a
                                                                                                                                                                                      • Instruction ID: b5709b81a08ee2b414ac32db9db5e9a4175f57b01f1fa3e32d23aafb2ee176ce
                                                                                                                                                                                      • Opcode Fuzzy Hash: 058a394f33d0b4ea0f3338ceab01116baeabbc1ca71f5aa138c65239db7cf94a
                                                                                                                                                                                      • Instruction Fuzzy Hash: CC513C72900219AFDB00CBA8CD85EEEBBF9EF49214F154115F905EB291EB34E985CB61
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100161C0 Relevance: 18.1, APIs: 12, Instructions: 91synchronizationthreadinjectionCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • _memset.LIBCMT ref: 100161DE
                                                                                                                                                                                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 100161FC
                                                                                                                                                                                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 10016206
                                                                                                                                                                                      • ResumeThread.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 10016248
                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,00000000), ref: 10016253
                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 1001625C
                                                                                                                                                                                      • SuspendThread.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 10016267
                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,00000000), ref: 10016277
                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 10016280
                                                                                                                                                                                      • CloseHandle.KERNEL32(00000002,?,00000000), ref: 100162A2
                                                                                                                                                                                        • Part of subcall function 100201F1: __CxxThrowException@8.LIBCMT ref: 10020205
                                                                                                                                                                                      • SetEvent.KERNEL32(00000004,?,?,?,?,?,?,?,00000000), ref: 1001628A
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CloseEventHandle$CreateObjectSingleThreadWait$Exception@8ResumeSuspendThrow_memset
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3191170017-0
                                                                                                                                                                                      • Opcode ID: 2f30da852c83b448af5579f0f44270d029fe44d128d829d4e1193c6c18408e94
                                                                                                                                                                                      • Instruction ID: 00337a1eacd8e53df2662d8cc6bc483a2e3f323796300d703392e3233c80558b
                                                                                                                                                                                      • Opcode Fuzzy Hash: 2f30da852c83b448af5579f0f44270d029fe44d128d829d4e1193c6c18408e94
                                                                                                                                                                                      • Instruction Fuzzy Hash: 69314772800A19FFDF11AFA4CD849AEBBB8EB08394F108269F511A6160D671A9818F61
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1001736E Relevance: 16.6, APIs: 11, Instructions: 139COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3_catch.LIBCMT ref: 10017375
                                                                                                                                                                                      • FindResourceA.KERNEL32(?,?,00000005), ref: 100173A8
                                                                                                                                                                                      • LoadResource.KERNEL32(?,00000000), ref: 100173B0
                                                                                                                                                                                      • LockResource.KERNEL32(00000008,00000024,100010EC,00000000,10046640), ref: 100173C1
                                                                                                                                                                                      • GetDesktopWindow.USER32 ref: 100173F4
                                                                                                                                                                                      • IsWindowEnabled.USER32(000000FF), ref: 10017402
                                                                                                                                                                                      • EnableWindow.USER32(000000FF,00000000), ref: 10017411
                                                                                                                                                                                        • Part of subcall function 1001DEAF: IsWindowEnabled.USER32(?), ref: 1001DEB8
                                                                                                                                                                                        • Part of subcall function 1001DECA: EnableWindow.USER32(?,10046640), ref: 1001DED7
                                                                                                                                                                                      • EnableWindow.USER32(000000FF,00000001), ref: 100174ED
                                                                                                                                                                                      • GetActiveWindow.USER32 ref: 100174F8
                                                                                                                                                                                      • SetActiveWindow.USER32(000000FF,?,00000024,100010EC,00000000,10046640), ref: 10017506
                                                                                                                                                                                      • FreeResource.KERNEL32(00000008,?,00000024,100010EC,00000000,10046640), ref: 10017522
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Window$Resource$Enable$ActiveEnabled$DesktopFindFreeH_prolog3_catchLoadLock
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1509511306-0
                                                                                                                                                                                      • Opcode ID: 8887fad69eff7dfeb0e1daad3ea1c484619822cd4cc789857992b00dd05f503d
                                                                                                                                                                                      • Instruction ID: 24f9302adfe4a133b48f7954ad32019338b8f4d830f04ff5f1dc3598c8fc37ea
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8887fad69eff7dfeb0e1daad3ea1c484619822cd4cc789857992b00dd05f503d
                                                                                                                                                                                      • Instruction Fuzzy Hash: 41519A34A00715DBDB11EFB4CD896AEBBF2FF48701F204129E506AA1A1DB74E9C1CB55
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100351B5 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 46libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(KERNEL32.DLL,10050C40,0000000C,100352C7,00000000,00000000,?,1003580D,?,00000001,00000001,10035A23,00000018,10050CC8,0000000C,10035AB2), ref: 100351C6
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 100351EF
                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,DecodePointer), ref: 100351FF
                                                                                                                                                                                      • InterlockedIncrement.KERNEL32(10054D18), ref: 10035221
                                                                                                                                                                                      • __lock.LIBCMT ref: 10035229
                                                                                                                                                                                      • ___addlocaleref.LIBCMT ref: 10035248
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AddressProc$HandleIncrementInterlockedModule___addlocaleref__lock
                                                                                                                                                                                      • String ID: DecodePointer$EncodePointer$KERNEL32.DLL
                                                                                                                                                                                      • API String ID: 1036688887-2843748187
                                                                                                                                                                                      • Opcode ID: d574a0f1000a19323f7053aa8cd70e6a5049edfe48066084e54d0a0798c8c5f6
                                                                                                                                                                                      • Instruction ID: b318c4b35d3b307acbdb6d10fcd30e50ea36946f4a8ba2e6b5da3482df9394b6
                                                                                                                                                                                      • Opcode Fuzzy Hash: d574a0f1000a19323f7053aa8cd70e6a5049edfe48066084e54d0a0798c8c5f6
                                                                                                                                                                                      • Instruction Fuzzy Hash: B811ACB0801B01AFE721CF79CC80B9ABBE0EF05302F104529E49ADB261DB75A900CF15
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1001717E Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 158COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3_catch.LIBCMT ref: 10017185
                                                                                                                                                                                      • GetSystemMetrics.USER32 ref: 10017236
                                                                                                                                                                                      • GlobalLock.KERNEL32 ref: 1001729F
                                                                                                                                                                                      • CreateDialogIndirectParamA.USER32(?,?,?,10016BDA,00000000), ref: 100172CE
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CreateDialogGlobalH_prolog3_catchIndirectLockMetricsParamSystem
                                                                                                                                                                                      • String ID: MS Shell Dlg
                                                                                                                                                                                      • API String ID: 1736106359-76309092
                                                                                                                                                                                      • Opcode ID: ce3ca581592317389ef65e808fedc345d4d6962fe5f5f1ce60146464d019ac3a
                                                                                                                                                                                      • Instruction ID: d5dd74ac162ff8de1123455b698b8f5e71fb740695f122bac0aed726529ed5a4
                                                                                                                                                                                      • Opcode Fuzzy Hash: ce3ca581592317389ef65e808fedc345d4d6962fe5f5f1ce60146464d019ac3a
                                                                                                                                                                                      • Instruction Fuzzy Hash: 4D51CC34900215EBCB05DFA8CC859EEBBB5FF44340F254659F85AEB292DB30DA81CB91
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100209ED Relevance: 13.6, APIs: 9, Instructions: 96memoryCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3_catch.LIBCMT ref: 100209F4
                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(?,00000010,10020CA6,?,00000000,?,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139,00000004,10001031), ref: 10020A05
                                                                                                                                                                                      • TlsGetValue.KERNEL32(?,?,00000000,?,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139,00000004,10001031,00000000), ref: 10020A23
                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,00000000,00000000,00000010,?,?,00000000,?,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139), ref: 10020A57
                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139,00000004,10001031,00000000), ref: 10020AC3
                                                                                                                                                                                      • _memset.LIBCMT ref: 10020AE2
                                                                                                                                                                                      • TlsSetValue.KERNEL32(?,00000000), ref: 10020AF3
                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139,00000004,10001031,00000000), ref: 10020B14
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CriticalSection$LeaveValue$AllocEnterH_prolog3_catchLocal_memset
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1891723912-0
                                                                                                                                                                                      • Opcode ID: c202fd39cbfffff3bf24e4dfcb1fdac57d085034b58585143c8170edaa30a227
                                                                                                                                                                                      • Instruction ID: bbf58174ed8a80918add6c1c4d28f9e8b2dc0fc786f447701b2046db94720ece
                                                                                                                                                                                      • Opcode Fuzzy Hash: c202fd39cbfffff3bf24e4dfcb1fdac57d085034b58585143c8170edaa30a227
                                                                                                                                                                                      • Instruction Fuzzy Hash: F2319874500716EFD720DF10EC85D5EBBA2EF04310BA1C529F91A9A662DB30B990CB81
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10014A22 Relevance: 12.1, APIs: 8, Instructions: 65memorystringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GlobalLock.KERNEL32 ref: 10014A3F
                                                                                                                                                                                      • lstrcmpA.KERNEL32(?,?), ref: 10014A4B
                                                                                                                                                                                      • OpenPrinterA.WINSPOOL.DRV(?,?,00000000), ref: 10014A5D
                                                                                                                                                                                      • DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 10014A7D
                                                                                                                                                                                      • GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 10014A85
                                                                                                                                                                                      • GlobalLock.KERNEL32 ref: 10014A8F
                                                                                                                                                                                      • DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 10014A9C
                                                                                                                                                                                      • ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 10014AB4
                                                                                                                                                                                        • Part of subcall function 10020495: GlobalFlags.KERNEL32(?), ref: 100204A0
                                                                                                                                                                                        • Part of subcall function 10020495: GlobalUnlock.KERNEL32(?,?,?,10014801,?,00000004,1000116F,?,?,1000113F), ref: 100204B2
                                                                                                                                                                                        • Part of subcall function 10020495: GlobalFree.KERNEL32 ref: 100204BD
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 168474834-0
                                                                                                                                                                                      • Opcode ID: 682e8427e4eae8e26461a3ae413d84982b563dbbe5be57b0626e4beef210c331
                                                                                                                                                                                      • Instruction ID: 20fc1444fe35ab48259a21c9388e4acfe4ba196ce7874d1294122afbb026df8a
                                                                                                                                                                                      • Opcode Fuzzy Hash: 682e8427e4eae8e26461a3ae413d84982b563dbbe5be57b0626e4beef210c331
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5111CAB6500604BBDB22DFA6CD89C6FBBEDEF897407514029FA01C6121DA31E940D728
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1001820B Relevance: 10.8, APIs: 7, Instructions: 255memoryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3.LIBCMT ref: 10018224
                                                                                                                                                                                      • MapDialogRect.USER32(?,00000000), ref: 100182B5
                                                                                                                                                                                      • SysAllocStringLen.OLEAUT32(?,?), ref: 100182D4
                                                                                                                                                                                      • CLSIDFromString.OLE32(?,?,00000000), ref: 100183C6
                                                                                                                                                                                        • Part of subcall function 100144EC: _malloc.LIBCMT ref: 10014506
                                                                                                                                                                                      • CLSIDFromProgID.OLE32(?,?,00000000), ref: 100183CE
                                                                                                                                                                                      • SetWindowPos.USER32(?,00000001,00000000,00000000,00000000,00000000,00000013,00000001,00000000,?,00000000,?,00000000,00000000,0000FC84,00000000), ref: 10018468
                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 100184BA
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: String$From$AllocDialogFreeH_prolog3ProgRectWindow_malloc
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2841959276-0
                                                                                                                                                                                      • Opcode ID: c0153d1bb8fcf0a41aaabcf573d8d81effc90bbca259e310eefe5537c03a2762
                                                                                                                                                                                      • Instruction ID: 12b2beb2c71702a94885f2910fef0e7bfaf155135e6476596dcf7fffba126212
                                                                                                                                                                                      • Opcode Fuzzy Hash: c0153d1bb8fcf0a41aaabcf573d8d81effc90bbca259e310eefe5537c03a2762
                                                                                                                                                                                      • Instruction Fuzzy Hash: E2B1F075900219AFDB44CFA8C984AEE7BF4FF08344F41812AFC199B251E774EA94CB94
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1001AC0A Relevance: 10.6, APIs: 7, Instructions: 115windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetParent.USER32(?), ref: 1001AC38
                                                                                                                                                                                      • PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 1001AC5F
                                                                                                                                                                                      • UpdateWindow.USER32(?), ref: 1001AC79
                                                                                                                                                                                      • SendMessageA.USER32(?,00000121,00000000,?), ref: 1001AC9D
                                                                                                                                                                                      • SendMessageA.USER32(?,0000036A,00000000,00000004), ref: 1001ACB7
                                                                                                                                                                                      • UpdateWindow.USER32(?), ref: 1001ACFD
                                                                                                                                                                                      • PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 1001AD31
                                                                                                                                                                                        • Part of subcall function 1001DDC0: GetWindowLongA.USER32 ref: 1001DDCB
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Message$Window$PeekSendUpdate$LongParent
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2853195852-0
                                                                                                                                                                                      • Opcode ID: 8feb0ac7bae7ce442b8f735e4586b594c24fd72a806b3adb2c8abbd7d5165037
                                                                                                                                                                                      • Instruction ID: 2c496a546f4f3369c4007c2120619f6f6246382fa3c8875764faf214921a126d
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8feb0ac7bae7ce442b8f735e4586b594c24fd72a806b3adb2c8abbd7d5165037
                                                                                                                                                                                      • Instruction Fuzzy Hash: CF419C306047419FD721DF218D84A1BBAE4FFC6B95F00092DF8829A5A1E772D9C4CA92
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100151F8 Relevance: 10.6, APIs: 7, Instructions: 111windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetCapture.USER32 ref: 10020D74
                                                                                                                                                                                      • SendMessageA.USER32(00000000,00000365,00000000,00000000), ref: 10020D8D
                                                                                                                                                                                      • GetFocus.USER32(?,?,?,?,00000000), ref: 10020D9F
                                                                                                                                                                                      • SendMessageA.USER32(00000000,00000365,00000000,00000000), ref: 10020DAB
                                                                                                                                                                                      • GetLastActivePopup.USER32(?), ref: 10020DD2
                                                                                                                                                                                      • SendMessageA.USER32(00000000,00000365,00000000,00000000), ref: 10020DDD
                                                                                                                                                                                      • SendMessageA.USER32(?,00000111,0000E147,00000000), ref: 10020E01
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSend$ActiveCaptureFocusLastPopup
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3219385341-0
                                                                                                                                                                                      • Opcode ID: 0692041214081e2f36a8d4241324024d2ae50e87aeefd30631ef423bb921d550
                                                                                                                                                                                      • Instruction ID: 62284d7f9b5d477bd881e5ff36e2f7527576b9e0115aa241cae08abffcb520cf
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0692041214081e2f36a8d4241324024d2ae50e87aeefd30631ef423bb921d550
                                                                                                                                                                                      • Instruction Fuzzy Hash: B2314975301315EFDA11DB64ECC4D6F7AEEEB866C1B530469F840DB112DB31EC8196A2
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002A200 Relevance: 10.6, APIs: 7, Instructions: 86windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Window$LongParentVisible
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 506644340-0
                                                                                                                                                                                      • Opcode ID: 4c680b8172efdff4f43197e84ba51ed07d499ac862c14e8ee8a7a782e640ae8a
                                                                                                                                                                                      • Instruction ID: 0686fc7eee0d828e519c8ddef4b664d273c3d3866c12363d81ce6f3f8585b441
                                                                                                                                                                                      • Opcode Fuzzy Hash: 4c680b8172efdff4f43197e84ba51ed07d499ac862c14e8ee8a7a782e640ae8a
                                                                                                                                                                                      • Instruction Fuzzy Hash: 8D219532A00B25EBD621EBB99C49F1B76DCFF8A790F810514F991EB152DF26EC848750
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10032A89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • ___set_flsgetvalue.LIBCMT ref: 10032AB8
                                                                                                                                                                                      • __calloc_crt.LIBCMT ref: 10032AC4
                                                                                                                                                                                      • CreateThread.KERNEL32 ref: 10032B08
                                                                                                                                                                                      • GetLastError.KERNEL32(?,1001623D,?,?,100160A8,?,00000002,00000030,?,00000000), ref: 10032B12
                                                                                                                                                                                      • __dosmaperr.LIBCMT ref: 10032B2A
                                                                                                                                                                                        • Part of subcall function 100311F4: __getptd_noexit.LIBCMT ref: 100311F4
                                                                                                                                                                                        • Part of subcall function 10037753: __decode_pointer.LIBCMT ref: 1003775C
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd_noexit
                                                                                                                                                                                      • String ID: V&'
                                                                                                                                                                                      • API String ID: 1067611704-802299783
                                                                                                                                                                                      • Opcode ID: 7692696f047afdf50ec9d72e30f89faf206a335569b9867b5efcd1348c4cc88e
                                                                                                                                                                                      • Instruction ID: 55a26fe1f49629ebb029cc0f5307a0876855c5a2f29d8e6ee061ec31c14b4724
                                                                                                                                                                                      • Opcode Fuzzy Hash: 7692696f047afdf50ec9d72e30f89faf206a335569b9867b5efcd1348c4cc88e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 28112376505205EFDB02EFA4DC8288FBBE8FF08366F210429F501DA061EB31A910CBA1
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10001390 Relevance: 10.6, APIs: 7, Instructions: 67COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 10016C9F: _memset.LIBCMT ref: 10016CB6
                                                                                                                                                                                      • Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 100013DA
                                                                                                                                                                                      • Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 100013EC
                                                                                                                                                                                      • Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 100013FE
                                                                                                                                                                                      • Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 10001410
                                                                                                                                                                                      • Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 10001422
                                                                                                                                                                                      • Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 10001446
                                                                                                                                                                                      • Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 10001458
                                                                                                                                                                                        • Part of subcall function 100136C0: LoadIconA.USER32(00000000,00000000), ref: 100136D2
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ProcessorVirtual$Concurrency::RootRoot::$IconLoad_memset
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2004563703-0
                                                                                                                                                                                      • Opcode ID: 6dfda32c90deb5612abc77854e0b58487ec939f19a89b76ccee82452222fe2ce
                                                                                                                                                                                      • Instruction ID: cb42d3b07606be4c321c66a21cc03232491b7df8b22d3b1298026f5f2f4788d5
                                                                                                                                                                                      • Opcode Fuzzy Hash: 6dfda32c90deb5612abc77854e0b58487ec939f19a89b76ccee82452222fe2ce
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1A216DB4904299EBDB04CBA8C951BAEBB75FF05704F148558E4516B3C2CB79AA00CB65
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10001180 Relevance: 10.6, APIs: 7, Instructions: 54COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • ~_Task_impl.LIBCPMT ref: 100011B6
                                                                                                                                                                                        • Part of subcall function 10018A6F: __EH_prolog3.LIBCMT ref: 10018A76
                                                                                                                                                                                      • ~_Task_impl.LIBCPMT ref: 100011C8
                                                                                                                                                                                      • ~_Task_impl.LIBCPMT ref: 100011EC
                                                                                                                                                                                        • Part of subcall function 10018AC4: __EH_prolog3.LIBCMT ref: 10018ACB
                                                                                                                                                                                      • ~_Task_impl.LIBCPMT ref: 100011FE
                                                                                                                                                                                      • ~_Task_impl.LIBCPMT ref: 10001210
                                                                                                                                                                                      • ~_Task_impl.LIBCPMT ref: 10001222
                                                                                                                                                                                      • ~_Task_impl.LIBCPMT ref: 10001231
                                                                                                                                                                                        • Part of subcall function 10018662: __EH_prolog3.LIBCMT ref: 10018669
                                                                                                                                                                                        • Part of subcall function 10016C14: __EH_prolog3.LIBCMT ref: 10016C1B
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Task_impl$H_prolog3
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1204490572-0
                                                                                                                                                                                      • Opcode ID: 10d967965786d9dd3e33bfeddf35d30d57af0e4a65215ad2dc6e6a32aea05cb1
                                                                                                                                                                                      • Instruction ID: 6e4cb6b4a122521f521244997ac3fe4936e5f385243ec76687bf906466ac38b5
                                                                                                                                                                                      • Opcode Fuzzy Hash: 10d967965786d9dd3e33bfeddf35d30d57af0e4a65215ad2dc6e6a32aea05cb1
                                                                                                                                                                                      • Instruction Fuzzy Hash: 6B215970905189DBEF09DB98C860BBEBB75EF01308F18469DE0526B3C2CB392B00C716
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002D1E9 Relevance: 9.3, APIs: 6, Instructions: 253stringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3_catch_GS.LIBCMT ref: 1002D1F0
                                                                                                                                                                                      • lstrlenA.KERNEL32(00000000,000000FF,00000050,10022221,00000000,00000001,?,?,000000FF,?,?,?), ref: 1002D222
                                                                                                                                                                                        • Part of subcall function 10017790: _memcpy_s.LIBCMT ref: 100177A0
                                                                                                                                                                                      • _memset.LIBCMT ref: 1002D2F2
                                                                                                                                                                                      • VariantClear.OLEAUT32(?), ref: 1002D3D1
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ClearH_prolog3_catch_Variant_memcpy_s_memsetlstrlen
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 4021759052-0
                                                                                                                                                                                      • Opcode ID: dc537336900b1f9e5654c723f7bc7d689170c1efb2efdbad80408bb984cec35a
                                                                                                                                                                                      • Instruction ID: 5c01f4bcc98ccee0a604cdfa5feeb0fdece88e80b40f5b50a3c571396f452454
                                                                                                                                                                                      • Opcode Fuzzy Hash: dc537336900b1f9e5654c723f7bc7d689170c1efb2efdbad80408bb984cec35a
                                                                                                                                                                                      • Instruction Fuzzy Hash: 50A18C35C04249DBCF11EFA4E985AEEBBF0FF04350FA0415AE914AB291D734AE41DB61
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100169E1 Relevance: 9.1, APIs: 6, Instructions: 115threadwindowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 10016936: GetParent.USER32(100010EC), ref: 10016989
                                                                                                                                                                                        • Part of subcall function 10016936: GetLastActivePopup.USER32(100010EC), ref: 10016998
                                                                                                                                                                                        • Part of subcall function 10016936: IsWindowEnabled.USER32(100010EC), ref: 100169AD
                                                                                                                                                                                        • Part of subcall function 10016936: EnableWindow.USER32(100010EC,00000000), ref: 100169C0
                                                                                                                                                                                      • EnableWindow.USER32(?,00000001), ref: 10016A2E
                                                                                                                                                                                      • GetWindowThreadProcessId.USER32(?,?), ref: 10016A3C
                                                                                                                                                                                      • GetCurrentProcessId.KERNEL32 ref: 10016A46
                                                                                                                                                                                      • SendMessageA.USER32(?,00000376,00000000,00000000), ref: 10016A5B
                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 10016AD8
                                                                                                                                                                                      • EnableWindow.USER32(?,00000001), ref: 10016B14
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Window$Enable$Process$ActiveCurrentEnabledFileLastMessageModuleNameParentPopupSendThread
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1877664794-0
                                                                                                                                                                                      • Opcode ID: f56e269d1f7720d56fa1c58fd8a6d78852bfdb5100da494152acd8aedeab4fb9
                                                                                                                                                                                      • Instruction ID: f13ef48dc5fb0c484cec2fa7b3f992f2dc6d3b1b42596072abe369902371925a
                                                                                                                                                                                      • Opcode Fuzzy Hash: f56e269d1f7720d56fa1c58fd8a6d78852bfdb5100da494152acd8aedeab4fb9
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3B415B72A00258DBEB20CFA4CC81BDD76A8EF09350F614119E949AB281E770D9848F52
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10016936 Relevance: 9.1, APIs: 6, Instructions: 68COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetWindowLongA.USER32 ref: 10016968
                                                                                                                                                                                      • GetParent.USER32(100010EC), ref: 10016976
                                                                                                                                                                                      • GetParent.USER32(100010EC), ref: 10016989
                                                                                                                                                                                      • GetLastActivePopup.USER32(100010EC), ref: 10016998
                                                                                                                                                                                      • IsWindowEnabled.USER32(100010EC), ref: 100169AD
                                                                                                                                                                                      • EnableWindow.USER32(100010EC,00000000), ref: 100169C0
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 670545878-0
                                                                                                                                                                                      • Opcode ID: 0556ac702c88567a1be081abf13cc9cce852e4592f4cca89957eeb32636ff491
                                                                                                                                                                                      • Instruction ID: 154aafdfd528b469a8bf80fc48512ff59873e22bfc4d6b8fcadc8b05587993e6
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0556ac702c88567a1be081abf13cc9cce852e4592f4cca89957eeb32636ff491
                                                                                                                                                                                      • Instruction Fuzzy Hash: D111A57260133697D661DB698E80B1BB6ECDF9EAE1F120115ED00EF254EB70DC808696
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1001D992 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 234COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _memset
                                                                                                                                                                                      • String ID: @$@$AfxFrameOrView80s$AfxMDIFrame80s
                                                                                                                                                                                      • API String ID: 2102423945-4122032997
                                                                                                                                                                                      • Opcode ID: 34855274ca0ecd676c0cb297c8efdd531dfb4bca4f276cdc03237f3f296c8161
                                                                                                                                                                                      • Instruction ID: bbe41a20c7329c8f9bdc0efe2c46215e461a01fcfe5e7bc54fed728f21783543
                                                                                                                                                                                      • Opcode Fuzzy Hash: 34855274ca0ecd676c0cb297c8efdd531dfb4bca4f276cdc03237f3f296c8161
                                                                                                                                                                                      • Instruction Fuzzy Hash: B0816076D04219AADB40EFA4D481BDEBBF8EF04384F518566F909EB181E774DAC4CB90
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002B437 Relevance: 7.6, APIs: 5, Instructions: 58COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetMapMode.GDI32(?,00000000,?,?,?,?,1002561E,?,?,?,?,?,?), ref: 1002B447
                                                                                                                                                                                      • GetDeviceCaps.GDI32(?,00000058), ref: 1002B481
                                                                                                                                                                                      • GetDeviceCaps.GDI32(?,0000005A), ref: 1002B48A
                                                                                                                                                                                        • Part of subcall function 1001ECE3: MulDiv.KERNEL32(?,00000000,00000000), ref: 1001ED23
                                                                                                                                                                                        • Part of subcall function 1001ECE3: MulDiv.KERNEL32(?,00000000,00000000), ref: 1001ED40
                                                                                                                                                                                      • MulDiv.KERNEL32(?,00000060,000009EC), ref: 1002B4AE
                                                                                                                                                                                      • MulDiv.KERNEL32(00000000,?,000009EC), ref: 1002B4B9
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CapsDevice$Mode
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 696222070-0
                                                                                                                                                                                      • Opcode ID: 6f199a3495fbdd21d567dc82426adb66683fca9deaa291746216ef97ded9c58c
                                                                                                                                                                                      • Instruction ID: 3f65263faca37ec2066e18a28c5c11a55be6ae6448755079bbf75ecdaa8dd8b2
                                                                                                                                                                                      • Opcode Fuzzy Hash: 6f199a3495fbdd21d567dc82426adb66683fca9deaa291746216ef97ded9c58c
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2511CE75600A14EFDB21AF55CC84C1EBBEAEF89750B118819FA8597361DB31EC01DB90
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002B3A9 Relevance: 7.6, APIs: 5, Instructions: 58COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetMapMode.GDI32(?,?,?,?,?,?,100255DA,?,00000000,0000001C,10025F48,?,?,?,?,?), ref: 1002B3B9
                                                                                                                                                                                      • GetDeviceCaps.GDI32(?,00000058), ref: 1002B3F3
                                                                                                                                                                                      • GetDeviceCaps.GDI32(?,0000005A), ref: 1002B3FC
                                                                                                                                                                                        • Part of subcall function 1001ED4C: MulDiv.KERNEL32(?,00000000,00000000), ref: 1001ED8C
                                                                                                                                                                                        • Part of subcall function 1001ED4C: MulDiv.KERNEL32(?,00000000,00000000), ref: 1001EDA9
                                                                                                                                                                                      • MulDiv.KERNEL32(?,000009EC,00000060), ref: 1002B420
                                                                                                                                                                                      • MulDiv.KERNEL32(00000000,000009EC,?), ref: 1002B42B
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CapsDevice$Mode
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 696222070-0
                                                                                                                                                                                      • Opcode ID: ad45f33bd95501225e01621eadf3d29f248a2335d01e386e7c92b4ca8057da2f
                                                                                                                                                                                      • Instruction ID: 63e99b0baf6d5dcfdd2b5bb48b7ec33f4fcd9c2a57d1919fdecc035dbf7e745c
                                                                                                                                                                                      • Opcode Fuzzy Hash: ad45f33bd95501225e01621eadf3d29f248a2335d01e386e7c92b4ca8057da2f
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2D110E71600A14EFDB21AF55CC84C0EBBE9EF89350B514829FA8597361DB31ED01CF90
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100203DD Relevance: 7.6, APIs: 5, Instructions: 53stringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • lstrlenA.KERNEL32(?), ref: 10020407
                                                                                                                                                                                      • _memset.LIBCMT ref: 10020424
                                                                                                                                                                                      • GetWindowTextA.USER32 ref: 1002043E
                                                                                                                                                                                      • lstrcmpA.KERNEL32(00000000,?), ref: 10020450
                                                                                                                                                                                      • SetWindowTextA.USER32(?,?), ref: 1002045C
                                                                                                                                                                                        • Part of subcall function 100201F1: __CxxThrowException@8.LIBCMT ref: 10020205
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: TextWindow$Exception@8Throw_memsetlstrcmplstrlen
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 289641511-0
                                                                                                                                                                                      • Opcode ID: 77b0c5cd9ac0cc3ff83a367ab42858fc436f0c74e7fc05fbf85526c4b9223b41
                                                                                                                                                                                      • Instruction ID: 8c1f3c136944a2c7f84d91cd4eaa34ef9436e2c15ebeed6ca137d0836ccfc0fa
                                                                                                                                                                                      • Opcode Fuzzy Hash: 77b0c5cd9ac0cc3ff83a367ab42858fc436f0c74e7fc05fbf85526c4b9223b41
                                                                                                                                                                                      • Instruction Fuzzy Hash: CE01DBB5600314A7E711DF64DDC4BDF77ADEB19341F408065F646D3142EAB09E448B61
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10012890 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 123COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 100134C0: GetSystemMenu.USER32(?,00000000,?,?,100128CA,00000000,C22A274B), ref: 100134D2
                                                                                                                                                                                      • GetWindowLongA.USER32 ref: 1001295E
                                                                                                                                                                                      • SetWindowLongA.USER32 ref: 10012989
                                                                                                                                                                                        • Part of subcall function 10013460: AppendMenuA.USER32 ref: 1001347A
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: LongMenuWindow$AppendSystem
                                                                                                                                                                                      • String ID: 192.168.3.85$Message
                                                                                                                                                                                      • API String ID: 4121476972-856608562
                                                                                                                                                                                      • Opcode ID: 3a485f645eb87c5dda0d91dee484213725162975b6f285bf4b629bdff528d801
                                                                                                                                                                                      • Instruction ID: 340d0da2b4c657a0b825359f55c53a9166b08011863532f0c2811cf24d97780a
                                                                                                                                                                                      • Opcode Fuzzy Hash: 3a485f645eb87c5dda0d91dee484213725162975b6f285bf4b629bdff528d801
                                                                                                                                                                                      • Instruction Fuzzy Hash: F2411B74A4020A9BDB04DB94CCA2FBFB771EF44714F108228F5226F2D2DB75A945CB54
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1003CB01 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(KERNEL32,10033B0B), ref: 1003CB06
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 1003CB16
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AddressHandleModuleProc
                                                                                                                                                                                      • String ID: IsProcessorFeaturePresent$KERNEL32
                                                                                                                                                                                      • API String ID: 1646373207-3105848591
                                                                                                                                                                                      • Opcode ID: dc24b012ca1fb4bb896a1dc56100cb90a959cbbb7befe9f8aa549c159bb80eea
                                                                                                                                                                                      • Instruction ID: 56947a08a2dfe052dc663468ef672e03bc5ef0643ca607e86d2238c745675855
                                                                                                                                                                                      • Opcode Fuzzy Hash: dc24b012ca1fb4bb896a1dc56100cb90a959cbbb7befe9f8aa549c159bb80eea
                                                                                                                                                                                      • Instruction Fuzzy Hash: EDF0362090091DE6EF01AFA1AD4969F7A74FB45747F510594E592F0094EF7081B49356
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002910E Relevance: 6.2, APIs: 4, Instructions: 173windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Window$Rect$DesktopVisible
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1055025324-0
                                                                                                                                                                                      • Opcode ID: 935237afc4adc895a68147513c1bf8892873bb4cd96f085db3d98f84c1cebb7e
                                                                                                                                                                                      • Instruction ID: 30a46d7291c636a93fdcae379f64361bdaca7d323e8f19b7ddc13159497105e4
                                                                                                                                                                                      • Opcode Fuzzy Hash: 935237afc4adc895a68147513c1bf8892873bb4cd96f085db3d98f84c1cebb7e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0751E875A0051AEFCB04EFA8DD84CAEB7B9FF48244B614458F515EB255C731EE44CB60
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1001E262 Relevance: 6.1, APIs: 4, Instructions: 103windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 1001E296
                                                                                                                                                                                      • SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 1001E2FB
                                                                                                                                                                                      • SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 1001E340
                                                                                                                                                                                      • SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 1001E369
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSend
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3850602802-0
                                                                                                                                                                                      • Opcode ID: 19518e3b86100b37808dce19ac351571687518489287765c305fecf2a5902a3e
                                                                                                                                                                                      • Instruction ID: f22ebcd49f6c4bcf1cb84aabd9b6e0a9805a11e2c96a6edef58545e6592a584a
                                                                                                                                                                                      • Opcode Fuzzy Hash: 19518e3b86100b37808dce19ac351571687518489287765c305fecf2a5902a3e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 05318F70500259FFDB15DF51C889EAE7BA9EF05790F10806AF90A8F251DA30EEC0DBA0
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1003E161 Relevance: 6.1, APIs: 4, Instructions: 101COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 1003E191
                                                                                                                                                                                      • __isleadbyte_l.LIBCMT ref: 1003E1C5
                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,A045FF98,?,00000000,00000000,?,00000000,1003E760,?,?,00000002), ref: 1003E1F6
                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,?,00000000,00000000,?,00000000,1003E760,?,?,00000002), ref: 1003E264
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3058430110-0
                                                                                                                                                                                      • Opcode ID: a45d194493aaf76ac1cbb866e4ff6e90a1da533cdec724975968ec5ddac79853
                                                                                                                                                                                      • Instruction ID: 9e7ca2975dce83e2c1685c00030f8d0177b945f551d5a1751bafc6038c684fbd
                                                                                                                                                                                      • Opcode Fuzzy Hash: a45d194493aaf76ac1cbb866e4ff6e90a1da533cdec724975968ec5ddac79853
                                                                                                                                                                                      • Instruction Fuzzy Hash: 23317C31A00296EFDB12CFA4CC849AA7BE9FF05352F168669E8608F1D1D330AD40DB51
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100211EE Relevance: 6.1, APIs: 4, Instructions: 88COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: __msize_malloc
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1288803200-0
                                                                                                                                                                                      • Opcode ID: 172559e824c18d3cfeedd4486189817d6fbc1f914f9a457cc390fc68d8836e76
                                                                                                                                                                                      • Instruction ID: b47b26af396fa43851c5e16859074de777cbaf7baa699ca6a99f78ce61545289
                                                                                                                                                                                      • Opcode Fuzzy Hash: 172559e824c18d3cfeedd4486189817d6fbc1f914f9a457cc390fc68d8836e76
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0921C138100210DFCB59DF64F881AEE77D5EF20690B908629F858CA246DB34ECA4CB80
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100160A8 Relevance: 6.1, APIs: 4, Instructions: 76synchronizationCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3_catch.LIBCMT ref: 100160AF
                                                                                                                                                                                      • SetEvent.KERNEL32(?,00000060), ref: 1001615C
                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,000000FF), ref: 10016165
                                                                                                                                                                                      • CloseHandle.KERNEL32(?), ref: 1001616C
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CloseEventH_prolog3_catchHandleObjectSingleWait
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2844562147-0
                                                                                                                                                                                      • Opcode ID: aba3a14f37cb35c8a4256fe786ec03d8f5582434084a49b38ed0d3b5c255888d
                                                                                                                                                                                      • Instruction ID: 49adf720413ee406403ea303cbd260c8a37cc91a4464af3b062c384fe739287e
                                                                                                                                                                                      • Opcode Fuzzy Hash: aba3a14f37cb35c8a4256fe786ec03d8f5582434084a49b38ed0d3b5c255888d
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9B312A38A00646EFCB14EFA4CE9595DBBB0FF08311B15466CE5569F2A2DB30FA81CB51
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10022C16 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • CharNextA.USER32(?), ref: 10022C6D
                                                                                                                                                                                        • Part of subcall function 10033A93: __ismbcspace_l.LIBCMT ref: 10033A99
                                                                                                                                                                                      • CharNextA.USER32(00000000), ref: 10022C8A
                                                                                                                                                                                      • _strtol.LIBCMT ref: 10022CB5
                                                                                                                                                                                      • _strtoul.LIBCMT ref: 10022CBC
                                                                                                                                                                                        • Part of subcall function 100338D4: strtoxl.LIBCMT ref: 100338F4
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CharNext$__ismbcspace_l_strtol_strtoulstrtoxl
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 4211061542-0
                                                                                                                                                                                      • Opcode ID: c0131c4ce0529d7fd5e33596a62ab6746ae30cca9c8134ef8296b597ce6c539f
                                                                                                                                                                                      • Instruction ID: 5151050668a075cb653ef24e642dff21439099837a3a94c33d4a4bfb9d6c905b
                                                                                                                                                                                      • Opcode Fuzzy Hash: c0131c4ce0529d7fd5e33596a62ab6746ae30cca9c8134ef8296b597ce6c539f
                                                                                                                                                                                      • Instruction Fuzzy Hash: 352127755002556FDB21DFB49C81BAEB7F8DF48241FA14066F984D7240DB709D40CBA1
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10027B2E Relevance: 6.1, APIs: 4, Instructions: 70COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ArrayDestroyFreeSafeTask
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3253174383-0
                                                                                                                                                                                      • Opcode ID: 3972c6b8702509201bc2289ccb81f4c02271859ab5e073d977715a4d6fe1d911
                                                                                                                                                                                      • Instruction ID: 529fdc980b661751dfd2f1e67b0f163afa7902daf74f578c55dc250feead27ea
                                                                                                                                                                                      • Opcode Fuzzy Hash: 3972c6b8702509201bc2289ccb81f4c02271859ab5e073d977715a4d6fe1d911
                                                                                                                                                                                      • Instruction Fuzzy Hash: 71117930201206EBDF66DF65EC88B6A7BE8FF05796B914458FC99CB250DB31ED01CA64
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10017081 Relevance: 6.1, APIs: 4, Instructions: 57COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • FindResourceA.KERNEL32(?,00000000,00000005), ref: 100170A7
                                                                                                                                                                                      • LoadResource.KERNEL32(?,00000000), ref: 100170AF
                                                                                                                                                                                      • LockResource.KERNEL32(00000000), ref: 100170C1
                                                                                                                                                                                      • FreeResource.KERNEL32(00000000), ref: 1001710B
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Resource$FindFreeLoadLock
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1078018258-0
                                                                                                                                                                                      • Opcode ID: 11e397817ce9c23df1d0d820314bfc405a5ae10b9211d558aa096ea116c59da1
                                                                                                                                                                                      • Instruction ID: b090516e65dfb2cc0079b63036416f790ce173b21e3ea297a20d0f4a61f138d4
                                                                                                                                                                                      • Opcode Fuzzy Hash: 11e397817ce9c23df1d0d820314bfc405a5ae10b9211d558aa096ea116c59da1
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0A11DA34600B61FBC711DF68CD88AAAB3B4FB08295F118119E8468B550E3B0ED80D6A0
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10015123 Relevance: 6.1, APIs: 4, Instructions: 56threadCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3.LIBCMT ref: 1001512A
                                                                                                                                                                                        • Part of subcall function 10015D26: __EH_prolog3.LIBCMT ref: 10015D2D
                                                                                                                                                                                      • __strdup.LIBCMT ref: 1001514C
                                                                                                                                                                                      • GetCurrentThread.KERNEL32 ref: 10015179
                                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 10015182
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CurrentH_prolog3Thread$__strdup
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 4206445780-0
                                                                                                                                                                                      • Opcode ID: d6edc2b71ccf17cf47a4ad25d9b10d29dc33f6072b75531269d3699570e9d83c
                                                                                                                                                                                      • Instruction ID: 8b11c4afa576c4c19aa6f664ae71e644c3fa519ec3c9c99d11d7e99696a9cddb
                                                                                                                                                                                      • Opcode Fuzzy Hash: d6edc2b71ccf17cf47a4ad25d9b10d29dc33f6072b75531269d3699570e9d83c
                                                                                                                                                                                      • Instruction Fuzzy Hash: C2218EB0801B40DFC722CF7A854525AFBF8FFA4601F14891FE59A8A721DBB4A481CF04
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10017C4C Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • FindResourceA.KERNEL32(?,?,000000F0), ref: 10017C70
                                                                                                                                                                                      • LoadResource.KERNEL32(?,00000000), ref: 10017C7C
                                                                                                                                                                                      • LockResource.KERNEL32(00000000), ref: 10017C8A
                                                                                                                                                                                      • FreeResource.KERNEL32(00000000), ref: 10017CB8
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Resource$FindFreeLoadLock
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1078018258-0
                                                                                                                                                                                      • Opcode ID: edfb174a9e285db0d5a3c51f4831c90a2ac26f0a6dda286db3df881abf1d384e
                                                                                                                                                                                      • Instruction ID: 37c567c5ed2abd0c262b3d9c14b2c0b98263367eb1ad4cff580600f06ae044bd
                                                                                                                                                                                      • Opcode Fuzzy Hash: edfb174a9e285db0d5a3c51f4831c90a2ac26f0a6dda286db3df881abf1d384e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 44112875600219EFDB409F95CA88AAE7BB9FF09390F108069F9099B260DB71DD40CFA1
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1001B96E Relevance: 6.0, APIs: 4, Instructions: 49COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetTopWindow.USER32(00000000), ref: 1001B97C
                                                                                                                                                                                      • GetTopWindow.USER32(00000000), ref: 1001B9BB
                                                                                                                                                                                      • GetWindow.USER32(00000000,00000002), ref: 1001B9D9
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Window
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2353593579-0
                                                                                                                                                                                      • Opcode ID: 53b3a67e4a4930d6f35b53cf06474ecb6a52427011bba0ba31954c8fd7e85df7
                                                                                                                                                                                      • Instruction ID: d676a82d7887273777baca2e38fe8b62e8198389fbfbdcd46b7f1d18b22838b9
                                                                                                                                                                                      • Opcode Fuzzy Hash: 53b3a67e4a4930d6f35b53cf06474ecb6a52427011bba0ba31954c8fd7e85df7
                                                                                                                                                                                      • Instruction Fuzzy Hash: 92012236001A2ABBCF129F919D05EDE3B6AEF49394F004010FE0069120D736C9A2EBA6
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002BC31 Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • SysStringLen.OLEAUT32(?), ref: 1002BC45
                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,0000000C,1002D018,00000000,00000018,1002D35E), ref: 1002BC5D
                                                                                                                                                                                      • SysAllocStringByteLen.OLEAUT32(00000000,00000000), ref: 1002BC65
                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000,?,?,0000000C,1002D018,00000000,00000018,1002D35E), ref: 1002BC84
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Byte$CharMultiStringWide$Alloc
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3384502665-0
                                                                                                                                                                                      • Opcode ID: 30c8667133e0e99acdefb8fda4e094958d0ee3b60e94751be478a45e222a3836
                                                                                                                                                                                      • Instruction ID: 8ac585039279df4530c17525e78cb38a3c471deb65f2ee77315d7d06ea712387
                                                                                                                                                                                      • Opcode Fuzzy Hash: 30c8667133e0e99acdefb8fda4e094958d0ee3b60e94751be478a45e222a3836
                                                                                                                                                                                      • Instruction Fuzzy Hash: 15F09671106774BF932157629D8CC9BBF9CFE8F3F5B11052AF549C2100D6629800C6F5
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1003C9F5 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3016257755-0
                                                                                                                                                                                      • Opcode ID: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
                                                                                                                                                                                      • Instruction ID: 43f41ac90f78858b98c9d7795bb0f5538c3c8e7231dcd18d5b884ccf0efad8a7
                                                                                                                                                                                      • Opcode Fuzzy Hash: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
                                                                                                                                                                                      • Instruction Fuzzy Hash: 78013D3640054EBFCF139F86DC41CEE3F66FB19295F558415FA1898121C636DAB1AB82
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1001B32D Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetDlgItem.USER32 ref: 1001B338
                                                                                                                                                                                      • GetTopWindow.USER32(00000000), ref: 1001B34B
                                                                                                                                                                                        • Part of subcall function 1001B32D: GetWindow.USER32(00000000,00000002), ref: 1001B392
                                                                                                                                                                                      • GetTopWindow.USER32(?), ref: 1001B37B
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Window$Item
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 369458955-0
                                                                                                                                                                                      • Opcode ID: 9be62a33154ecf838a8ec693ceb269fba071d7fc85a8faced3965e2d85c2953e
                                                                                                                                                                                      • Instruction ID: 858530c175d9441ab3e78fa875986bdb84c423c322646567b0054cf47e6755e0
                                                                                                                                                                                      • Opcode Fuzzy Hash: 9be62a33154ecf838a8ec693ceb269fba071d7fc85a8faced3965e2d85c2953e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 4D01A236101E6AF7DB129F618D05E8F3B99EF453E4F024010FD249D120DB71DBB196A1
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10013010 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108memorynetworkCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 1001E3AC: __EH_prolog3.LIBCMT ref: 1001E3B3
                                                                                                                                                                                        • Part of subcall function 1001E3AC: GetWindowTextA.USER32 ref: 1001E3C9
                                                                                                                                                                                        • Part of subcall function 1001DDF4: IsWindow.USER32(?), ref: 1001DE03
                                                                                                                                                                                      • _DebugHeapAllocator.LIBCPMTD ref: 100130B2
                                                                                                                                                                                        • Part of subcall function 10013820: _DebugHeapAllocator.LIBCPMTD ref: 10013875
                                                                                                                                                                                        • Part of subcall function 100137A0: SendMessageA.USER32(?,00001014,?,0000001E), ref: 100137BB
                                                                                                                                                                                      • send.WS2_32(?,?,00000064,00000000), ref: 10013195
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AllocatorDebugHeapWindow$H_prolog3MessageSendTextsend
                                                                                                                                                                                      • String ID: :
                                                                                                                                                                                      • API String ID: 14538988-3653984579
                                                                                                                                                                                      • Opcode ID: 13b8f6eccedc4ccdf4080b13ffaaa0417b73d22118cf8ccc7af144c890aa7e78
                                                                                                                                                                                      • Instruction ID: f6b77999ec19404b7b7ce6cfec7bf3295ff1974a42ab232d1976716b8ec2d843
                                                                                                                                                                                      • Opcode Fuzzy Hash: 13b8f6eccedc4ccdf4080b13ffaaa0417b73d22118cf8ccc7af144c890aa7e78
                                                                                                                                                                                      • Instruction Fuzzy Hash: 01410DB59001189FDB24DB64CC91BEEB775FF44304F5082ADE51AA7282DF346A85CF54
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1001508F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 100150B5
                                                                                                                                                                                      • PathFindExtensionA.SHLWAPI(?), ref: 100150CB
                                                                                                                                                                                        • Part of subcall function 10014B27: _strcpy_s.LIBCMT ref: 10014B33
                                                                                                                                                                                        • Part of subcall function 10014DA8: __EH_prolog3.LIBCMT ref: 10014DC7
                                                                                                                                                                                        • Part of subcall function 10014DA8: GetModuleHandleA.KERNEL32(kernel32.dll,00000058), ref: 10014DE8
                                                                                                                                                                                        • Part of subcall function 10014DA8: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 10014DF9
                                                                                                                                                                                        • Part of subcall function 10014DA8: ConvertDefaultLocale.KERNEL32(?), ref: 10014E2F
                                                                                                                                                                                        • Part of subcall function 10014DA8: ConvertDefaultLocale.KERNEL32(?), ref: 10014E37
                                                                                                                                                                                        • Part of subcall function 10014DA8: GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 10014E4B
                                                                                                                                                                                        • Part of subcall function 10014DA8: ConvertDefaultLocale.KERNEL32(?), ref: 10014E6F
                                                                                                                                                                                        • Part of subcall function 10014DA8: ConvertDefaultLocale.KERNEL32(000003FF), ref: 10014E75
                                                                                                                                                                                        • Part of subcall function 10014DA8: GetModuleFileNameA.KERNEL32(10000000,?,00000105), ref: 10014EAE
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ConvertDefaultLocale$Module$AddressFileNameProc$ExtensionFindH_prolog3HandlePath_strcpy_s
                                                                                                                                                                                      • String ID: %s.dll
                                                                                                                                                                                      • API String ID: 3444012488-3668843792
                                                                                                                                                                                      • Opcode ID: 658e8660b57156c47c50295d269887a352ab673736f5c816275cebcb6cd6bc48
                                                                                                                                                                                      • Instruction ID: 0816ccb3c2c5dc3d5c2f43fd153125c4ae2bbce82e663fde520804fb1fdab18a
                                                                                                                                                                                      • Opcode Fuzzy Hash: 658e8660b57156c47c50295d269887a352ab673736f5c816275cebcb6cd6bc48
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9901B971A10118BBDF09DB74DD96AEEB3B8DF04B01F0105E9EA02DB140EEB1EE448A61
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10020B38 Relevance: 5.1, APIs: 4, Instructions: 60COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(?), ref: 10020B95
                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?,?), ref: 10020BA5
                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 10020BAE
                                                                                                                                                                                      • TlsSetValue.KERNEL32(?,00000000), ref: 10020BC0
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.261577474.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.261573919.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261614044.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261623815.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261628108.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.261632260.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_10000000_loaddll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CriticalSection$EnterFreeLeaveLocalValue
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2949335588-0
                                                                                                                                                                                      • Opcode ID: 6676c0264c2eb297a537204f12f4d5c162c59b7e83937d8b07f604b269a52a54
                                                                                                                                                                                      • Instruction ID: af4df8c6ab00e3b134578f48d56f113cbd39bdf93991f651abc1e22c3acb8acd
                                                                                                                                                                                      • Opcode Fuzzy Hash: 6676c0264c2eb297a537204f12f4d5c162c59b7e83937d8b07f604b269a52a54
                                                                                                                                                                                      • Instruction Fuzzy Hash: 70113435600305EFE721CF54D9C4B9AB7AAFF0A35AF508429F5528B5A2DB71F980CB50
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Execution Graph

                                                                                                                                                                                      Execution Coverage:21.4%
                                                                                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                      Signature Coverage:0%
                                                                                                                                                                                      Total number of Nodes:318
                                                                                                                                                                                      Total number of Limit Nodes:19
                                                                                                                                                                                      execution_graph 24729 10020c26 24732 10020c32 __EH_prolog3 24729->24732 24731 10020c80 24756 100206c8 EnterCriticalSection TlsGetValue LeaveCriticalSection LeaveCriticalSection 24731->24756 24732->24731 24740 1002083b EnterCriticalSection 24732->24740 24754 100201f1 RaiseException __CxxThrowException@8 24732->24754 24755 1002094b TlsAlloc InitializeCriticalSection 24732->24755 24735 10020c8d 24737 10020c93 24735->24737 24738 10020ca6 ~_Task_impl 24735->24738 24757 100209ed 88 API calls 4 library calls 24737->24757 24741 1002085a 24740->24741 24743 10020893 24741->24743 24744 100208a8 GlobalHandle GlobalUnlock 24741->24744 24753 10020916 _memset 24741->24753 24742 1002092a LeaveCriticalSection 24742->24732 24758 10014460 24743->24758 24745 10014460 ctype 80 API calls 24744->24745 24747 100208c5 GlobalReAlloc 24745->24747 24749 100208cf 24747->24749 24750 100208f7 GlobalLock 24749->24750 24751 100208da GlobalHandle GlobalLock 24749->24751 24752 100208e8 LeaveCriticalSection 24749->24752 24750->24753 24751->24752 24752->24750 24753->24742 24755->24732 24756->24735 24757->24738 24759 10014477 ctype 24758->24759 24760 1001448c GlobalAlloc 24759->24760 24762 10013ba0 80 API calls ctype 24759->24762 24760->24749 24762->24760 24763 10030d06 24764 10030d12 24763->24764 24765 10030d0d 24763->24765 24769 10030c10 24764->24769 24781 1003906d GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter 24765->24781 24768 10030d23 24771 10030c1c ___FrameUnwindToState 24769->24771 24770 10030c69 24772 10030cb9 ___FrameUnwindToState 24770->24772 24837 100125c0 24770->24837 24771->24770 24771->24772 24782 10030a37 24771->24782 24772->24768 24775 10030c99 24775->24772 24777 10030a37 __CRT_INIT@12 165 API calls 24775->24777 24777->24772 24778 100125c0 ___DllMainCRTStartup 141 API calls 24779 10030c90 24778->24779 24780 10030a37 __CRT_INIT@12 165 API calls 24779->24780 24780->24775 24781->24764 24783 10030b61 24782->24783 24784 10030a4a GetProcessHeap HeapAlloc 24782->24784 24786 10030b9c 24783->24786 24790 10030b67 24783->24790 24785 10030a6e GetVersionExA 24784->24785 24815 10030a67 24784->24815 24787 10030a89 GetProcessHeap HeapFree 24785->24787 24788 10030a7e GetProcessHeap HeapFree 24785->24788 24789 10030ba1 24786->24789 24793 10030bfa 24786->24793 24791 10030ab5 24787->24791 24788->24815 24956 10035135 6 API calls __decode_pointer 24789->24956 24794 10030b86 24790->24794 24790->24815 24952 100310be 67 API calls _doexit 24790->24952 24859 10036624 HeapCreate 24791->24859 24793->24815 24978 10035425 79 API calls 2 library calls 24793->24978 24794->24815 24953 100389ee 68 API calls __CRT_INIT@12 24794->24953 24795 10030ba6 24957 10035840 24795->24957 24800 10030aeb 24800->24815 24869 1003548e GetModuleHandleA 24800->24869 24803 10030b90 24954 10035178 70 API calls 2 library calls 24803->24954 24804 10030bbe 24963 100350ae TlsGetValue TlsGetValue GetModuleHandleA GetProcAddress 24804->24963 24807 10030b95 24955 1003667e VirtualFree HeapFree HeapFree HeapDestroy 24807->24955 24809 10030af9 __RTC_Initialize 24812 10030afd 24809->24812 24814 10030b0c GetCommandLineA 24809->24814 24811 10030bd0 24817 10030bd7 24811->24817 24818 10030bee 24811->24818 24946 1003667e VirtualFree HeapFree HeapFree HeapDestroy 24812->24946 24902 10038d66 24814->24902 24815->24770 24964 100351b5 67 API calls 4 library calls 24817->24964 24965 1002fa69 24818->24965 24822 10030bde GetCurrentThreadId 24822->24815 24823 10030b4f 24823->24815 24825 10030b26 24826 10030b31 24825->24826 24827 10030b2a 24825->24827 24948 10038cad 111 API calls 3 library calls 24826->24948 24947 10035178 70 API calls 2 library calls 24827->24947 24830 10030b36 24831 10030b4a 24830->24831 24949 10038a3a 110 API calls 6 library calls 24830->24949 24831->24823 24951 100389ee 68 API calls __CRT_INIT@12 24831->24951 24834 10030b5f 24834->24827 24835 10030b3f 24835->24831 24950 10030f4d 75 API calls 4 library calls 24835->24950 25029 10006a90 24837->25029 24840 1001265a 25059 1002fe65 105 API calls 6 library calls 24840->25059 24841 1001261c FindResourceW LoadResource SizeofResource 24844 10006a90 ___DllMainCRTStartup 67 API calls 24841->24844 24847 10012744 ___DllMainCRTStartup 24844->24847 24846 1001284d 24846->24775 24846->24778 24848 100127b7 VirtualAlloc 24847->24848 24849 1001279b VirtualAllocExNuma 24847->24849 24850 100127da 24848->24850 24849->24850 24851 1002fb00 ___crtGetEnvironmentStringsA __VEC_memcpy 24850->24851 24852 100127eb 24851->24852 25034 1002f9a6 24852->25034 24854 100127fa 25053 10002970 24854->25053 24856 10012810 ___DllMainCRTStartup 25056 100026a0 24856->25056 24858 10012664 25060 1002f81e 5 API calls __invoke_watson 24858->25060 24860 10036647 24859->24860 24861 10036644 24859->24861 24979 100365c9 67 API calls 3 library calls 24860->24979 24861->24800 24863 1003664c 24864 10036656 24863->24864 24865 1003667a 24863->24865 24980 10035aca HeapAlloc 24864->24980 24865->24800 24867 10036660 24867->24865 24868 10036665 HeapDestroy 24867->24868 24868->24861 24870 100354a0 24869->24870 24871 100354a9 GetProcAddress GetProcAddress GetProcAddress GetProcAddress 24869->24871 24981 10035178 70 API calls 2 library calls 24870->24981 24873 100354f3 TlsAlloc 24871->24873 24876 10035541 TlsSetValue 24873->24876 24877 1003560d 24873->24877 24875 100354a5 24875->24809 24876->24877 24878 10035552 24876->24878 24877->24809 24982 100310cd 5 API calls 3 library calls 24878->24982 24880 10035557 24983 10035042 TlsGetValue 24880->24983 24883 10035042 __encode_pointer 5 API calls 24884 10035572 24883->24884 24885 10035042 __encode_pointer 5 API calls 24884->24885 24886 10035582 24885->24886 24887 10035042 __encode_pointer 5 API calls 24886->24887 24888 10035592 24887->24888 24992 10035923 67 API calls ___crtInitCritSecAndSpinCount 24888->24992 24890 1003559f 24891 10035608 24890->24891 24993 100350ae TlsGetValue TlsGetValue GetModuleHandleA GetProcAddress 24890->24993 24996 10035178 70 API calls 2 library calls 24891->24996 24894 100355b3 24894->24891 24895 10035840 __calloc_crt 67 API calls 24894->24895 24896 100355cc 24895->24896 24896->24891 24994 100350ae TlsGetValue TlsGetValue GetModuleHandleA GetProcAddress 24896->24994 24898 100355e6 24898->24891 24899 100355ed 24898->24899 24995 100351b5 67 API calls 4 library calls 24899->24995 24901 100355f5 GetCurrentThreadId 24901->24877 24903 10038d82 GetEnvironmentStringsW 24902->24903 24904 10038da1 24902->24904 24905 10038d8a 24903->24905 24907 10038d96 GetLastError 24903->24907 24904->24905 24906 10038e3c 24904->24906 24908 10038dcb WideCharToMultiByte 24905->24908 24909 10038dbc GetEnvironmentStringsW 24905->24909 24910 10038e44 GetEnvironmentStrings 24906->24910 24911 10030b1c 24906->24911 24907->24904 24915 10038e31 FreeEnvironmentStringsW 24908->24915 24916 10038dff 24908->24916 24909->24908 24909->24911 24910->24911 24912 10038e54 24910->24912 24929 100387ae 24911->24929 24998 10035800 67 API calls _malloc 24912->24998 24915->24911 24997 10035800 67 API calls _malloc 24916->24997 24919 10038e6d 24921 10038e80 24919->24921 24922 10038e74 FreeEnvironmentStringsA 24919->24922 24920 10038e05 24920->24915 24923 10038e0e WideCharToMultiByte 24920->24923 24999 1002fb00 24921->24999 24922->24911 24925 10038e1f 24923->24925 24926 10038e28 24923->24926 24928 1002fa69 __CRT_INIT@12 67 API calls 24925->24928 24926->24915 24928->24926 25003 10032b38 24929->25003 24931 100387ba GetStartupInfoA 24932 10035840 __calloc_crt 67 API calls 24931->24932 24940 100387db 24932->24940 24933 100389e5 ___FrameUnwindToState 24933->24825 24934 10038962 GetStdHandle 24939 1003892c 24934->24939 24935 100389c7 SetHandleCount 24935->24933 24936 10035840 __calloc_crt 67 API calls 24936->24940 24937 10038974 GetFileType 24937->24939 24938 100388af 24938->24939 24941 100388e3 24938->24941 24942 100388d8 GetFileType 24938->24942 24939->24934 24939->24935 24939->24937 24945 1003898b 24939->24945 24940->24933 24940->24936 24940->24938 24940->24939 24941->24933 24941->24938 25004 10039358 67 API calls 5 library calls 24941->25004 24942->24938 24942->24941 24945->24933 24945->24939 25005 10039358 67 API calls 5 library calls 24945->25005 24946->24815 24947->24812 24948->24830 24949->24835 24950->24831 24951->24834 24952->24794 24953->24803 24954->24807 24955->24815 24956->24795 24959 10035844 24957->24959 24960 10030bb2 24959->24960 24961 10035864 Sleep 24959->24961 25006 10030678 24959->25006 24960->24804 24960->24815 24962 10035879 24961->24962 24962->24959 24962->24960 24963->24811 24964->24822 24966 1002fa75 ___FrameUnwindToState 24965->24966 24967 1002fab4 24966->24967 24973 1002faee ___FrameUnwindToState __dosmaperr 24966->24973 25025 10035a99 67 API calls 2 library calls 24966->25025 24968 1002fac9 RtlFreeHeap 24967->24968 24967->24973 24970 1002fadb 24968->24970 24968->24973 25028 100311f4 67 API calls __getptd_noexit 24970->25028 24972 1002fae0 GetLastError 24972->24973 24973->24823 24974 1002faa6 25027 1002fabf LeaveCriticalSection _doexit 24974->25027 24975 1002fa8c ___sbh_find_block 24975->24974 25026 10035b3d VirtualFree VirtualFree HeapFree _memmove_s 24975->25026 24978->24815 24979->24863 24980->24867 24981->24875 24982->24880 24984 10035076 GetModuleHandleA 24983->24984 24985 10035055 24983->24985 24987 10035085 GetProcAddress 24984->24987 24988 1003509f 24984->24988 24985->24984 24986 1003505f TlsGetValue 24985->24986 24989 1003506a 24986->24989 24991 1003506e 24987->24991 24988->24883 24989->24984 24989->24991 24990 10035095 RtlEncodePointer 24990->24988 24991->24988 24991->24990 24992->24890 24993->24894 24994->24898 24995->24901 24996->24877 24997->24920 24998->24919 25000 1002fb18 24999->25000 25001 1002fb47 FreeEnvironmentStringsA 25000->25001 25002 1002fb3f __VEC_memcpy 25000->25002 25001->24911 25002->25001 25003->24931 25004->24941 25005->24945 25007 10030684 ___FrameUnwindToState 25006->25007 25008 1003069c 25007->25008 25016 100306bb _memset 25007->25016 25019 100311f4 67 API calls __getptd_noexit 25008->25019 25010 100306a1 25020 10037753 4 API calls 2 library calls 25010->25020 25012 1003072d RtlAllocateHeap 25012->25016 25013 100306b1 ___FrameUnwindToState 25013->24959 25016->25012 25016->25013 25021 10035a99 67 API calls 2 library calls 25016->25021 25022 100362e6 5 API calls 2 library calls 25016->25022 25023 10030774 LeaveCriticalSection _doexit 25016->25023 25024 100368d5 TlsGetValue TlsGetValue GetModuleHandleA GetProcAddress __decode_pointer 25016->25024 25019->25010 25021->25016 25022->25016 25023->25016 25024->25016 25025->24975 25026->24974 25027->24967 25028->24972 25030 1002f9a6 _malloc 67 API calls 25029->25030 25032 10006aa1 25030->25032 25031 10006aad 25031->24840 25031->24841 25032->25031 25033 1002fa69 __CRT_INIT@12 67 API calls 25032->25033 25033->25031 25035 1002fa53 25034->25035 25046 1002f9b4 25034->25046 25068 100368d5 TlsGetValue TlsGetValue GetModuleHandleA GetProcAddress __decode_pointer 25035->25068 25037 1002fa59 25069 100311f4 67 API calls __getptd_noexit 25037->25069 25040 1002fa5f 25040->24854 25043 1002fa17 RtlAllocateHeap 25043->25046 25044 1002f9c9 25044->25046 25061 10036892 67 API calls 2 library calls 25044->25061 25062 100366f2 67 API calls 7 library calls 25044->25062 25063 10030e7b GetModuleHandleA GetProcAddress ExitProcess ___crtCorExitProcess 25044->25063 25046->25043 25046->25044 25047 1002fa4a 25046->25047 25048 1002fa3e 25046->25048 25051 1002fa3c 25046->25051 25064 1002f957 67 API calls 4 library calls 25046->25064 25065 100368d5 TlsGetValue TlsGetValue GetModuleHandleA GetProcAddress __decode_pointer 25046->25065 25047->24854 25066 100311f4 67 API calls __getptd_noexit 25048->25066 25067 100311f4 67 API calls __getptd_noexit 25051->25067 25054 1002f9a6 _malloc 67 API calls 25053->25054 25055 10002990 25054->25055 25055->24856 25070 10002280 25056->25070 25059->24858 25060->24846 25061->25044 25062->25044 25064->25046 25065->25046 25066->25051 25067->25047 25068->25037 25069->25040 25105 10001990 25070->25105 25073 100022c3 SetLastError 25103 100022a9 25073->25103 25074 100022d5 25075 10001990 ___DllMainCRTStartup SetLastError 25074->25075 25076 100022ee 25075->25076 25077 10002310 SetLastError 25076->25077 25078 10002322 25076->25078 25076->25103 25077->25103 25079 10002331 SetLastError 25078->25079 25080 10002343 25078->25080 25079->25103 25081 1000234e SetLastError 25080->25081 25083 10002360 GetNativeSystemInfo 25080->25083 25081->25103 25084 10002414 SetLastError 25083->25084 25085 10002426 VirtualAlloc 25083->25085 25084->25103 25086 10002472 GetProcessHeap HeapAlloc 25085->25086 25087 10002447 VirtualAlloc 25085->25087 25089 100024ac 25086->25089 25090 1000248c VirtualFree SetLastError 25086->25090 25087->25086 25088 10002463 SetLastError 25087->25088 25088->25103 25091 10001990 ___DllMainCRTStartup SetLastError 25089->25091 25090->25103 25092 1000250e 25091->25092 25093 10002512 25092->25093 25094 1000251c VirtualAlloc 25092->25094 25137 10002840 VirtualFree VirtualFree GetProcessHeap HeapFree ___DllMainCRTStartup 25093->25137 25095 1000254b ___DllMainCRTStartup 25094->25095 25108 100019c0 25095->25108 25098 1000257f ___DllMainCRTStartup 25098->25093 25118 10001ff0 25098->25118 25102 100025e8 ___DllMainCRTStartup 25102->25093 25102->25103 25104 1000264f SetLastError 25102->25104 25103->24858 25104->25093 25106 100019ab 25105->25106 25107 1000199f SetLastError 25105->25107 25106->25073 25106->25074 25106->25103 25107->25106 25109 100019f0 25108->25109 25110 10001a83 25109->25110 25112 10001a2c VirtualAlloc 25109->25112 25117 10001aa0 ___DllMainCRTStartup 25109->25117 25111 10001990 ___DllMainCRTStartup SetLastError 25110->25111 25114 10001a9c 25111->25114 25113 10001a50 25112->25113 25116 10001a57 ___DllMainCRTStartup 25112->25116 25113->25117 25115 10001aa4 VirtualAlloc 25114->25115 25114->25117 25115->25117 25116->25109 25117->25098 25119 10002029 IsBadReadPtr 25118->25119 25128 1000201f 25118->25128 25121 10002053 25119->25121 25119->25128 25122 10002085 SetLastError 25121->25122 25123 10002099 25121->25123 25121->25128 25122->25128 25138 100018b0 VirtualQuery VirtualFree VirtualAlloc ___DllMainCRTStartup 25123->25138 25125 100020b3 25126 100020bf SetLastError 25125->25126 25130 100020e9 25125->25130 25126->25128 25128->25093 25131 10001cb0 25128->25131 25129 100021f9 SetLastError 25129->25128 25130->25128 25130->25129 25135 10001cf8 ___DllMainCRTStartup 25131->25135 25132 10001e01 25133 10001b80 ___DllMainCRTStartup 2 API calls 25132->25133 25136 10001ddd 25133->25136 25135->25132 25135->25136 25139 10001b80 25135->25139 25136->25102 25137->25103 25138->25125 25140 10001b9c 25139->25140 25142 10001b92 25139->25142 25141 10001baa 25140->25141 25144 10001c04 VirtualProtect 25140->25144 25141->25142 25145 10001be2 VirtualFree 25141->25145 25142->25135 25144->25142 25145->25142

                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                      Function 100125C0 Relevance: 45.7, APIs: 7, Strings: 19, Instructions: 165memoryCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 10006A90: _malloc.LIBCMT ref: 10006A9C
                                                                                                                                                                                      • _printf.LIBCMT ref: 1001265F
                                                                                                                                                                                      • FindResourceW.KERNELBASE(00000000,00001705,DASHBOARD), ref: 1001268A
                                                                                                                                                                                      • LoadResource.KERNEL32(00000000,00000000), ref: 1001269B
                                                                                                                                                                                      • SizeofResource.KERNEL32(00000000,00000000), ref: 100126AC
                                                                                                                                                                                      • VirtualAllocExNuma.KERNELBASE(000000FF,00000000,00000000,00003000,00000040,00000000), ref: 100127AC
                                                                                                                                                                                      • VirtualAlloc.KERNEL32(00000000,00000000,-100510CC,00000040), ref: 100127D1
                                                                                                                                                                                      • _malloc.LIBCMT ref: 100127F5
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Resource$AllocVirtual_malloc$FindLoadNumaSizeof_printf
                                                                                                                                                                                      • String ID: .$.$2$3$6p2Z6a6CZ&M>ZR$a@Y$xnQ?<XBeh<22mz&0$DASHBOARD$d$d$e$kre3.l$l$l$l$l$l$l$l$n$ndldl
                                                                                                                                                                                      • API String ID: 572389289-2839844625
                                                                                                                                                                                      • Opcode ID: adac8d752e0c47dc141f46a7132d7a35c557a18b7d00a43f57a8df52d4076e8d
                                                                                                                                                                                      • Instruction ID: 8f66a7c676ce8d0fa2ca8bd8519024a549b55f77dd79b918ae70bd0eec3b217e
                                                                                                                                                                                      • Opcode Fuzzy Hash: adac8d752e0c47dc141f46a7132d7a35c557a18b7d00a43f57a8df52d4076e8d
                                                                                                                                                                                      • Instruction Fuzzy Hash: FB613EB5D10218EBEB00DFA0DC95B9EBBB5FF08344F10911CE504AB390E7B66548CB6A
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10002280 Relevance: 22.8, APIs: 15, Instructions: 331COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 36 10002280-100022a7 call 10001990 39 100022b0-100022c1 36->39 40 100022a9-100022ab 36->40 42 100022c3-100022d0 SetLastError 39->42 43 100022d5-100022f0 call 10001990 39->43 41 1000269a-1000269d 40->41 42->41 46 100022f2-100022f4 43->46 47 100022f9-1000230e 43->47 46->41 48 10002310-1000231d SetLastError 47->48 49 10002322-1000232f 47->49 48->41 50 10002331-1000233e SetLastError 49->50 51 10002343-1000234c 49->51 50->41 52 10002360-10002381 51->52 53 1000234e-1000235b SetLastError 51->53 54 10002395-1000239f 52->54 53->41 55 100023a1-100023a8 54->55 56 100023d7-10002412 GetNativeSystemInfo 54->56 57 100023b8-100023c4 55->57 58 100023aa-100023b6 55->58 59 10002414-10002421 SetLastError 56->59 60 10002426-10002445 VirtualAlloc 56->60 61 100023c7-100023cd 57->61 58->61 59->41 62 10002472-1000248a GetProcessHeap HeapAlloc 60->62 63 10002447-10002461 VirtualAlloc 60->63 64 100023d5 61->64 65 100023cf-100023d2 61->65 67 100024ac-10002510 call 10001990 62->67 68 1000248c-100024a7 VirtualFree SetLastError 62->68 63->62 66 10002463-1000246d SetLastError 63->66 64->54 65->64 66->41 72 10002512 67->72 73 1000251c-10002581 VirtualAlloc call 10001810 call 100019c0 67->73 68->41 74 1000268c-10002698 call 10002840 72->74 81 10002583 73->81 82 1000258d-1000259e 73->82 74->41 81->74 83 100025a0-100025b6 call 10001eb0 82->83 84 100025b8-100025bb 82->84 86 100025c2-100025d0 call 10001ff0 83->86 84->86 90 100025d2 86->90 91 100025dc-100025ea call 10001cb0 86->91 90->74 94 100025f6-10002604 call 10001e30 91->94 95 100025ec 91->95 98 10002606 94->98 99 1000260d-10002616 94->99 95->74 98->74 100 10002618-1000261f 99->100 101 1000267d-10002680 99->101 103 10002621-10002642 100->103 104 1000266a-10002678 100->104 102 10002687-1000268a 101->102 102->41 106 10002646-1000264d 103->106 105 1000267b 104->105 105->102 107 1000265e-10002668 106->107 108 1000264f-1000265a SetLastError 106->108 107->105 108->74
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 10001990: SetLastError.KERNEL32(0000000D,?,?,100022A5,10012839,00000040), ref: 100019A1
                                                                                                                                                                                      • SetLastError.KERNEL32(000000C1,10012839,00000040), ref: 100022C8
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ErrorLast
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1452528299-0
                                                                                                                                                                                      • Opcode ID: 0e09b11d72102b2f53da7248ccc42e4e27664b89a2cf1ce4a90d5e07d10becff
                                                                                                                                                                                      • Instruction ID: 346a8eef4056a92d897d0963d9e5b5a8ca828aef95f805bf3d5880fe5d8ad0e4
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0e09b11d72102b2f53da7248ccc42e4e27664b89a2cf1ce4a90d5e07d10becff
                                                                                                                                                                                      • Instruction Fuzzy Hash: 18E14974A00209DFEB48CF94C990AAEB7F6FF88340F208559E905AB359DB75AD42CF50
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10006A90 Relevance: 18.4, APIs: 1, Instructions: 16933COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 109 10006a90-10006aab call 1002f9a6 112 10006ab7-10012570 109->112 113 10006aad-10006ab2 109->113 115 10012584-1001258b 112->115 114 100125b4-100125b8 113->114 116 10012597-1001259b call 1002fa69 115->116 117 1001258d-10012595 115->117 120 100125a0-100125a9 116->120 117->115 121 100125ab-100125ad 120->121 122 100125af 120->122 121->114 122->114
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • _malloc.LIBCMT ref: 10006A9C
                                                                                                                                                                                        • Part of subcall function 1002F9A6: __FF_MSGBANNER.LIBCMT ref: 1002F9C9
                                                                                                                                                                                        • Part of subcall function 1002F9A6: __NMSG_WRITE.LIBCMT ref: 1002F9D0
                                                                                                                                                                                        • Part of subcall function 1002F9A6: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,1003580D,?,00000001,00000001,10035A23,00000018,10050CC8,0000000C,10035AB2,00000001), ref: 1002FA1E
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AllocateHeap_malloc
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 501242067-0
                                                                                                                                                                                      • Opcode ID: ab67eba576b62ed2242e6049fa4a9f00a0283ae289beaf397465af8560d1c9fc
                                                                                                                                                                                      • Instruction ID: 7622b3071c216813c8acba396ad13572c3e9674cac4916c3917d4934f1ce5c91
                                                                                                                                                                                      • Opcode Fuzzy Hash: ab67eba576b62ed2242e6049fa4a9f00a0283ae289beaf397465af8560d1c9fc
                                                                                                                                                                                      • Instruction Fuzzy Hash: BF844072D0002ECFCF08DFECCA959EEFBB5FF68204B169259D425BB294C6356A11CA54
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002083B Relevance: 16.6, APIs: 11, Instructions: 103memoryCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(100575E0,?,?,?,?,100575C4,10020C7A,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139,00000004), ref: 1002084A
                                                                                                                                                                                      • GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,100575C4,10020C7A,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139), ref: 100208A0
                                                                                                                                                                                      • GlobalHandle.KERNEL32(02A55500), ref: 100208A9
                                                                                                                                                                                      • GlobalUnlock.KERNEL32(00000000,?,?,?,?,100575C4,10020C7A,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139,00000004), ref: 100208B2
                                                                                                                                                                                      • GlobalReAlloc.KERNEL32 ref: 100208C9
                                                                                                                                                                                      • GlobalHandle.KERNEL32(02A55500), ref: 100208DB
                                                                                                                                                                                      • GlobalLock.KERNEL32 ref: 100208E2
                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?,?,?,?,?,100575C4,10020C7A,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139,00000004), ref: 100208EC
                                                                                                                                                                                      • GlobalLock.KERNEL32 ref: 100208F8
                                                                                                                                                                                      • _memset.LIBCMT ref: 10020911
                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?), ref: 1002093D
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock_memset
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 496899490-0
                                                                                                                                                                                      • Opcode ID: 23a5f943a2514d5899e1dc1f035ea6f74369b98ac7016ed06c6f01df95d95d17
                                                                                                                                                                                      • Instruction ID: dc14c853345dee55639cdae2a1fd03b11c2696e398e705256622f09b1856cd91
                                                                                                                                                                                      • Opcode Fuzzy Hash: 23a5f943a2514d5899e1dc1f035ea6f74369b98ac7016ed06c6f01df95d95d17
                                                                                                                                                                                      • Instruction Fuzzy Hash: 08319C75600715AFE324CF24DD88A1AB7EAEB49241B01492AF996C3662EB71F8448B50
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002FA69 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __lock.LIBCMT ref: 1002FA87
                                                                                                                                                                                        • Part of subcall function 10035A99: __mtinitlocknum.LIBCMT ref: 10035AAD
                                                                                                                                                                                        • Part of subcall function 10035A99: __amsg_exit.LIBCMT ref: 10035AB9
                                                                                                                                                                                        • Part of subcall function 10035A99: EnterCriticalSection.KERNEL32(00000001,00000001,?,10035387,0000000D,10050C60,00000008,10035479,00000001,?,?,00000001,?,?,10030C69,00000001), ref: 10035AC1
                                                                                                                                                                                      • ___sbh_find_block.LIBCMT ref: 1002FA92
                                                                                                                                                                                      • ___sbh_free_block.LIBCMT ref: 1002FAA1
                                                                                                                                                                                      • RtlFreeHeap.NTDLL(00000000,?,10050988,0000000C,100352DD,00000000,?,1003580D,?,00000001,00000001,10035A23,00000018,10050CC8,0000000C,10035AB2), ref: 1002FAD1
                                                                                                                                                                                      • GetLastError.KERNEL32(?,1003580D,?,00000001,00000001,10035A23,00000018,10050CC8,0000000C,10035AB2,00000001,00000001,?,10035387,0000000D,10050C60), ref: 1002FAE2
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2714421763-0
                                                                                                                                                                                      • Opcode ID: dc462893557a6a2c1efb59ab9fc79b5cbceadcecec0e23dee2ff352f2dee75c2
                                                                                                                                                                                      • Instruction ID: c59143bfe651e608972d8f734a12067a167937505bca417355bd9d82aad263b9
                                                                                                                                                                                      • Opcode Fuzzy Hash: dc462893557a6a2c1efb59ab9fc79b5cbceadcecec0e23dee2ff352f2dee75c2
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3D012BB5904316AEEB11DFB0EC05B9D7BB4EF013D2F50412DF008AE091DB35A840DB92
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10001B80 Relevance: 3.1, APIs: 2, Instructions: 98COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 173 10001b80-10001b90 174 10001b92-10001b97 173->174 175 10001b9c-10001ba8 173->175 176 10001c9c-10001c9f 174->176 177 10001c04-10001c66 175->177 178 10001baa-10001bb5 175->178 181 10001c74-10001c91 VirtualProtect 177->181 182 10001c68-10001c71 177->182 179 10001bb7-10001bbe 178->179 180 10001bfa-10001bff 178->180 183 10001bc0-10001bce 179->183 184 10001be2-10001bf4 VirtualFree 179->184 180->176 185 10001c93-10001c95 181->185 186 10001c97 181->186 182->181 183->184 187 10001bd0-10001be0 183->187 184->180 185->176 186->176 187->180 187->184
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • VirtualFree.KERNELBASE(00000000,?,00004000,?,10001E18,00000001,00000000,?,100025E8,?,?,?,?,100025E8,00000000,00000000), ref: 10001BF4
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: FreeVirtual
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1263568516-0
                                                                                                                                                                                      • Opcode ID: dd38d51ca3a6b672f32aeaf0fb246c4496e8ccb210392943b19121075d5be09d
                                                                                                                                                                                      • Instruction ID: 749d9464b473a0839557e7d3f54d457581c14e70089049c47b2cfbba366a5d19
                                                                                                                                                                                      • Opcode Fuzzy Hash: dd38d51ca3a6b672f32aeaf0fb246c4496e8ccb210392943b19121075d5be09d
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5841B9746002099FEB48CF58C490FA9B7B2FB88350F14C659E81A9F395D731EE41CB84
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10036624 Relevance: 3.0, APIs: 2, Instructions: 28memoryCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 188 10036624-10036642 HeapCreate 189 10036647-10036654 call 100365c9 188->189 190 10036644-10036646 188->190 193 10036656-10036663 call 10035aca 189->193 194 1003667a-1003667d 189->194 193->194 197 10036665-10036678 HeapDestroy 193->197 197->190
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • HeapCreate.KERNELBASE(00000000,00001000,00000000,10030AEB,00000001,?,?,00000001,?,?,10030C69,00000001,?,?,10050A28,0000000C), ref: 10036635
                                                                                                                                                                                      • HeapDestroy.KERNEL32(?,?,00000001,?,?,10030C69,00000001,?,?,10050A28,0000000C,10030D23,?), ref: 1003666B
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Heap$CreateDestroy
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3296620671-0
                                                                                                                                                                                      • Opcode ID: d3c419273cfe47b5decc93e2e70dd510a49122bb40b3ad2795d27682d43cbdf9
                                                                                                                                                                                      • Instruction ID: 5adf962be877c1470e25a5b203e63be93066c2f5666ac54c72bc9e0dfe65a95a
                                                                                                                                                                                      • Opcode Fuzzy Hash: d3c419273cfe47b5decc93e2e70dd510a49122bb40b3ad2795d27682d43cbdf9
                                                                                                                                                                                      • Instruction Fuzzy Hash: 22E06D706103519EFB139B30CE8A33539F8FB5878BF008869F405C80A0FBA08840AA15
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100019C0 Relevance: 2.6, APIs: 2, Instructions: 115memoryCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 198 100019c0-100019ee 199 10001a02-10001a0e 198->199 200 10001a14-10001a1b 199->200 201 10001b06 199->201 203 10001a83-10001a9e call 10001990 200->203 204 10001a1d-10001a2a 200->204 202 10001b0b-10001b0e 201->202 213 10001aa0-10001aa2 203->213 214 10001aa4-10001ac9 VirtualAlloc 203->214 206 10001a2c-10001a4e VirtualAlloc 204->206 207 10001a7e 204->207 208 10001a50-10001a52 206->208 209 10001a57-10001a7b call 100017c0 206->209 207->199 208->202 209->207 213->202 216 10001acb-10001acd 214->216 217 10001acf-10001afe call 10001810 214->217 216->202 217->201
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • VirtualAlloc.KERNEL32(4D8B0000,00000000,00001000,00000004,?,1000257F,00000000), ref: 10001A41
                                                                                                                                                                                      • VirtualAlloc.KERNELBASE(4D8B0000,8B118BBC,00001000,00000004,10012839,8B118BBC,?,1000257F,00000000,10012839,?), ref: 10001ABC
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AllocVirtual
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 4275171209-0
                                                                                                                                                                                      • Opcode ID: 095274eb58cefc7da223eb8c3e93af1acb0495bf3fbc764276b25f8f0a8074d8
                                                                                                                                                                                      • Instruction ID: bcee95509f27266f5ca249dd7f6d6a0ca5035efccc592cd1fda7edfbe35d51d4
                                                                                                                                                                                      • Opcode Fuzzy Hash: 095274eb58cefc7da223eb8c3e93af1acb0495bf3fbc764276b25f8f0a8074d8
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0D51D9B4A0010AEFDB04CF94C991AAEB7F5FF48344F248599E905AB345D770EE91CBA1
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                      Function 10021854 Relevance: 12.1, APIs: 8, Instructions: 129filestringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3.LIBCMT ref: 10021873
                                                                                                                                                                                      • GetFullPathNameA.KERNEL32(?,00000104,?,?,00000014), ref: 100218B4
                                                                                                                                                                                        • Part of subcall function 100201F1: __CxxThrowException@8.LIBCMT ref: 10020205
                                                                                                                                                                                      • PathIsUNCA.SHLWAPI(?,00000000), ref: 100218FE
                                                                                                                                                                                      • GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000), ref: 1002191C
                                                                                                                                                                                      • CharUpperA.USER32(?), ref: 10021943
                                                                                                                                                                                      • FindFirstFileA.KERNEL32(?,00000000), ref: 10021954
                                                                                                                                                                                      • FindClose.KERNEL32(00000000), ref: 10021960
                                                                                                                                                                                      • lstrlenA.KERNEL32(?), ref: 10021975
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: FindPath$CharCloseException@8FileFirstFullH_prolog3InformationNameThrowUpperVolumelstrlen
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3249967234-0
                                                                                                                                                                                      • Opcode ID: eb490681b6d568b073a389bcc3f25b73e071b185c17e64a21006f2b4c6435a32
                                                                                                                                                                                      • Instruction ID: 60a4613adf5c573b6f7ecf717c69f11d5bc108e5d701f0798ce0fed1b7752ca1
                                                                                                                                                                                      • Opcode Fuzzy Hash: eb490681b6d568b073a389bcc3f25b73e071b185c17e64a21006f2b4c6435a32
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0E41DF7990024AAFEB11DFB4DC95AFF77BCEF14355F800529F815E2192EB30A944CA61
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10014B71 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70libraryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • _strcpy_s.LIBCMT ref: 10014B9E
                                                                                                                                                                                        • Part of subcall function 100311F4: __getptd_noexit.LIBCMT ref: 100311F4
                                                                                                                                                                                      • __snprintf_s.LIBCMT ref: 10014BD7
                                                                                                                                                                                        • Part of subcall function 1003119A: __vsnprintf_s_l.LIBCMT ref: 100311AF
                                                                                                                                                                                      • GetLocaleInfoA.KERNEL32(00000800,00000003,?,00000004), ref: 10014C02
                                                                                                                                                                                      • LoadLibraryA.KERNEL32(?), ref: 10014C25
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: InfoLibraryLoadLocale__getptd_noexit__snprintf_s__vsnprintf_s_l_strcpy_s
                                                                                                                                                                                      • String ID: LOC
                                                                                                                                                                                      • API String ID: 3864805678-519433814
                                                                                                                                                                                      • Opcode ID: 993ef955d11e1d056c0da4e243e940ae0abcf9c49e17b7ca6a81ba24efbb4c92
                                                                                                                                                                                      • Instruction ID: c6b9acf05ba5f485c5c472c95a6cc1a1d49ea65b07ecc8430683ae88ba63382e
                                                                                                                                                                                      • Opcode Fuzzy Hash: 993ef955d11e1d056c0da4e243e940ae0abcf9c49e17b7ca6a81ba24efbb4c92
                                                                                                                                                                                      • Instruction Fuzzy Hash: B011E471900118AFDB11DB64CC86BDD73B8EF09315F1241A1F7059F0A1EEB0E9859AD1
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002F81E Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • IsDebuggerPresent.KERNEL32 ref: 100357B5
                                                                                                                                                                                      • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 100357CA
                                                                                                                                                                                      • UnhandledExceptionFilter.KERNEL32(10049C70), ref: 100357D5
                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(C0000409), ref: 100357F1
                                                                                                                                                                                      • TerminateProcess.KERNEL32(00000000), ref: 100357F8
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2579439406-0
                                                                                                                                                                                      • Opcode ID: 8c939c2efb241c6fb0af2f27818b77021c2f68401b871af98be5750efaca2114
                                                                                                                                                                                      • Instruction ID: 3237c6aacfb12be4d9d12df29f826ae8d0614ddfd4a103b53015e2b6a0b2c6c3
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8c939c2efb241c6fb0af2f27818b77021c2f68401b871af98be5750efaca2114
                                                                                                                                                                                      • Instruction Fuzzy Hash: B021FFB4801320CFFB11DF68EDC56483BB4FB88315F50606AE90D87A71E7B16A80AF56
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1001B43F Relevance: 6.0, APIs: 4, Instructions: 41keyboardwindowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 1001DDC0: GetWindowLongA.USER32 ref: 1001DDCB
                                                                                                                                                                                      • GetKeyState.USER32(00000010), ref: 1001B463
                                                                                                                                                                                      • GetKeyState.USER32(00000011), ref: 1001B46C
                                                                                                                                                                                      • GetKeyState.USER32(00000012), ref: 1001B475
                                                                                                                                                                                      • SendMessageA.USER32 ref: 1001B48B
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: State$LongMessageSendWindow
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1063413437-0
                                                                                                                                                                                      • Opcode ID: cbe92a3c8afafbb230f3664375f9361b4519f62e794af51cea28ccd5527820e8
                                                                                                                                                                                      • Instruction ID: b089c7fc05c7e6fbdd4fc06f52c570ea12a8721339fdd196cb0bdf3cbec2e35a
                                                                                                                                                                                      • Opcode Fuzzy Hash: cbe92a3c8afafbb230f3664375f9361b4519f62e794af51cea28ccd5527820e8
                                                                                                                                                                                      • Instruction Fuzzy Hash: F6F0E97679075A27EB20BA744CC1F9A0154DF89BD9F028534B741EE0D3DBB0C8819170
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10018C9A Relevance: 4.5, APIs: 3, Instructions: 37COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: fb0f3e1e5a18f2ff69a806334b974a9f52d4ac6ab5fd56aeff2c93c24eadb245
                                                                                                                                                                                      • Instruction ID: 3e933570e0ddfcbf732aafa8bdad2c1db21bb76b11c706ff9f14b0ef8e609435
                                                                                                                                                                                      • Opcode Fuzzy Hash: fb0f3e1e5a18f2ff69a806334b974a9f52d4ac6ab5fd56aeff2c93c24eadb245
                                                                                                                                                                                      • Instruction Fuzzy Hash: 63F03731505119EBDF01DF70CD48AAE3FA9FB04284F008020FD09D9060EB31EB95EBA1
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100134F0 Relevance: 1.5, APIs: 1, Instructions: 11windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Iconic
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 110040809-0
                                                                                                                                                                                      • Opcode ID: c62964fb237a153d00a9d951690d2dc04f1de6fa771c83c35e5bfac844c94462
                                                                                                                                                                                      • Instruction ID: 838b9ee9edc54b62b4d2e1430c30368496747ad900502173d0e488298d75c8b4
                                                                                                                                                                                      • Opcode Fuzzy Hash: c62964fb237a153d00a9d951690d2dc04f1de6fa771c83c35e5bfac844c94462
                                                                                                                                                                                      • Instruction Fuzzy Hash: D6C012B0504208EB8704CB94D940C1977A8E74D30470002CCF80C83300D531AD008655
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10014DA8 Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 229registrylibraryloaderCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3.LIBCMT ref: 10014DC7
                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(kernel32.dll,00000058), ref: 10014DE8
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 10014DF9
                                                                                                                                                                                      • ConvertDefaultLocale.KERNEL32(?), ref: 10014E2F
                                                                                                                                                                                      • ConvertDefaultLocale.KERNEL32(?), ref: 10014E37
                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 10014E4B
                                                                                                                                                                                      • ConvertDefaultLocale.KERNEL32(?), ref: 10014E6F
                                                                                                                                                                                      • ConvertDefaultLocale.KERNEL32(000003FF), ref: 10014E75
                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(10000000,?,00000105), ref: 10014EAE
                                                                                                                                                                                      • GetVersion.KERNEL32 ref: 10014EC3
                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 10014EE8
                                                                                                                                                                                      • RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,?,?), ref: 10014F0D
                                                                                                                                                                                      • _sscanf.LIBCMT ref: 10014F2D
                                                                                                                                                                                      • ConvertDefaultLocale.KERNEL32(?), ref: 10014F62
                                                                                                                                                                                      • ConvertDefaultLocale.KERNEL32(75144EE0), ref: 10014F68
                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?), ref: 10014F77
                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(ntdll.dll), ref: 10014F87
                                                                                                                                                                                      • EnumResourceLanguagesA.KERNEL32 ref: 10014FA2
                                                                                                                                                                                      • ConvertDefaultLocale.KERNEL32(?), ref: 10014FD3
                                                                                                                                                                                      • ConvertDefaultLocale.KERNEL32(75144EE0), ref: 10014FD9
                                                                                                                                                                                      • _memset.LIBCMT ref: 10014FF3
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ConvertDefaultLocale$Module$AddressHandleProc$CloseEnumFileH_prolog3LanguagesNameOpenQueryResourceValueVersion_memset_sscanf
                                                                                                                                                                                      • String ID: Control Panel\Desktop\ResourceLocale$GetSystemDefaultUILanguage$GetUserDefaultUILanguage$kernel32.dll$ntdll.dll
                                                                                                                                                                                      • API String ID: 434808117-483790700
                                                                                                                                                                                      • Opcode ID: 65e42d20e5498d3f2b12d62d094999c60a842ca76fef1cc8bf600e845580613e
                                                                                                                                                                                      • Instruction ID: 7e9daad585b95ff1e899939a3d2ed629ef259dc49ac6fd8c909ded718bcfc143
                                                                                                                                                                                      • Opcode Fuzzy Hash: 65e42d20e5498d3f2b12d62d094999c60a842ca76fef1cc8bf600e845580613e
                                                                                                                                                                                      • Instruction Fuzzy Hash: A4818271D002699FDB10DFA5DD84AFEBBF9FB48341F11012AE944E7290DB789A41CB60
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002E129 Relevance: 42.0, APIs: 12, Strings: 12, Instructions: 44registryclipboardCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • RegisterClipboardFormatA.USER32(Native), ref: 1002E138
                                                                                                                                                                                      • RegisterClipboardFormatA.USER32(OwnerLink), ref: 1002E141
                                                                                                                                                                                      • RegisterClipboardFormatA.USER32(ObjectLink), ref: 1002E14B
                                                                                                                                                                                      • RegisterClipboardFormatA.USER32(Embedded Object), ref: 1002E155
                                                                                                                                                                                      • RegisterClipboardFormatA.USER32(Embed Source), ref: 1002E15F
                                                                                                                                                                                      • RegisterClipboardFormatA.USER32(Link Source), ref: 1002E169
                                                                                                                                                                                      • RegisterClipboardFormatA.USER32(Object Descriptor), ref: 1002E173
                                                                                                                                                                                      • RegisterClipboardFormatA.USER32(Link Source Descriptor), ref: 1002E17D
                                                                                                                                                                                      • RegisterClipboardFormatA.USER32(FileName), ref: 1002E187
                                                                                                                                                                                      • RegisterClipboardFormatA.USER32(FileNameW), ref: 1002E191
                                                                                                                                                                                      • RegisterClipboardFormatA.USER32(Rich Text Format), ref: 1002E19B
                                                                                                                                                                                      • RegisterClipboardFormatA.USER32(RichEdit Text and Objects), ref: 1002E1A5
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ClipboardFormatRegister
                                                                                                                                                                                      • String ID: Embed Source$Embedded Object$FileName$FileNameW$Link Source$Link Source Descriptor$Native$Object Descriptor$ObjectLink$OwnerLink$Rich Text Format$RichEdit Text and Objects
                                                                                                                                                                                      • API String ID: 1228543026-2889995556
                                                                                                                                                                                      • Opcode ID: 59400726b86d90ec70e7cae638daa4a7ba4f983a7778b7d8b23ac204cd440048
                                                                                                                                                                                      • Instruction ID: dd0e5b84f65b6698509d1545b20fc89df91f0ad9f4cec7ea2b0b947e93895074
                                                                                                                                                                                      • Opcode Fuzzy Hash: 59400726b86d90ec70e7cae638daa4a7ba4f983a7778b7d8b23ac204cd440048
                                                                                                                                                                                      • Instruction Fuzzy Hash: 11013271800784AACB30EFB69C48C8BBAE4EEC5611322493EE295C7651E774D142CF88
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1003548E Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,10030AF9,?,?,00000001,?,?,10030C69,00000001,?,?,10050A28,0000000C,10030D23,?), ref: 10035494
                                                                                                                                                                                      • __mtterm.LIBCMT ref: 100354A0
                                                                                                                                                                                        • Part of subcall function 10035178: __decode_pointer.LIBCMT ref: 10035189
                                                                                                                                                                                        • Part of subcall function 10035178: TlsFree.KERNEL32(00000021,10030B95,?,?,00000001,?,?,10030C69,00000001,?,?,10050A28,0000000C,10030D23,?), ref: 100351A3
                                                                                                                                                                                        • Part of subcall function 10035178: DeleteCriticalSection.KERNEL32(00000000,00000000,?,00000001,10030B95,?,?,00000001,?,?,10030C69,00000001,?,?,10050A28,0000000C), ref: 10035987
                                                                                                                                                                                        • Part of subcall function 10035178: DeleteCriticalSection.KERNEL32(00000021,?,00000001,10030B95,?,?,00000001,?,?,10030C69,00000001,?,?,10050A28,0000000C,10030D23), ref: 100359B1
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 100354B6
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 100354C3
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 100354D0
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,FlsFree), ref: 100354DD
                                                                                                                                                                                      • TlsAlloc.KERNEL32(?,?,00000001,?,?,10030C69,00000001,?,?,10050A28,0000000C,10030D23,?), ref: 1003552D
                                                                                                                                                                                      • TlsSetValue.KERNEL32(00000000,?,?,00000001,?,?,10030C69,00000001,?,?,10050A28,0000000C,10030D23,?), ref: 10035548
                                                                                                                                                                                      • __init_pointers.LIBCMT ref: 10035552
                                                                                                                                                                                      • __encode_pointer.LIBCMT ref: 1003555D
                                                                                                                                                                                      • __encode_pointer.LIBCMT ref: 1003556D
                                                                                                                                                                                      • __encode_pointer.LIBCMT ref: 1003557D
                                                                                                                                                                                      • __encode_pointer.LIBCMT ref: 1003558D
                                                                                                                                                                                      • __decode_pointer.LIBCMT ref: 100355AE
                                                                                                                                                                                      • __calloc_crt.LIBCMT ref: 100355C7
                                                                                                                                                                                      • __decode_pointer.LIBCMT ref: 100355E1
                                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 100355F7
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AddressProc__encode_pointer$__decode_pointer$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm
                                                                                                                                                                                      • String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
                                                                                                                                                                                      • API String ID: 4287529916-3819984048
                                                                                                                                                                                      • Opcode ID: 7b999aff3b121b0dd31d802fbd5a53390c05e299083a78b6c63fb44fd02a4d79
                                                                                                                                                                                      • Instruction ID: 5f0ed48c763fc33488bdc3e5787629902cd989e4a3f8a0ff7b7d748a1094bf66
                                                                                                                                                                                      • Opcode Fuzzy Hash: 7b999aff3b121b0dd31d802fbd5a53390c05e299083a78b6c63fb44fd02a4d79
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0131A0709067219EEB12DF74ADC5A593AE1FB45363F21092AE414CB1F0EB3694409FA0
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1001C915 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 179COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Long$ClassHookPropWindow$AtomCallGlobalNameNext$Exception@8H_prolog3H_prolog3_ThrowUnhookWindows_memset
                                                                                                                                                                                      • String ID: #32768$AfxOldWndProc423$ime
                                                                                                                                                                                      • API String ID: 867647115-4034971020
                                                                                                                                                                                      • Opcode ID: be0f4bdd952448ef7690da40483777f37b87bc3c1912211ef9ad5859523c10f5
                                                                                                                                                                                      • Instruction ID: e0f5ce7512a5b4d1e32b812d2adba45b1a1350b75cf904612dadc9a2b629d5df
                                                                                                                                                                                      • Opcode Fuzzy Hash: be0f4bdd952448ef7690da40483777f37b87bc3c1912211ef9ad5859523c10f5
                                                                                                                                                                                      • Instruction Fuzzy Hash: A561EF7540426EAFDB11DF61CD89FAE3BB8EF09362F100154F509EA191DB34EA80CBA5
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002DB49 Relevance: 28.9, APIs: 19, Instructions: 423stringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: String$Variant$ClearFree_memset$ChangeException@8H_prolog3ThrowTypelstrlen
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 4128688680-0
                                                                                                                                                                                      • Opcode ID: 6192f18373e1637f38ae635fdb485c2c49157f7b8aa44aff1f0335ddf822a966
                                                                                                                                                                                      • Instruction ID: 42fa242583032f4c72b1ee8c19c4a820194bcb4b4a787a5525753aa98076571e
                                                                                                                                                                                      • Opcode Fuzzy Hash: 6192f18373e1637f38ae635fdb485c2c49157f7b8aa44aff1f0335ddf822a966
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5EF18A7490025ADFDF11DFA8D880AEEBBB4FF05300F90406AE951AB2A1D774AE56CF50
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10018B59 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 77libraryloaderCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(USER32,00000000,00000000,74ED5D80,10018CA5,?,?,?,?,?,?,?,1001AB36,00000000,00000002,00000028), ref: 10018B82
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 10018B9E
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 10018BAF
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 10018BC0
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 10018BD1
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 10018BE2
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 10018BF3
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,EnumDisplayDevicesA), ref: 10018C04
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AddressProc$HandleModule
                                                                                                                                                                                      • String ID: EnumDisplayDevicesA$EnumDisplayMonitors$GetMonitorInfoA$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32
                                                                                                                                                                                      • API String ID: 667068680-68207542
                                                                                                                                                                                      • Opcode ID: ef20b1205fbe14ac9d2a40522549883dc0a7ccf4399eb4921ca3be0b95f38340
                                                                                                                                                                                      • Instruction ID: 77f58ff47d83721d02e0aa712f7cb6554a3c60b1de10c844b6b889dbd48dd915
                                                                                                                                                                                      • Opcode Fuzzy Hash: ef20b1205fbe14ac9d2a40522549883dc0a7ccf4399eb4921ca3be0b95f38340
                                                                                                                                                                                      • Instruction Fuzzy Hash: 40213071902121AAE751DF25ADC046DBAEAF349280F61093FF10CD6560D7309AC6AFA9
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002A778 Relevance: 26.0, APIs: 17, Instructions: 452windowkeyboardCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetFocus.USER32(?), ref: 1002A7CB
                                                                                                                                                                                      • IsWindowEnabled.USER32(?), ref: 1002A827
                                                                                                                                                                                      • __EH_prolog3_catch.LIBCMT ref: 1002A875
                                                                                                                                                                                      • GetFocus.USER32(00000028), ref: 1002A895
                                                                                                                                                                                      • GetParent.USER32(?), ref: 1002A8E0
                                                                                                                                                                                      • GetParent.USER32(?), ref: 1002A8F0
                                                                                                                                                                                      • GetKeyState.USER32(00000012), ref: 1002A9AE
                                                                                                                                                                                      • IsDialogMessageA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1002AA62
                                                                                                                                                                                      • GetFocus.USER32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 1002AA75
                                                                                                                                                                                      • GetFocus.USER32(00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1002AA82
                                                                                                                                                                                      • IsWindow.USER32(?), ref: 1002AA9A
                                                                                                                                                                                      • GetFocus.USER32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 1002AAA6
                                                                                                                                                                                      • IsWindow.USER32(?), ref: 1002AABC
                                                                                                                                                                                      • GetFocus.USER32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 1002AAC2
                                                                                                                                                                                      • GetKeyState.USER32(00000010), ref: 1002AAEB
                                                                                                                                                                                      • MessageBeep.USER32(00000000), ref: 1002ABE2
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Focus$Window$MessageParentState$BeepDialogEnabledH_prolog3_catch
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 656273425-0
                                                                                                                                                                                      • Opcode ID: c00fbb9f62a63b0a8ab12a0078c89d294cc621361981fd48dcea0cc4144d3722
                                                                                                                                                                                      • Instruction ID: ae1ce06b8cbd239f24ee816c06620fe7a5750cbf7a5142a39db81a57ec361da3
                                                                                                                                                                                      • Opcode Fuzzy Hash: c00fbb9f62a63b0a8ab12a0078c89d294cc621361981fd48dcea0cc4144d3722
                                                                                                                                                                                      • Instruction Fuzzy Hash: ECF1BC35E00206ABDF11EF61E984AAE7BF5EF46790F924029E845AB161DF34ECC0DB51
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1001AA48 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 176windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Rect$Window$Copy$Long$MessageParentSend
                                                                                                                                                                                      • String ID: (
                                                                                                                                                                                      • API String ID: 808654186-3887548279
                                                                                                                                                                                      • Opcode ID: 058a394f33d0b4ea0f3338ceab01116baeabbc1ca71f5aa138c65239db7cf94a
                                                                                                                                                                                      • Instruction ID: b5709b81a08ee2b414ac32db9db5e9a4175f57b01f1fa3e32d23aafb2ee176ce
                                                                                                                                                                                      • Opcode Fuzzy Hash: 058a394f33d0b4ea0f3338ceab01116baeabbc1ca71f5aa138c65239db7cf94a
                                                                                                                                                                                      • Instruction Fuzzy Hash: CC513C72900219AFDB00CBA8CD85EEEBBF9EF49214F154115F905EB291EB34E985CB61
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100161C0 Relevance: 18.1, APIs: 12, Instructions: 91synchronizationthreadinjectionCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • _memset.LIBCMT ref: 100161DE
                                                                                                                                                                                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 100161FC
                                                                                                                                                                                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 10016206
                                                                                                                                                                                      • ResumeThread.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 10016248
                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,00000000), ref: 10016253
                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 1001625C
                                                                                                                                                                                      • SuspendThread.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 10016267
                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,00000000), ref: 10016277
                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 10016280
                                                                                                                                                                                      • CloseHandle.KERNEL32(00000002,?,00000000), ref: 100162A2
                                                                                                                                                                                        • Part of subcall function 100201F1: __CxxThrowException@8.LIBCMT ref: 10020205
                                                                                                                                                                                      • SetEvent.KERNEL32(00000004,?,?,?,?,?,?,?,00000000), ref: 1001628A
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CloseEventHandle$CreateObjectSingleThreadWait$Exception@8ResumeSuspendThrow_memset
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3191170017-0
                                                                                                                                                                                      • Opcode ID: 2f30da852c83b448af5579f0f44270d029fe44d128d829d4e1193c6c18408e94
                                                                                                                                                                                      • Instruction ID: 00337a1eacd8e53df2662d8cc6bc483a2e3f323796300d703392e3233c80558b
                                                                                                                                                                                      • Opcode Fuzzy Hash: 2f30da852c83b448af5579f0f44270d029fe44d128d829d4e1193c6c18408e94
                                                                                                                                                                                      • Instruction Fuzzy Hash: 69314772800A19FFDF11AFA4CD849AEBBB8EB08394F108269F511A6160D671A9818F61
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10014538 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 56libraryloaderCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(KERNEL32,00000000,?,00000020,1001501F,000000FF), ref: 1001455A
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,CreateActCtxA), ref: 10014578
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,ReleaseActCtx), ref: 10014585
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,ActivateActCtx), ref: 10014592
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,DeactivateActCtx), ref: 1001459F
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AddressProc$HandleModule
                                                                                                                                                                                      • String ID: ActivateActCtx$CreateActCtxA$DeactivateActCtx$KERNEL32$ReleaseActCtx
                                                                                                                                                                                      • API String ID: 667068680-3617302793
                                                                                                                                                                                      • Opcode ID: 70c6ef07d46d29c871f349003da5afecfc7d385a2253c1c7baa95387be190aff
                                                                                                                                                                                      • Instruction ID: 377a8d7a9955057825aa4721d5912d38cb8da7d44d97b701af19917326088f09
                                                                                                                                                                                      • Opcode Fuzzy Hash: 70c6ef07d46d29c871f349003da5afecfc7d385a2253c1c7baa95387be190aff
                                                                                                                                                                                      • Instruction Fuzzy Hash: E711A0B1902766FFE710DF658CD040B7BE5E780256313023FF108CA422DA729884CB22
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1001736E Relevance: 16.6, APIs: 11, Instructions: 139COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3_catch.LIBCMT ref: 10017375
                                                                                                                                                                                      • FindResourceA.KERNEL32(?,?,00000005), ref: 100173A8
                                                                                                                                                                                      • LoadResource.KERNEL32(?,00000000), ref: 100173B0
                                                                                                                                                                                      • LockResource.KERNEL32(00000008,00000024,100010EC,00000000,10046640), ref: 100173C1
                                                                                                                                                                                      • GetDesktopWindow.USER32 ref: 100173F4
                                                                                                                                                                                      • IsWindowEnabled.USER32(000000FF), ref: 10017402
                                                                                                                                                                                      • EnableWindow.USER32(000000FF,00000000), ref: 10017411
                                                                                                                                                                                        • Part of subcall function 1001DEAF: IsWindowEnabled.USER32(?), ref: 1001DEB8
                                                                                                                                                                                        • Part of subcall function 1001DECA: EnableWindow.USER32(?,10046640), ref: 1001DED7
                                                                                                                                                                                      • EnableWindow.USER32(000000FF,00000001), ref: 100174ED
                                                                                                                                                                                      • GetActiveWindow.USER32 ref: 100174F8
                                                                                                                                                                                      • SetActiveWindow.USER32(000000FF,?,00000024,100010EC,00000000,10046640), ref: 10017506
                                                                                                                                                                                      • FreeResource.KERNEL32(00000008,?,00000024,100010EC,00000000,10046640), ref: 10017522
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Window$Resource$Enable$ActiveEnabled$DesktopFindFreeH_prolog3_catchLoadLock
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1509511306-0
                                                                                                                                                                                      • Opcode ID: 8887fad69eff7dfeb0e1daad3ea1c484619822cd4cc789857992b00dd05f503d
                                                                                                                                                                                      • Instruction ID: 24f9302adfe4a133b48f7954ad32019338b8f4d830f04ff5f1dc3598c8fc37ea
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8887fad69eff7dfeb0e1daad3ea1c484619822cd4cc789857992b00dd05f503d
                                                                                                                                                                                      • Instruction Fuzzy Hash: 41519A34A00715DBDB11EFB4CD896AEBBF2FF48701F204129E506AA1A1DB74E9C1CB55
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1001C7D1 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 90COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3_catch.LIBCMT ref: 1001C7D8
                                                                                                                                                                                      • GetPropA.USER32 ref: 1001C7E7
                                                                                                                                                                                      • CallWindowProcA.USER32 ref: 1001C841
                                                                                                                                                                                        • Part of subcall function 1001B617: GetWindowRect.USER32 ref: 1001B63F
                                                                                                                                                                                        • Part of subcall function 1001B617: GetWindow.USER32(?,00000004), ref: 1001B65C
                                                                                                                                                                                      • SetWindowLongA.USER32 ref: 1001C868
                                                                                                                                                                                      • RemovePropA.USER32 ref: 1001C870
                                                                                                                                                                                      • GlobalFindAtomA.KERNEL32 ref: 1001C877
                                                                                                                                                                                      • GlobalDeleteAtom.KERNEL32 ref: 1001C87E
                                                                                                                                                                                        • Part of subcall function 10019DB1: GetWindowRect.USER32 ref: 10019DBD
                                                                                                                                                                                      • CallWindowProcA.USER32 ref: 1001C8D2
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Window$AtomCallGlobalProcPropRect$DeleteFindH_prolog3_catchLongRemove
                                                                                                                                                                                      • String ID: AfxOldWndProc423
                                                                                                                                                                                      • API String ID: 2702501687-1060338832
                                                                                                                                                                                      • Opcode ID: a063fd3bf8fccbd5a0981dbc34fedfe81f848f8f936f79458706efa0baf70b36
                                                                                                                                                                                      • Instruction ID: 2c86e32aa846b6cd4ed02fbbba056fe4065443c08480c9ca6c7694d446bc6c4a
                                                                                                                                                                                      • Opcode Fuzzy Hash: a063fd3bf8fccbd5a0981dbc34fedfe81f848f8f936f79458706efa0baf70b36
                                                                                                                                                                                      • Instruction Fuzzy Hash: D931417680011AEBDF06DFA4CD89DFF7AB8EF0A311F004124F611AA061DB79D9919B65
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10012E90 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 81networkCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 1001E3AC: __EH_prolog3.LIBCMT ref: 1001E3B3
                                                                                                                                                                                        • Part of subcall function 1001E3AC: GetWindowTextA.USER32 ref: 1001E3C9
                                                                                                                                                                                      • inet_addr.WS2_32(?), ref: 10012ECA
                                                                                                                                                                                      • htons.WS2_32(00001C1F), ref: 10012EF0
                                                                                                                                                                                        • Part of subcall function 1001C0D4: GetWindowTextLengthA.USER32(?), ref: 1001C0E0
                                                                                                                                                                                        • Part of subcall function 1001C0D4: GetWindowTextA.USER32 ref: 1001C0F8
                                                                                                                                                                                      • WSAStartup.WS2_32(00000202,?), ref: 10012F58
                                                                                                                                                                                      • _printf.LIBCMT ref: 10012F79
                                                                                                                                                                                      • socket.WS2_32(00000002,00000001,00000006), ref: 10012F87
                                                                                                                                                                                      • WSACleanup.WS2_32 ref: 10012FB6
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: TextWindow$CleanupH_prolog3LengthStartup_printfhtonsinet_addrsocket
                                                                                                                                                                                      • String ID: Please enter your name$WSAStartup function failed with error: %d$error
                                                                                                                                                                                      • API String ID: 4222005279-2156106531
                                                                                                                                                                                      • Opcode ID: 67037696b88feaf8089c85546bf0036186714c2ea7473beb98d4f0a5558571d4
                                                                                                                                                                                      • Instruction ID: 3737c0697f466a88bc0bbe9275da51ac62ffde411ffa2b98b4ee14bbe11db7c9
                                                                                                                                                                                      • Opcode Fuzzy Hash: 67037696b88feaf8089c85546bf0036186714c2ea7473beb98d4f0a5558571d4
                                                                                                                                                                                      • Instruction Fuzzy Hash: 6A317174A85218DBE724DB90CD66FD9B3B1EF48300F1041E8E609AA2C2DB72E9C18F55
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100351B5 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 46libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(KERNEL32.DLL,10050C40,0000000C,100352C7,00000000,00000000,?,1003580D,?,00000001,00000001,10035A23,00000018,10050CC8,0000000C,10035AB2), ref: 100351C6
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 100351EF
                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,DecodePointer), ref: 100351FF
                                                                                                                                                                                      • InterlockedIncrement.KERNEL32(10054D18), ref: 10035221
                                                                                                                                                                                      • __lock.LIBCMT ref: 10035229
                                                                                                                                                                                      • ___addlocaleref.LIBCMT ref: 10035248
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AddressProc$HandleIncrementInterlockedModule___addlocaleref__lock
                                                                                                                                                                                      • String ID: DecodePointer$EncodePointer$KERNEL32.DLL
                                                                                                                                                                                      • API String ID: 1036688887-2843748187
                                                                                                                                                                                      • Opcode ID: d574a0f1000a19323f7053aa8cd70e6a5049edfe48066084e54d0a0798c8c5f6
                                                                                                                                                                                      • Instruction ID: b318c4b35d3b307acbdb6d10fcd30e50ea36946f4a8ba2e6b5da3482df9394b6
                                                                                                                                                                                      • Opcode Fuzzy Hash: d574a0f1000a19323f7053aa8cd70e6a5049edfe48066084e54d0a0798c8c5f6
                                                                                                                                                                                      • Instruction Fuzzy Hash: B811ACB0801B01AFE721CF79CC80B9ABBE0EF05302F104529E49ADB261DB75A900CF15
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1001717E Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 158COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3_catch.LIBCMT ref: 10017185
                                                                                                                                                                                      • GetSystemMetrics.USER32 ref: 10017236
                                                                                                                                                                                      • GlobalLock.KERNEL32 ref: 1001729F
                                                                                                                                                                                      • CreateDialogIndirectParamA.USER32(?,?,?,10016BDA,00000000), ref: 100172CE
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CreateDialogGlobalH_prolog3_catchIndirectLockMetricsParamSystem
                                                                                                                                                                                      • String ID: MS Shell Dlg
                                                                                                                                                                                      • API String ID: 1736106359-76309092
                                                                                                                                                                                      • Opcode ID: ce3ca581592317389ef65e808fedc345d4d6962fe5f5f1ce60146464d019ac3a
                                                                                                                                                                                      • Instruction ID: d5dd74ac162ff8de1123455b698b8f5e71fb740695f122bac0aed726529ed5a4
                                                                                                                                                                                      • Opcode Fuzzy Hash: ce3ca581592317389ef65e808fedc345d4d6962fe5f5f1ce60146464d019ac3a
                                                                                                                                                                                      • Instruction Fuzzy Hash: 4D51CC34900215EBCB05DFA8CC859EEBBB5FF44340F254659F85AEB292DB30DA81CB91
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10021ED7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 63COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetStockObject.GDI32(00000011), ref: 10021EFD
                                                                                                                                                                                      • GetStockObject.GDI32(0000000D), ref: 10021F05
                                                                                                                                                                                      • GetObjectA.GDI32(00000000,0000003C,?), ref: 10021F12
                                                                                                                                                                                      • GetDC.USER32(00000000), ref: 10021F21
                                                                                                                                                                                      • GetDeviceCaps.GDI32(00000000,0000005A), ref: 10021F35
                                                                                                                                                                                      • MulDiv.KERNEL32(00000000,00000048,00000000), ref: 10021F41
                                                                                                                                                                                      • ReleaseDC.USER32 ref: 10021F4D
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Object$Stock$CapsDeviceRelease
                                                                                                                                                                                      • String ID: System
                                                                                                                                                                                      • API String ID: 46613423-3470857405
                                                                                                                                                                                      • Opcode ID: 4af17c4c8fdd97dc95f0f93d77672d7bd64c29950e8ea380bbe0e81d253d6bc4
                                                                                                                                                                                      • Instruction ID: 373189280b20a42e9b8e0e5153e2554ccb1f78fece54ef70e8a9f21809c5893c
                                                                                                                                                                                      • Opcode Fuzzy Hash: 4af17c4c8fdd97dc95f0f93d77672d7bd64c29950e8ea380bbe0e81d253d6bc4
                                                                                                                                                                                      • Instruction Fuzzy Hash: 65119175640268EBEB10DBA0DE85FEF77B8EF19781F800025FA05E6181EB709D05CB65
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100209ED Relevance: 13.6, APIs: 9, Instructions: 96memoryCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3_catch.LIBCMT ref: 100209F4
                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(?,00000010,10020CA6,?,00000000,?,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139,00000004,10001031), ref: 10020A05
                                                                                                                                                                                      • TlsGetValue.KERNEL32(?,?,00000000,?,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139,00000004,10001031,00000000), ref: 10020A23
                                                                                                                                                                                      • LocalAlloc.KERNEL32(00000000,00000000,00000000,00000010,?,?,00000000,?,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139), ref: 10020A57
                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139,00000004,10001031,00000000), ref: 10020AC3
                                                                                                                                                                                      • _memset.LIBCMT ref: 10020AE2
                                                                                                                                                                                      • TlsSetValue.KERNEL32(?,00000000), ref: 10020AF3
                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139,00000004,10001031,00000000), ref: 10020B14
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CriticalSection$LeaveValue$AllocEnterH_prolog3_catchLocal_memset
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1891723912-0
                                                                                                                                                                                      • Opcode ID: c202fd39cbfffff3bf24e4dfcb1fdac57d085034b58585143c8170edaa30a227
                                                                                                                                                                                      • Instruction ID: bbf58174ed8a80918add6c1c4d28f9e8b2dc0fc786f447701b2046db94720ece
                                                                                                                                                                                      • Opcode Fuzzy Hash: c202fd39cbfffff3bf24e4dfcb1fdac57d085034b58585143c8170edaa30a227
                                                                                                                                                                                      • Instruction Fuzzy Hash: F2319874500716EFD720DF10EC85D5EBBA2EF04310BA1C529F91A9A662DB30B990CB81
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10012C30 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 156networkCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • _memset.LIBCMT ref: 10012C6C
                                                                                                                                                                                      • connect.WS2_32(?,?,00000010), ref: 10012CA7
                                                                                                                                                                                      • send.WS2_32(?,?,00000064,00000000), ref: 10012D06
                                                                                                                                                                                      • recv.WS2_32(000000FF,?,00000064,00000000), ref: 10012D9D
                                                                                                                                                                                        • Part of subcall function 1001DDF4: IsWindow.USER32(?), ref: 1001DE03
                                                                                                                                                                                        • Part of subcall function 1001DECA: EnableWindow.USER32(?,10046640), ref: 1001DED7
                                                                                                                                                                                        • Part of subcall function 1001DD46: GetDlgItem.USER32 ref: 1001DD53
                                                                                                                                                                                        • Part of subcall function 1001DDF4: SetWindowTextA.USER32(?,00000064), ref: 1001DE2B
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Window$EnableItemText_memsetconnectrecvsend
                                                                                                                                                                                      • String ID: Connected$Disconnected$Wait...
                                                                                                                                                                                      • API String ID: 119675363-2304371739
                                                                                                                                                                                      • Opcode ID: 5b08e9dbcbe72183f65bc00083dd8b9667ad7d5dfeacba7cbb0734b26863e533
                                                                                                                                                                                      • Instruction ID: 809deafcd8a1ebdff950075e8a5ab3cba01c3ccaf73ffb16f134ff4a091f78a6
                                                                                                                                                                                      • Opcode Fuzzy Hash: 5b08e9dbcbe72183f65bc00083dd8b9667ad7d5dfeacba7cbb0734b26863e533
                                                                                                                                                                                      • Instruction Fuzzy Hash: 88513DB4A002189BDB14EBA8CC95BEEB7B1FF48308F104169E5066F2C2DF75A991CF44
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10025BA5 Relevance: 12.3, APIs: 8, Instructions: 297memoryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3.LIBCMT ref: 10025BAC
                                                                                                                                                                                        • Part of subcall function 1002426A: SysStringLen.OLEAUT32(?), ref: 10024272
                                                                                                                                                                                        • Part of subcall function 1002426A: CoGetClassObject.OLE32(?,?,00000000,1004B62C,?), ref: 10024290
                                                                                                                                                                                      • CreateILockBytesOnHGlobal.OLE32(00000000,00000001,?), ref: 10025D36
                                                                                                                                                                                      • StgCreateDocfileOnILockBytes.OLE32(?,00001012,00000000,?), ref: 10025D57
                                                                                                                                                                                      • GlobalAlloc.KERNEL32(00000000,00000000), ref: 10025DA4
                                                                                                                                                                                      • GlobalLock.KERNEL32 ref: 10025DB2
                                                                                                                                                                                      • GlobalUnlock.KERNEL32(?), ref: 10025DCA
                                                                                                                                                                                      • CreateILockBytesOnHGlobal.OLE32(8007000E,00000001,?), ref: 10025DED
                                                                                                                                                                                      • StgOpenStorageOnILockBytes.OLE32(?,00000000,00000012,00000000,00000000,?), ref: 10025E09
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: GlobalLock$Bytes$Create$AllocClassDocfileH_prolog3ObjectOpenStorageStringUnlock
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 317715441-0
                                                                                                                                                                                      • Opcode ID: 2828fa5d641ff44e81fbef86681a6654b74232d6680dac4ff27e1d2418666a7c
                                                                                                                                                                                      • Instruction ID: 6b32e8b7721f49624c611e5d3fbfac2c00c012c139a68ad78311da97252ee3f4
                                                                                                                                                                                      • Opcode Fuzzy Hash: 2828fa5d641ff44e81fbef86681a6654b74232d6680dac4ff27e1d2418666a7c
                                                                                                                                                                                      • Instruction Fuzzy Hash: BCC12BB090024AEFCF14DFA4DC889AEB7B9FF48341BA14929F916DB251D7719A40CB64
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10014A22 Relevance: 12.1, APIs: 8, Instructions: 65memorystringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GlobalLock.KERNEL32 ref: 10014A3F
                                                                                                                                                                                      • lstrcmpA.KERNEL32(?,?), ref: 10014A4B
                                                                                                                                                                                      • OpenPrinterA.WINSPOOL.DRV(?,?,00000000), ref: 10014A5D
                                                                                                                                                                                      • DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 10014A7D
                                                                                                                                                                                      • GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 10014A85
                                                                                                                                                                                      • GlobalLock.KERNEL32 ref: 10014A8F
                                                                                                                                                                                      • DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 10014A9C
                                                                                                                                                                                      • ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 10014AB4
                                                                                                                                                                                        • Part of subcall function 10020495: GlobalFlags.KERNEL32(?), ref: 100204A0
                                                                                                                                                                                        • Part of subcall function 10020495: GlobalUnlock.KERNEL32(?,?,?,10014801,?,00000004,1000116F,?,?,1000113F), ref: 100204B2
                                                                                                                                                                                        • Part of subcall function 10020495: GlobalFree.KERNEL32 ref: 100204BD
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 168474834-0
                                                                                                                                                                                      • Opcode ID: 682e8427e4eae8e26461a3ae413d84982b563dbbe5be57b0626e4beef210c331
                                                                                                                                                                                      • Instruction ID: 20fc1444fe35ab48259a21c9388e4acfe4ba196ce7874d1294122afbb026df8a
                                                                                                                                                                                      • Opcode Fuzzy Hash: 682e8427e4eae8e26461a3ae413d84982b563dbbe5be57b0626e4beef210c331
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5111CAB6500604BBDB22DFA6CD89C6FBBEDEF897407514029FA01C6121DA31E940D728
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10020F2E Relevance: 12.0, APIs: 8, Instructions: 38COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetSystemMetrics.USER32 ref: 10020F3B
                                                                                                                                                                                      • GetSystemMetrics.USER32 ref: 10020F42
                                                                                                                                                                                      • GetSystemMetrics.USER32 ref: 10020F49
                                                                                                                                                                                      • GetSystemMetrics.USER32 ref: 10020F53
                                                                                                                                                                                      • GetDC.USER32(00000000), ref: 10020F5D
                                                                                                                                                                                      • GetDeviceCaps.GDI32(00000000,00000058), ref: 10020F6E
                                                                                                                                                                                      • GetDeviceCaps.GDI32(00000000,0000005A), ref: 10020F76
                                                                                                                                                                                      • ReleaseDC.USER32 ref: 10020F7E
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MetricsSystem$CapsDevice$Release
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1151147025-0
                                                                                                                                                                                      • Opcode ID: cd0d00d3bf09b09063c79ec0fd26ae0b7f2f0b754747fdae3c9245efa7409752
                                                                                                                                                                                      • Instruction ID: 9c0db37145597a9d8002a30536ddf2583a3ab63f37cab70819204e46a6a6359b
                                                                                                                                                                                      • Opcode Fuzzy Hash: cd0d00d3bf09b09063c79ec0fd26ae0b7f2f0b754747fdae3c9245efa7409752
                                                                                                                                                                                      • Instruction Fuzzy Hash: 84F09670A40714AEF7206F718D8DF277BA4EBC6B51F01442AE611CB2D0D6B598018F50
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1001820B Relevance: 10.8, APIs: 7, Instructions: 255memoryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3.LIBCMT ref: 10018224
                                                                                                                                                                                      • MapDialogRect.USER32(?,00000000), ref: 100182B5
                                                                                                                                                                                      • SysAllocStringLen.OLEAUT32(?,?), ref: 100182D4
                                                                                                                                                                                      • CLSIDFromString.OLE32(?,?,00000000), ref: 100183C6
                                                                                                                                                                                        • Part of subcall function 100144EC: _malloc.LIBCMT ref: 10014506
                                                                                                                                                                                      • CLSIDFromProgID.OLE32(?,?,00000000), ref: 100183CE
                                                                                                                                                                                      • SetWindowPos.USER32(?,00000001,00000000,00000000,00000000,00000000,00000013,00000001,00000000,?,00000000,?,00000000,00000000,0000FC84,00000000), ref: 10018468
                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 100184BA
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: String$From$AllocDialogFreeH_prolog3ProgRectWindow_malloc
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2841959276-0
                                                                                                                                                                                      • Opcode ID: c0153d1bb8fcf0a41aaabcf573d8d81effc90bbca259e310eefe5537c03a2762
                                                                                                                                                                                      • Instruction ID: 12b2beb2c71702a94885f2910fef0e7bfaf155135e6476596dcf7fffba126212
                                                                                                                                                                                      • Opcode Fuzzy Hash: c0153d1bb8fcf0a41aaabcf573d8d81effc90bbca259e310eefe5537c03a2762
                                                                                                                                                                                      • Instruction Fuzzy Hash: E2B1F075900219AFDB44CFA8C984AEE7BF4FF08344F41812AFC199B251E774EA94CB94
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10029D32 Relevance: 10.6, APIs: 7, Instructions: 128COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3.LIBCMT ref: 10029D39
                                                                                                                                                                                      • _memset.LIBCMT ref: 10029DA5
                                                                                                                                                                                        • Part of subcall function 1002BDD9: _memset.LIBCMT ref: 1002BDE1
                                                                                                                                                                                      • VariantClear.OLEAUT32(?), ref: 10029DE5
                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 10029E66
                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 10029E75
                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 10029E84
                                                                                                                                                                                      • VariantClear.OLEAUT32(00000000), ref: 10029E99
                                                                                                                                                                                        • Part of subcall function 1002981B: __EH_prolog3.LIBCMT ref: 10029837
                                                                                                                                                                                        • Part of subcall function 1002981B: VariantClear.OLEAUT32(?), ref: 1002989C
                                                                                                                                                                                        • Part of subcall function 1002BDB9: VariantCopy.OLEAUT32(?,?), ref: 1002BDC7
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Variant$ClearFreeString$H_prolog3_memset$Copy
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2905758408-0
                                                                                                                                                                                      • Opcode ID: 317752fba171eb6017de271287eb17fa51ac427e87f13bc90c3293dac50f3e70
                                                                                                                                                                                      • Instruction ID: f0b41ad0b9e8c5ab018840f5e4220df87c974ebe41012567005bb994ff67d79c
                                                                                                                                                                                      • Opcode Fuzzy Hash: 317752fba171eb6017de271287eb17fa51ac427e87f13bc90c3293dac50f3e70
                                                                                                                                                                                      • Instruction Fuzzy Hash: 285145B1900209DFDB50CFA4D984BDEBBF8FF08345F604529E516EB292DB74A944CB60
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10026AC9 Relevance: 10.6, APIs: 7, Instructions: 121COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: FreeString$_memset$ClearH_prolog3Variant
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3574576181-0
                                                                                                                                                                                      • Opcode ID: 2395c72e51517dafebea27bc0076b2bbc153d5feea7613aa175e303fbf427c27
                                                                                                                                                                                      • Instruction ID: f024da645e7c2c1b7af1d173f97c0c2408efe7f25a4d8a65d4f7a6d8da03a969
                                                                                                                                                                                      • Opcode Fuzzy Hash: 2395c72e51517dafebea27bc0076b2bbc153d5feea7613aa175e303fbf427c27
                                                                                                                                                                                      • Instruction Fuzzy Hash: D5414B71901229EFCB12DFA4CC45ADDBBB9FF48750F60811AF059AB151C770AA91CF90
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10016570 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117registryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3.LIBCMT ref: 1001658F
                                                                                                                                                                                      • RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 1001664B
                                                                                                                                                                                      • RegEnumKeyA.ADVAPI32(?,00000000,00000000,00000104), ref: 10016662
                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,?,?,?,Software\,00000018), ref: 1001667C
                                                                                                                                                                                      • RegQueryValueA.ADVAPI32(80000001,?,?,?), ref: 1001668E
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CloseEnumH_prolog3OpenQueryValue
                                                                                                                                                                                      • String ID: Software\
                                                                                                                                                                                      • API String ID: 3878845136-964853688
                                                                                                                                                                                      • Opcode ID: f1b56214fd335d4f9116c0b783ab986839370396de21831478769312653865ef
                                                                                                                                                                                      • Instruction ID: 033a50cfb30fa6cc3e6a93964c888ed0270874f81604230ed873c3433942879c
                                                                                                                                                                                      • Opcode Fuzzy Hash: f1b56214fd335d4f9116c0b783ab986839370396de21831478769312653865ef
                                                                                                                                                                                      • Instruction Fuzzy Hash: EB41BD3590021ADBDF11DBA4CC85AEFB7F9EF49300F10452AF551E7290DB74AA84CBA1
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1001AC0A Relevance: 10.6, APIs: 7, Instructions: 115windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetParent.USER32(?), ref: 1001AC38
                                                                                                                                                                                      • PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 1001AC5F
                                                                                                                                                                                      • UpdateWindow.USER32(?), ref: 1001AC79
                                                                                                                                                                                      • SendMessageA.USER32 ref: 1001AC9D
                                                                                                                                                                                      • SendMessageA.USER32 ref: 1001ACB7
                                                                                                                                                                                      • UpdateWindow.USER32(?), ref: 1001ACFD
                                                                                                                                                                                      • PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 1001AD31
                                                                                                                                                                                        • Part of subcall function 1001DDC0: GetWindowLongA.USER32 ref: 1001DDCB
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Message$Window$PeekSendUpdate$LongParent
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2853195852-0
                                                                                                                                                                                      • Opcode ID: 8feb0ac7bae7ce442b8f735e4586b594c24fd72a806b3adb2c8abbd7d5165037
                                                                                                                                                                                      • Instruction ID: 2c496a546f4f3369c4007c2120619f6f6246382fa3c8875764faf214921a126d
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8feb0ac7bae7ce442b8f735e4586b594c24fd72a806b3adb2c8abbd7d5165037
                                                                                                                                                                                      • Instruction Fuzzy Hash: CF419C306047419FD721DF218D84A1BBAE4FFC6B95F00092DF8829A5A1E772D9C4CA92
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100151F8 Relevance: 10.6, APIs: 7, Instructions: 111windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSend$ActiveCaptureFocusLastPopup
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3219385341-0
                                                                                                                                                                                      • Opcode ID: 0692041214081e2f36a8d4241324024d2ae50e87aeefd30631ef423bb921d550
                                                                                                                                                                                      • Instruction ID: 62284d7f9b5d477bd881e5ff36e2f7527576b9e0115aa241cae08abffcb520cf
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0692041214081e2f36a8d4241324024d2ae50e87aeefd30631ef423bb921d550
                                                                                                                                                                                      • Instruction Fuzzy Hash: B2314975301315EFDA11DB64ECC4D6F7AEEEB866C1B530469F840DB112DB31EC8196A2
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002A200 Relevance: 10.6, APIs: 7, Instructions: 86windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Window$LongParentVisible
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 506644340-0
                                                                                                                                                                                      • Opcode ID: 4c680b8172efdff4f43197e84ba51ed07d499ac862c14e8ee8a7a782e640ae8a
                                                                                                                                                                                      • Instruction ID: 0686fc7eee0d828e519c8ddef4b664d273c3d3866c12363d81ce6f3f8585b441
                                                                                                                                                                                      • Opcode Fuzzy Hash: 4c680b8172efdff4f43197e84ba51ed07d499ac862c14e8ee8a7a782e640ae8a
                                                                                                                                                                                      • Instruction Fuzzy Hash: 8D219532A00B25EBD621EBB99C49F1B76DCFF8A790F810514F991EB152DF26EC848750
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10032A89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • ___set_flsgetvalue.LIBCMT ref: 10032AB8
                                                                                                                                                                                      • __calloc_crt.LIBCMT ref: 10032AC4
                                                                                                                                                                                      • CreateThread.KERNEL32 ref: 10032B08
                                                                                                                                                                                      • GetLastError.KERNEL32(?,1001623D,?,?,100160A8,?,00000002,00000030,?,00000000), ref: 10032B12
                                                                                                                                                                                      • __dosmaperr.LIBCMT ref: 10032B2A
                                                                                                                                                                                        • Part of subcall function 100311F4: __getptd_noexit.LIBCMT ref: 100311F4
                                                                                                                                                                                        • Part of subcall function 10037753: __decode_pointer.LIBCMT ref: 1003775C
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd_noexit
                                                                                                                                                                                      • String ID: V&'
                                                                                                                                                                                      • API String ID: 1067611704-802299783
                                                                                                                                                                                      • Opcode ID: 7692696f047afdf50ec9d72e30f89faf206a335569b9867b5efcd1348c4cc88e
                                                                                                                                                                                      • Instruction ID: 55a26fe1f49629ebb029cc0f5307a0876855c5a2f29d8e6ee061ec31c14b4724
                                                                                                                                                                                      • Opcode Fuzzy Hash: 7692696f047afdf50ec9d72e30f89faf206a335569b9867b5efcd1348c4cc88e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 28112376505205EFDB02EFA4DC8288FBBE8FF08366F210429F501DA061EB31A910CBA1
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10001390 Relevance: 10.6, APIs: 7, Instructions: 67COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 10016C9F: _memset.LIBCMT ref: 10016CB6
                                                                                                                                                                                      • Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 100013DA
                                                                                                                                                                                      • Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 100013EC
                                                                                                                                                                                      • Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 100013FE
                                                                                                                                                                                      • Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 10001410
                                                                                                                                                                                      • Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 10001422
                                                                                                                                                                                      • Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 10001446
                                                                                                                                                                                      • Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 10001458
                                                                                                                                                                                        • Part of subcall function 100136C0: LoadIconA.USER32(00000000,00000000), ref: 100136D2
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ProcessorVirtual$Concurrency::RootRoot::$IconLoad_memset
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2004563703-0
                                                                                                                                                                                      • Opcode ID: 6dfda32c90deb5612abc77854e0b58487ec939f19a89b76ccee82452222fe2ce
                                                                                                                                                                                      • Instruction ID: cb42d3b07606be4c321c66a21cc03232491b7df8b22d3b1298026f5f2f4788d5
                                                                                                                                                                                      • Opcode Fuzzy Hash: 6dfda32c90deb5612abc77854e0b58487ec939f19a89b76ccee82452222fe2ce
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1A216DB4904299EBDB04CBA8C951BAEBB75FF05704F148558E4516B3C2CB79AA00CB65
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10017632 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65registryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • RegOpenKeyExA.ADVAPI32(80000001,software,00000000,0002001F,?), ref: 10017660
                                                                                                                                                                                      • RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 10017683
                                                                                                                                                                                      • RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 1001769F
                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?), ref: 100176AF
                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?), ref: 100176B9
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CloseCreate$Open
                                                                                                                                                                                      • String ID: software
                                                                                                                                                                                      • API String ID: 1740278721-2010147023
                                                                                                                                                                                      • Opcode ID: f07ad67f425876aa3b9c3d1abad745f5130b44368e02ee1c7008248ac9000b61
                                                                                                                                                                                      • Instruction ID: 0cbbb75e8a23424455f11a5bf93a60ebfd6ed3f7897ef2d174d7de764d8d358b
                                                                                                                                                                                      • Opcode Fuzzy Hash: f07ad67f425876aa3b9c3d1abad745f5130b44368e02ee1c7008248ac9000b61
                                                                                                                                                                                      • Instruction Fuzzy Hash: E911C576900169FBDB21DB9ACD88CDFBFBCEF8A740B1040AAE504E2121D3719A55DB60
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10001180 Relevance: 10.6, APIs: 7, Instructions: 54COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • ~_Task_impl.LIBCPMT ref: 100011B6
                                                                                                                                                                                        • Part of subcall function 10018A6F: __EH_prolog3.LIBCMT ref: 10018A76
                                                                                                                                                                                      • ~_Task_impl.LIBCPMT ref: 100011C8
                                                                                                                                                                                      • ~_Task_impl.LIBCPMT ref: 100011EC
                                                                                                                                                                                        • Part of subcall function 10018AC4: __EH_prolog3.LIBCMT ref: 10018ACB
                                                                                                                                                                                      • ~_Task_impl.LIBCPMT ref: 100011FE
                                                                                                                                                                                      • ~_Task_impl.LIBCPMT ref: 10001210
                                                                                                                                                                                      • ~_Task_impl.LIBCPMT ref: 10001222
                                                                                                                                                                                      • ~_Task_impl.LIBCPMT ref: 10001231
                                                                                                                                                                                        • Part of subcall function 10018662: __EH_prolog3.LIBCMT ref: 10018669
                                                                                                                                                                                        • Part of subcall function 10016C14: __EH_prolog3.LIBCMT ref: 10016C1B
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Task_impl$H_prolog3
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1204490572-0
                                                                                                                                                                                      • Opcode ID: 10d967965786d9dd3e33bfeddf35d30d57af0e4a65215ad2dc6e6a32aea05cb1
                                                                                                                                                                                      • Instruction ID: 6e4cb6b4a122521f521244997ac3fe4936e5f385243ec76687bf906466ac38b5
                                                                                                                                                                                      • Opcode Fuzzy Hash: 10d967965786d9dd3e33bfeddf35d30d57af0e4a65215ad2dc6e6a32aea05cb1
                                                                                                                                                                                      • Instruction Fuzzy Hash: 6B215970905189DBEF09DB98C860BBEBB75EF01308F18469DE0526B3C2CB392B00C716
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10020A8E Relevance: 10.6, APIs: 7, Instructions: 51memoryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?), ref: 10020A95
                                                                                                                                                                                      • __CxxThrowException@8.LIBCMT ref: 10020A9F
                                                                                                                                                                                        • Part of subcall function 10033135: RaiseException.KERNEL32(?,?,?,?), ref: 10033175
                                                                                                                                                                                      • LocalReAlloc.KERNEL32(?,00000000,00000002,00000000,00000010,?,?,00000000,?,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004), ref: 10020AB6
                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139,00000004,10001031,00000000), ref: 10020AC3
                                                                                                                                                                                        • Part of subcall function 100201BD: __CxxThrowException@8.LIBCMT ref: 100201D1
                                                                                                                                                                                      • _memset.LIBCMT ref: 10020AE2
                                                                                                                                                                                      • TlsSetValue.KERNEL32(?,00000000), ref: 10020AF3
                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139,00000004,10001031,00000000), ref: 10020B14
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CriticalLeaveSection$Exception@8Throw$AllocExceptionLocalRaiseValue_memset
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 356813703-0
                                                                                                                                                                                      • Opcode ID: 83477c0e15d1c33d1bb5ec65c1815380ae7d3f4553bdd0be20f92f622c24e4f3
                                                                                                                                                                                      • Instruction ID: 3e12b38782b34356c97e10a87625d487b7a933956f885299f771b8ffc362d3ba
                                                                                                                                                                                      • Opcode Fuzzy Hash: 83477c0e15d1c33d1bb5ec65c1815380ae7d3f4553bdd0be20f92f622c24e4f3
                                                                                                                                                                                      • Instruction Fuzzy Hash: 7B117974100305AFE721EF60CD86D2ABBA6EF44314B51C029F8569A622DB30FC60CB50
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10020EEA Relevance: 10.5, APIs: 7, Instructions: 29COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetSysColor.USER32(0000000F), ref: 10020EF6
                                                                                                                                                                                      • GetSysColor.USER32(00000010), ref: 10020EFD
                                                                                                                                                                                      • GetSysColor.USER32(00000014), ref: 10020F04
                                                                                                                                                                                      • GetSysColor.USER32(00000012), ref: 10020F0B
                                                                                                                                                                                      • GetSysColor.USER32(00000006), ref: 10020F12
                                                                                                                                                                                      • GetSysColorBrush.USER32(0000000F), ref: 10020F1F
                                                                                                                                                                                      • GetSysColorBrush.USER32(00000006), ref: 10020F26
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Color$Brush
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2798902688-0
                                                                                                                                                                                      • Opcode ID: 72252987b8d251bab477bb0d0c872f96bc616149d35122bfb9b146a10746700a
                                                                                                                                                                                      • Instruction ID: b96cbce945517a62156269669ca61c0ebe7744eb3e98ebe12a1aee9bfd1db884
                                                                                                                                                                                      • Opcode Fuzzy Hash: 72252987b8d251bab477bb0d0c872f96bc616149d35122bfb9b146a10746700a
                                                                                                                                                                                      • Instruction Fuzzy Hash: 65F012719407449BD730BF728D49B47BAD5FFC4710F02092EE2418B990E6B6E040DF44
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002981B Relevance: 9.4, APIs: 6, Instructions: 404COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3.LIBCMT ref: 10029837
                                                                                                                                                                                      • VariantClear.OLEAUT32(?), ref: 1002989C
                                                                                                                                                                                        • Part of subcall function 100201F1: __CxxThrowException@8.LIBCMT ref: 10020205
                                                                                                                                                                                      • VariantClear.OLEAUT32(?), ref: 10029AAB
                                                                                                                                                                                      • VariantClear.OLEAUT32(?), ref: 10029B1D
                                                                                                                                                                                      • VariantClear.OLEAUT32(?), ref: 10029D0E
                                                                                                                                                                                        • Part of subcall function 1002BDB9: VariantCopy.OLEAUT32(?,?), ref: 1002BDC7
                                                                                                                                                                                        • Part of subcall function 10013820: _DebugHeapAllocator.LIBCPMTD ref: 10013875
                                                                                                                                                                                        • Part of subcall function 1002C06F: __EH_prolog3.LIBCMT ref: 1002C079
                                                                                                                                                                                        • Part of subcall function 1002C06F: lstrlenA.KERNEL32(?,00000224,10029CDA,?,00000008,00000000,?,000000CC), ref: 1002C098
                                                                                                                                                                                        • Part of subcall function 1002C06F: SysAllocStringByteLen.OLEAUT32(?,00000000), ref: 1002C0A0
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Variant$Clear$H_prolog3$AllocAllocatorByteCopyDebugException@8HeapStringThrowlstrlen
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 63617653-0
                                                                                                                                                                                      • Opcode ID: 5e2e0a19dc0039e2f502762359befe2295f094a54db6864ce8f61926c363e3fd
                                                                                                                                                                                      • Instruction ID: 8f7f5911e4d3fd52506e0ebb541b856e7b36a578254e0be009e80c36fe1d785e
                                                                                                                                                                                      • Opcode Fuzzy Hash: 5e2e0a19dc0039e2f502762359befe2295f094a54db6864ce8f61926c363e3fd
                                                                                                                                                                                      • Instruction Fuzzy Hash: 13F16D7890024CEBDF55DFA0E890AFD7BB9EF08384F90405AFC5593191DB74AA88DB61
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002D1E9 Relevance: 9.3, APIs: 6, Instructions: 253stringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3_catch_GS.LIBCMT ref: 1002D1F0
                                                                                                                                                                                      • lstrlenA.KERNEL32(00000000,000000FF,00000050,10022221,00000000,00000001,?,?,000000FF,?,?,?), ref: 1002D222
                                                                                                                                                                                        • Part of subcall function 10017790: _memcpy_s.LIBCMT ref: 100177A0
                                                                                                                                                                                      • _memset.LIBCMT ref: 1002D2F2
                                                                                                                                                                                      • VariantClear.OLEAUT32(?), ref: 1002D3D1
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ClearH_prolog3_catch_Variant_memcpy_s_memsetlstrlen
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 4021759052-0
                                                                                                                                                                                      • Opcode ID: dc537336900b1f9e5654c723f7bc7d689170c1efb2efdbad80408bb984cec35a
                                                                                                                                                                                      • Instruction ID: 5c01f4bcc98ccee0a604cdfa5feeb0fdece88e80b40f5b50a3c571396f452454
                                                                                                                                                                                      • Opcode Fuzzy Hash: dc537336900b1f9e5654c723f7bc7d689170c1efb2efdbad80408bb984cec35a
                                                                                                                                                                                      • Instruction Fuzzy Hash: 50A18C35C04249DBCF11EFA4E985AEEBBF0FF04350FA0415AE914AB291D734AE41DB61
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002D5D0 Relevance: 9.1, APIs: 6, Instructions: 118memoryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • _memset.LIBCMT ref: 1002D5FF
                                                                                                                                                                                      • SysAllocString.OLEAUT32(00000000), ref: 1002D650
                                                                                                                                                                                      • SysAllocString.OLEAUT32(00000000), ref: 1002D674
                                                                                                                                                                                        • Part of subcall function 100200B9: __EH_prolog3.LIBCMT ref: 100200C0
                                                                                                                                                                                      • SysAllocString.OLEAUT32(00000000), ref: 1002D6CC
                                                                                                                                                                                      • SysAllocString.OLEAUT32(00000000), ref: 1002D6F5
                                                                                                                                                                                      • SysAllocString.OLEAUT32(00000000), ref: 1002D724
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AllocString$H_prolog3_memset
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 842698744-0
                                                                                                                                                                                      • Opcode ID: 508acb920ccba7a207f47e88a798d4189b9ed575a01c86aa1581d938c190cd50
                                                                                                                                                                                      • Instruction ID: 4ca028c9b4d427f08f2d669533113988f62624cee2fc7606aac8abf48e723189
                                                                                                                                                                                      • Opcode Fuzzy Hash: 508acb920ccba7a207f47e88a798d4189b9ed575a01c86aa1581d938c190cd50
                                                                                                                                                                                      • Instruction Fuzzy Hash: E9414A34900304CFDB24EFB8D891AADB7B5EF04314F50852EF9659B2A2DB74A854CF55
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100169E1 Relevance: 9.1, APIs: 6, Instructions: 115threadwindowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 10016936: GetParent.USER32(100010EC), ref: 10016989
                                                                                                                                                                                        • Part of subcall function 10016936: GetLastActivePopup.USER32(100010EC), ref: 10016998
                                                                                                                                                                                        • Part of subcall function 10016936: IsWindowEnabled.USER32(100010EC), ref: 100169AD
                                                                                                                                                                                        • Part of subcall function 10016936: EnableWindow.USER32(100010EC,00000000), ref: 100169C0
                                                                                                                                                                                      • EnableWindow.USER32(?,00000001), ref: 10016A2E
                                                                                                                                                                                      • GetWindowThreadProcessId.USER32(?,?), ref: 10016A3C
                                                                                                                                                                                      • GetCurrentProcessId.KERNEL32 ref: 10016A46
                                                                                                                                                                                      • SendMessageA.USER32 ref: 10016A5B
                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 10016AD8
                                                                                                                                                                                      • EnableWindow.USER32(?,00000001), ref: 10016B14
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Window$Enable$Process$ActiveCurrentEnabledFileLastMessageModuleNameParentPopupSendThread
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1877664794-0
                                                                                                                                                                                      • Opcode ID: f56e269d1f7720d56fa1c58fd8a6d78852bfdb5100da494152acd8aedeab4fb9
                                                                                                                                                                                      • Instruction ID: f13ef48dc5fb0c484cec2fa7b3f992f2dc6d3b1b42596072abe369902371925a
                                                                                                                                                                                      • Opcode Fuzzy Hash: f56e269d1f7720d56fa1c58fd8a6d78852bfdb5100da494152acd8aedeab4fb9
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3B415B72A00258DBEB20CFA4CC81BDD76A8EF09350F614119E949AB281E770D9848F52
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10016936 Relevance: 9.1, APIs: 6, Instructions: 68COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetWindowLongA.USER32 ref: 10016968
                                                                                                                                                                                      • GetParent.USER32(100010EC), ref: 10016976
                                                                                                                                                                                      • GetParent.USER32(100010EC), ref: 10016989
                                                                                                                                                                                      • GetLastActivePopup.USER32(100010EC), ref: 10016998
                                                                                                                                                                                      • IsWindowEnabled.USER32(100010EC), ref: 100169AD
                                                                                                                                                                                      • EnableWindow.USER32(100010EC,00000000), ref: 100169C0
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 670545878-0
                                                                                                                                                                                      • Opcode ID: 0556ac702c88567a1be081abf13cc9cce852e4592f4cca89957eeb32636ff491
                                                                                                                                                                                      • Instruction ID: 154aafdfd528b469a8bf80fc48512ff59873e22bfc4d6b8fcadc8b05587993e6
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0556ac702c88567a1be081abf13cc9cce852e4592f4cca89957eeb32636ff491
                                                                                                                                                                                      • Instruction Fuzzy Hash: D111A57260133697D661DB698E80B1BB6ECDF9EAE1F120115ED00EF254EB70DC808696
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10020559 Relevance: 9.0, APIs: 6, Instructions: 45COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Window$Rect$ClientCtrlLongScreen
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1315500227-0
                                                                                                                                                                                      • Opcode ID: 6e799736a4181f77db8ba904b29fc337daefc7dc264e49bf5415e2b3170b0d90
                                                                                                                                                                                      • Instruction ID: 9197e044a219b4c4c22350dcb983fe24fb7029e94376554506d026f7e511957d
                                                                                                                                                                                      • Opcode Fuzzy Hash: 6e799736a4181f77db8ba904b29fc337daefc7dc264e49bf5415e2b3170b0d90
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3B01A235501739EBEB11DF549C48E9F3BADEF4A791F404011FD10D2061E730DA018B99
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1001D992 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 234COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _memset
                                                                                                                                                                                      • String ID: @$@$AfxFrameOrView80s$AfxMDIFrame80s
                                                                                                                                                                                      • API String ID: 2102423945-4122032997
                                                                                                                                                                                      • Opcode ID: 34855274ca0ecd676c0cb297c8efdd531dfb4bca4f276cdc03237f3f296c8161
                                                                                                                                                                                      • Instruction ID: bbe41a20c7329c8f9bdc0efe2c46215e461a01fcfe5e7bc54fed728f21783543
                                                                                                                                                                                      • Opcode Fuzzy Hash: 34855274ca0ecd676c0cb297c8efdd531dfb4bca4f276cdc03237f3f296c8161
                                                                                                                                                                                      • Instruction Fuzzy Hash: B0816076D04219AADB40EFA4D481BDEBBF8EF04384F518566F909EB181E774DAC4CB90
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10021D88 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 126stringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GlobalLock.KERNEL32 ref: 10021DB2
                                                                                                                                                                                      • lstrlenA.KERNEL32(?), ref: 10021DFA
                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000020), ref: 10021E14
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ByteCharGlobalLockMultiWidelstrlen
                                                                                                                                                                                      • String ID: System
                                                                                                                                                                                      • API String ID: 1529587224-3470857405
                                                                                                                                                                                      • Opcode ID: 33974d9c05b04c687ac20437ddad08aa00536e5ed05beed44e1f4e08908d61b5
                                                                                                                                                                                      • Instruction ID: 0e81d0f59cd66082c3aa20aff96d3ec22f48ed16ea157d431ad3d5bc96dc32b7
                                                                                                                                                                                      • Opcode Fuzzy Hash: 33974d9c05b04c687ac20437ddad08aa00536e5ed05beed44e1f4e08908d61b5
                                                                                                                                                                                      • Instruction Fuzzy Hash: B441C275900215DFDF14CFA4DD85AEEBBB5EF14310F51822AE802DB285EB70A946CB50
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100233C4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 98libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3_GS.LIBCMT ref: 100233CB
                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(?,1004B63C,00000000,?), ref: 10023496
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,MFCM80ReleaseManagedReferences), ref: 100234A6
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AddressH_prolog3_HandleModuleProc
                                                                                                                                                                                      • String ID: MFCM80ReleaseManagedReferences$mfcm80.dll
                                                                                                                                                                                      • API String ID: 2418878492-2500072749
                                                                                                                                                                                      • Opcode ID: b0e0a0a37f3552f3ecb8dafd0a082c9c0df66c75591a9635effa9e0eee7a218d
                                                                                                                                                                                      • Instruction ID: 416d3485c59068a364c2a46f33bf17d30033b20eabc5154db7a9307924c289c3
                                                                                                                                                                                      • Opcode Fuzzy Hash: b0e0a0a37f3552f3ecb8dafd0a082c9c0df66c75591a9635effa9e0eee7a218d
                                                                                                                                                                                      • Instruction Fuzzy Hash: 45318F74A006449FCF06EFA0D8957AD77F9EF48300F914098E905EB292DB78EE04CB55
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10015723 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetMenuCheckMarkDimensions.USER32 ref: 1001573B
                                                                                                                                                                                      • _memset.LIBCMT ref: 1001579D
                                                                                                                                                                                      • CreateBitmap.GDI32(?,?,00000001,00000001,?), ref: 100157EF
                                                                                                                                                                                      • LoadBitmapA.USER32 ref: 10015807
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Bitmap$CheckCreateDimensionsLoadMarkMenu_memset
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 4271682439-3916222277
                                                                                                                                                                                      • Opcode ID: 0828224e24eec93523923ff328a5ceada98e4d45539c90ba39b5b31778de99bb
                                                                                                                                                                                      • Instruction ID: fd313e63bbbbf4de8925541e866d87c57cd6a5f11e69b9eb671f3de319ba3105
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0828224e24eec93523923ff328a5ceada98e4d45539c90ba39b5b31778de99bb
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2831C072A00216DFEB10CF78DDCAAAE7BB5EB44645F15052AE506EF2C1E631E9448750
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10023B21 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92comCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3_GS.LIBCMT ref: 10023B2B
                                                                                                                                                                                      • GetObjectA.GDI32(100188B8,0000003C,?), ref: 10023B7D
                                                                                                                                                                                      • GetDeviceCaps.GDI32(?,0000005A), ref: 10023BED
                                                                                                                                                                                      • OleCreateFontIndirect.OLEAUT32(00000020,1004B6CC), ref: 10023C19
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CapsCreateDeviceFontH_prolog3_IndirectObject
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2429671754-3916222277
                                                                                                                                                                                      • Opcode ID: 0b083a6c98d2b7d8e028f34a6b6374e6a807bb31420a17051dfa8a45a9cb4bd1
                                                                                                                                                                                      • Instruction ID: e2743fe1d96de1c748b152781f443ff04db9fb8b7a9177862e5f836bc5268938
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0b083a6c98d2b7d8e028f34a6b6374e6a807bb31420a17051dfa8a45a9cb4bd1
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5A41AD38D01289DEDB11CFE4D951ADDFBF4EF18340F20816AE945EB292EB749A44CB11
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10018D05 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • SystemParametersInfoA.USER32(00000030,00000000,00000000,00000000), ref: 10018D43
                                                                                                                                                                                      • GetSystemMetrics.USER32 ref: 10018D5B
                                                                                                                                                                                      • GetSystemMetrics.USER32 ref: 10018D62
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: System$Metrics$InfoParameters
                                                                                                                                                                                      • String ID: B$DISPLAY
                                                                                                                                                                                      • API String ID: 3136151823-3316187204
                                                                                                                                                                                      • Opcode ID: 01d6d3f2a82c9fc94354165a46392fa9fba4dc51678a518b48c06610c97029f8
                                                                                                                                                                                      • Instruction ID: a878fcb1cedf1c60654c719a4428af0d7f153658fed9e58891951680bc1a7591
                                                                                                                                                                                      • Opcode Fuzzy Hash: 01d6d3f2a82c9fc94354165a46392fa9fba4dc51678a518b48c06610c97029f8
                                                                                                                                                                                      • Instruction Fuzzy Hash: 7F119471900334EBDF11DF54AC8465A7BA8EF1A794F004061FE08AE086D270DB40CBD1
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10016D6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID: Edit
                                                                                                                                                                                      • API String ID: 0-554135844
                                                                                                                                                                                      • Opcode ID: aeba8321252689d607d43ce831c94e9037d76912a5b48d9cd96901cd2708aa45
                                                                                                                                                                                      • Instruction ID: d7da207644b64a2d982eb74dcfc255ba7c8492391b78acd90f64b6ebdbaccf44
                                                                                                                                                                                      • Opcode Fuzzy Hash: aeba8321252689d607d43ce831c94e9037d76912a5b48d9cd96901cd2708aa45
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5401C034B00222ABEA50DA35DC45B5AB6F9EF4E795F120524F512EE0A1DF70ECC1C666
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10023C5A Relevance: 7.6, APIs: 5, Instructions: 108windowthreadCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3.LIBCMT ref: 10023C61
                                                                                                                                                                                      • SendMessageA.USER32 ref: 10023CD9
                                                                                                                                                                                      • GetBkColor.GDI32(?), ref: 10023CE2
                                                                                                                                                                                      • GetTextColor.GDI32(?), ref: 10023CEE
                                                                                                                                                                                      • GetThreadLocale.KERNEL32(0000F1C0,00000000,?,?,00000014), ref: 10023D80
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Color$H_prolog3LocaleMessageSendTextThread
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 187318432-0
                                                                                                                                                                                      • Opcode ID: 22d64082b81602bfd0fc9dbcb24da953966e1acb36a79bd38355d93537422c11
                                                                                                                                                                                      • Instruction ID: d28fad7a3843e667b269742353e4bf680cf5f7ebce9377355bc1d9e2da6f7a14
                                                                                                                                                                                      • Opcode Fuzzy Hash: 22d64082b81602bfd0fc9dbcb24da953966e1acb36a79bd38355d93537422c11
                                                                                                                                                                                      • Instruction Fuzzy Hash: 99416A38400746DFCB20DF64D845A9EB7F1FF08310F618959F9969B2A1EB74E941CB51
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10016461 Relevance: 7.6, APIs: 5, Instructions: 75registryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3_catch.LIBCMT ref: 10016480
                                                                                                                                                                                      • RegOpenKeyA.ADVAPI32(?,00000000,?), ref: 1001649F
                                                                                                                                                                                      • RegEnumKeyA.ADVAPI32(?,00000000,00000000,00000104), ref: 100164BD
                                                                                                                                                                                      • RegDeleteKeyA.ADVAPI32(?,?), ref: 10016538
                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?), ref: 10016543
                                                                                                                                                                                        • Part of subcall function 10013820: _DebugHeapAllocator.LIBCPMTD ref: 10013875
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AllocatorCloseDebugDeleteEnumH_prolog3_catchHeapOpen
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 69039007-0
                                                                                                                                                                                      • Opcode ID: 0669dfe3de0cc61b0444232be26762e4236a4070ce21c008c0579ea5e657dd0e
                                                                                                                                                                                      • Instruction ID: 2ee7fd04e7e526f2a2658ba16ac7fadb449e12f7dad9b6db0157347413a913f7
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0669dfe3de0cc61b0444232be26762e4236a4070ce21c008c0579ea5e657dd0e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3A21D075D0025ADBDB21CB94CC416EEB7B0EF08350F10412AED41AB290EB30AE84DBA1
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002B3A9 Relevance: 7.6, APIs: 5, Instructions: 58COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetMapMode.GDI32(?,?,?,?,?,?,100255DA,?,00000000,0000001C,10025F48,?,?,?,?,?), ref: 1002B3B9
                                                                                                                                                                                      • GetDeviceCaps.GDI32(?,00000058), ref: 1002B3F3
                                                                                                                                                                                      • GetDeviceCaps.GDI32(?,0000005A), ref: 1002B3FC
                                                                                                                                                                                        • Part of subcall function 1001ED4C: MulDiv.KERNEL32(?,00000000,00000000), ref: 1001ED8C
                                                                                                                                                                                        • Part of subcall function 1001ED4C: MulDiv.KERNEL32(?,00000000,00000000), ref: 1001EDA9
                                                                                                                                                                                      • MulDiv.KERNEL32(?,000009EC,00000060), ref: 1002B420
                                                                                                                                                                                      • MulDiv.KERNEL32(00000000,000009EC,?), ref: 1002B42B
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CapsDevice$Mode
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 696222070-0
                                                                                                                                                                                      • Opcode ID: ad45f33bd95501225e01621eadf3d29f248a2335d01e386e7c92b4ca8057da2f
                                                                                                                                                                                      • Instruction ID: 63e99b0baf6d5dcfdd2b5bb48b7ec33f4fcd9c2a57d1919fdecc035dbf7e745c
                                                                                                                                                                                      • Opcode Fuzzy Hash: ad45f33bd95501225e01621eadf3d29f248a2335d01e386e7c92b4ca8057da2f
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2D110E71600A14EFDB21AF55CC84C0EBBE9EF89350B514829FA8597361DB31ED01CF90
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002B437 Relevance: 7.6, APIs: 5, Instructions: 58COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetMapMode.GDI32(?,00000000,?,?,?,?,1002561E,?,?,?,?,?,?), ref: 1002B447
                                                                                                                                                                                      • GetDeviceCaps.GDI32(?,00000058), ref: 1002B481
                                                                                                                                                                                      • GetDeviceCaps.GDI32(?,0000005A), ref: 1002B48A
                                                                                                                                                                                        • Part of subcall function 1001ECE3: MulDiv.KERNEL32(?,00000000,00000000), ref: 1001ED23
                                                                                                                                                                                        • Part of subcall function 1001ECE3: MulDiv.KERNEL32(?,00000000,00000000), ref: 1001ED40
                                                                                                                                                                                      • MulDiv.KERNEL32(?,00000060,000009EC), ref: 1002B4AE
                                                                                                                                                                                      • MulDiv.KERNEL32(00000000,?,000009EC), ref: 1002B4B9
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CapsDevice$Mode
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 696222070-0
                                                                                                                                                                                      • Opcode ID: 6f199a3495fbdd21d567dc82426adb66683fca9deaa291746216ef97ded9c58c
                                                                                                                                                                                      • Instruction ID: 3f65263faca37ec2066e18a28c5c11a55be6ae6448755079bbf75ecdaa8dd8b2
                                                                                                                                                                                      • Opcode Fuzzy Hash: 6f199a3495fbdd21d567dc82426adb66683fca9deaa291746216ef97ded9c58c
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2511CE75600A14EFDB21AF55CC84C1EBBEAEF89750B118819FA8597361DB31EC01DB90
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100203DD Relevance: 7.6, APIs: 5, Instructions: 53stringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • lstrlenA.KERNEL32(?), ref: 10020407
                                                                                                                                                                                      • _memset.LIBCMT ref: 10020424
                                                                                                                                                                                      • GetWindowTextA.USER32 ref: 1002043E
                                                                                                                                                                                      • lstrcmpA.KERNEL32(00000000,?), ref: 10020450
                                                                                                                                                                                      • SetWindowTextA.USER32(?,?), ref: 1002045C
                                                                                                                                                                                        • Part of subcall function 100201F1: __CxxThrowException@8.LIBCMT ref: 10020205
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: TextWindow$Exception@8Throw_memsetlstrcmplstrlen
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 289641511-0
                                                                                                                                                                                      • Opcode ID: 77b0c5cd9ac0cc3ff83a367ab42858fc436f0c74e7fc05fbf85526c4b9223b41
                                                                                                                                                                                      • Instruction ID: 8c1f3c136944a2c7f84d91cd4eaa34ef9436e2c15ebeed6ca137d0836ccfc0fa
                                                                                                                                                                                      • Opcode Fuzzy Hash: 77b0c5cd9ac0cc3ff83a367ab42858fc436f0c74e7fc05fbf85526c4b9223b41
                                                                                                                                                                                      • Instruction Fuzzy Hash: CE01DBB5600314A7E711DF64DDC4BDF77ADEB19341F408065F646D3142EAB09E448B61
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10012890 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 123COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 100134C0: GetSystemMenu.USER32(?,00000000,?,?,100128CA,00000000,669449D7), ref: 100134D2
                                                                                                                                                                                      • GetWindowLongA.USER32 ref: 1001295E
                                                                                                                                                                                      • SetWindowLongA.USER32 ref: 10012989
                                                                                                                                                                                        • Part of subcall function 10013460: AppendMenuA.USER32 ref: 1001347A
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: LongMenuWindow$AppendSystem
                                                                                                                                                                                      • String ID: 192.168.3.85$Message
                                                                                                                                                                                      • API String ID: 4121476972-856608562
                                                                                                                                                                                      • Opcode ID: 3a485f645eb87c5dda0d91dee484213725162975b6f285bf4b629bdff528d801
                                                                                                                                                                                      • Instruction ID: 340d0da2b4c657a0b825359f55c53a9166b08011863532f0c2811cf24d97780a
                                                                                                                                                                                      • Opcode Fuzzy Hash: 3a485f645eb87c5dda0d91dee484213725162975b6f285bf4b629bdff528d801
                                                                                                                                                                                      • Instruction Fuzzy Hash: F2411B74A4020A9BDB04DB94CCA2FBFB771EF44714F108228F5226F2D2DB75A945CB54
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1001C1A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39libraryloaderCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 10020E5D: EnterCriticalSection.KERNEL32(10057798,?,?,?,?,1002074A,00000010,00000008,1001FA2A,1001F9CD,10015B30,1001555B,?,10015D3C,00000004,10015139), ref: 10020E99
                                                                                                                                                                                        • Part of subcall function 10020E5D: InitializeCriticalSection.KERNEL32(?,?,?,?,?,1002074A,00000010,00000008,1001FA2A,1001F9CD,10015B30,1001555B,?,10015D3C,00000004,10015139), ref: 10020EA8
                                                                                                                                                                                        • Part of subcall function 10020E5D: LeaveCriticalSection.KERNEL32(10057798,?,?,?,?,1002074A,00000010,00000008,1001FA2A,1001F9CD,10015B30,1001555B,?,10015D3C,00000004,10015139), ref: 10020EB5
                                                                                                                                                                                        • Part of subcall function 10020E5D: EnterCriticalSection.KERNEL32(?,?,?,?,?,1002074A,00000010,00000008,1001FA2A,1001F9CD,10015B30,1001555B,?,10015D3C,00000004,10015139), ref: 10020EC1
                                                                                                                                                                                        • Part of subcall function 1002072F: __EH_prolog3_catch.LIBCMT ref: 10020736
                                                                                                                                                                                        • Part of subcall function 100201F1: __CxxThrowException@8.LIBCMT ref: 10020205
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,HtmlHelpA), ref: 1001C1E4
                                                                                                                                                                                      • FreeLibrary.KERNEL32(?), ref: 1001C1F4
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CriticalSection$Enter$AddressException@8FreeH_prolog3_catchInitializeLeaveLibraryProcThrow
                                                                                                                                                                                      • String ID: HtmlHelpA$hhctrl.ocx
                                                                                                                                                                                      • API String ID: 3274081130-63838506
                                                                                                                                                                                      • Opcode ID: c4ff01ed609920668b45cb7a661f9e4cbf771a6b1ff00103ddf750d8f10613a5
                                                                                                                                                                                      • Instruction ID: 160066d18b9ed5655b72b10460cb3280c451ea5be833735a295996cf30cd07f4
                                                                                                                                                                                      • Opcode Fuzzy Hash: c4ff01ed609920668b45cb7a661f9e4cbf771a6b1ff00103ddf750d8f10613a5
                                                                                                                                                                                      • Instruction Fuzzy Hash: AB01F431044706EFE721DFA0AE06F4B7AD5FF04B42F114819F48B98452D770E890AA26
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1003CB01 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(KERNEL32,10033B0B), ref: 1003CB06
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 1003CB16
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AddressHandleModuleProc
                                                                                                                                                                                      • String ID: IsProcessorFeaturePresent$KERNEL32
                                                                                                                                                                                      • API String ID: 1646373207-3105848591
                                                                                                                                                                                      • Opcode ID: dc24b012ca1fb4bb896a1dc56100cb90a959cbbb7befe9f8aa549c159bb80eea
                                                                                                                                                                                      • Instruction ID: 56947a08a2dfe052dc663468ef672e03bc5ef0643ca607e86d2238c745675855
                                                                                                                                                                                      • Opcode Fuzzy Hash: dc24b012ca1fb4bb896a1dc56100cb90a959cbbb7befe9f8aa549c159bb80eea
                                                                                                                                                                                      • Instruction Fuzzy Hash: EDF0362090091DE6EF01AFA1AD4969F7A74FB45747F510594E592F0094EF7081B49356
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100026D0 Relevance: 6.4, APIs: 5, Instructions: 118COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • SetLastError.KERNEL32(0000007F), ref: 100026FF
                                                                                                                                                                                      • SetLastError.KERNEL32(0000007F), ref: 1000272B
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ErrorLast
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1452528299-0
                                                                                                                                                                                      • Opcode ID: c9d272d6c554433b4f74cd5ef5cb02bf0863a661864ac41ad17d6d3c26d06b94
                                                                                                                                                                                      • Instruction ID: 8e64829365f1e03862022e03b3a1730166a9b8a5af119672a2ae158ec68dc0e1
                                                                                                                                                                                      • Opcode Fuzzy Hash: c9d272d6c554433b4f74cd5ef5cb02bf0863a661864ac41ad17d6d3c26d06b94
                                                                                                                                                                                      • Instruction Fuzzy Hash: 15511774E0411AEFEB04CF94C980AAEB7F1FF48344F208568E819AB345D774EA41DB91
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10028638 Relevance: 6.3, APIs: 4, Instructions: 309memoryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3.LIBCMT ref: 10028651
                                                                                                                                                                                      • CoTaskMemAlloc.OLE32(?,?), ref: 1002876F
                                                                                                                                                                                      • _memset.LIBCMT ref: 10028791
                                                                                                                                                                                      • CoTaskMemFree.OLE32(?), ref: 1002896D
                                                                                                                                                                                        • Part of subcall function 100144EC: _malloc.LIBCMT ref: 10014506
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Task$AllocFreeH_prolog3_malloc_memset
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2459298410-0
                                                                                                                                                                                      • Opcode ID: 56213c16b803c0e3796c36805e348e495a167a55b28ccf8aaf43ce70b74c7790
                                                                                                                                                                                      • Instruction ID: 01fa38cd0bce2764ee9a58647bdb5924a3a29805fe2f500651f730ac49990a2b
                                                                                                                                                                                      • Opcode Fuzzy Hash: 56213c16b803c0e3796c36805e348e495a167a55b28ccf8aaf43ce70b74c7790
                                                                                                                                                                                      • Instruction Fuzzy Hash: A9C14878601709EFCB14CF68D884AAEB7F5FF88304B648919F856CB291DB71EA41CB50
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100294E4 Relevance: 6.2, APIs: 4, Instructions: 186COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3.LIBCMT ref: 100294EB
                                                                                                                                                                                      • VariantClear.OLEAUT32(?), ref: 100295AF
                                                                                                                                                                                      • CoTaskMemFree.OLE32(?,00000010), ref: 1002965C
                                                                                                                                                                                      • CoTaskMemFree.OLE32(?,00000010), ref: 1002966A
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: FreeTask$ClearH_prolog3Variant
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 365290523-0
                                                                                                                                                                                      • Opcode ID: f4bb32272e54c4630c0f1c2b8213bbcb586b41b40c6f53f6c8fe32820d3a87b6
                                                                                                                                                                                      • Instruction ID: 6dfbb0beff937a9ff07d9f1090c18b3058f0abcc9665a1e5acd726f5cd97e7a7
                                                                                                                                                                                      • Opcode Fuzzy Hash: f4bb32272e54c4630c0f1c2b8213bbcb586b41b40c6f53f6c8fe32820d3a87b6
                                                                                                                                                                                      • Instruction Fuzzy Hash: 6D711775A00A52CFCB60CFA4D9D892AB7F5FF483447A1086DE1469B661CB31EC84CB50
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002910E Relevance: 6.2, APIs: 4, Instructions: 173windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Window$Rect$DesktopVisible
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1055025324-0
                                                                                                                                                                                      • Opcode ID: 935237afc4adc895a68147513c1bf8892873bb4cd96f085db3d98f84c1cebb7e
                                                                                                                                                                                      • Instruction ID: 30a46d7291c636a93fdcae379f64361bdaca7d323e8f19b7ddc13159497105e4
                                                                                                                                                                                      • Opcode Fuzzy Hash: 935237afc4adc895a68147513c1bf8892873bb4cd96f085db3d98f84c1cebb7e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0751E875A0051AEFCB04EFA8DD84CAEB7B9FF48244B614458F515EB255C731EE44CB60
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002C6D0 Relevance: 6.1, APIs: 4, Instructions: 132timeCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • _memset.LIBCMT ref: 1002C6E7
                                                                                                                                                                                        • Part of subcall function 1001DCEA: _wctomb_s.LIBCMT ref: 1001DCFA
                                                                                                                                                                                      • GetFileTime.KERNEL32(?,?,?,?), ref: 1002C71E
                                                                                                                                                                                      • GetFileSize.KERNEL32(?,00000000), ref: 1002C733
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: File$SizeTime_memset_wctomb_s
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 26245289-0
                                                                                                                                                                                      • Opcode ID: 7b2a999f3c33549589a606ce6b98c8e8e242c4bbabb886e5bb6986c1362b8808
                                                                                                                                                                                      • Instruction ID: d07d59a7ff7176791715ff84f3171322556d45097dda904751fff30d64e08997
                                                                                                                                                                                      • Opcode Fuzzy Hash: 7b2a999f3c33549589a606ce6b98c8e8e242c4bbabb886e5bb6986c1362b8808
                                                                                                                                                                                      • Instruction Fuzzy Hash: 32411B755046199FC724DFA8D981C9AB7F8FF093A07508A2EE5A6D3690E730F944CF50
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1001E262 Relevance: 6.1, APIs: 4, Instructions: 103windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSend
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3850602802-0
                                                                                                                                                                                      • Opcode ID: 19518e3b86100b37808dce19ac351571687518489287765c305fecf2a5902a3e
                                                                                                                                                                                      • Instruction ID: f22ebcd49f6c4bcf1cb84aabd9b6e0a9805a11e2c96a6edef58545e6592a584a
                                                                                                                                                                                      • Opcode Fuzzy Hash: 19518e3b86100b37808dce19ac351571687518489287765c305fecf2a5902a3e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 05318F70500259FFDB15DF51C889EAE7BA9EF05790F10806AF90A8F251DA30EEC0DBA0
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1003E161 Relevance: 6.1, APIs: 4, Instructions: 101COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 1003E191
                                                                                                                                                                                      • __isleadbyte_l.LIBCMT ref: 1003E1C5
                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,A045FF98,?,00000000,00000000,?,00000000,1003E760,?,?,00000002), ref: 1003E1F6
                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,?,00000000,00000000,?,00000000,1003E760,?,?,00000002), ref: 1003E264
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3058430110-0
                                                                                                                                                                                      • Opcode ID: a45d194493aaf76ac1cbb866e4ff6e90a1da533cdec724975968ec5ddac79853
                                                                                                                                                                                      • Instruction ID: 9e7ca2975dce83e2c1685c00030f8d0177b945f551d5a1751bafc6038c684fbd
                                                                                                                                                                                      • Opcode Fuzzy Hash: a45d194493aaf76ac1cbb866e4ff6e90a1da533cdec724975968ec5ddac79853
                                                                                                                                                                                      • Instruction Fuzzy Hash: 23317C31A00296EFDB12CFA4CC849AA7BE9FF05352F168669E8608F1D1D330AD40DB51
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10026509 Relevance: 6.1, APIs: 4, Instructions: 91COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3.LIBCMT ref: 10026510
                                                                                                                                                                                        • Part of subcall function 100201F1: __CxxThrowException@8.LIBCMT ref: 10020205
                                                                                                                                                                                      • GetDC.USER32(?), ref: 1002658E
                                                                                                                                                                                      • IntersectRect.USER32 ref: 100265C8
                                                                                                                                                                                      • CreateRectRgnIndirect.GDI32(?), ref: 100265D2
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Rect$CreateException@8H_prolog3IndirectIntersectThrow
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3511876931-0
                                                                                                                                                                                      • Opcode ID: 7f6c9fa0e8688ea19043668f2c8dfda2f995fd9ab5cfcbe19950409bb8c584bc
                                                                                                                                                                                      • Instruction ID: 5a52d3282697d26d7181906baa499751bc8b7848460d4ff7fbcd99527b494316
                                                                                                                                                                                      • Opcode Fuzzy Hash: 7f6c9fa0e8688ea19043668f2c8dfda2f995fd9ab5cfcbe19950409bb8c584bc
                                                                                                                                                                                      • Instruction Fuzzy Hash: 71315D71D0062ADFCF01CFA4C989ADEBBB5FF08300F614459F915AB155D774AA81CBA1
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100211EE Relevance: 6.1, APIs: 4, Instructions: 88COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: __msize_malloc
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1288803200-0
                                                                                                                                                                                      • Opcode ID: 172559e824c18d3cfeedd4486189817d6fbc1f914f9a457cc390fc68d8836e76
                                                                                                                                                                                      • Instruction ID: b47b26af396fa43851c5e16859074de777cbaf7baa699ca6a99f78ce61545289
                                                                                                                                                                                      • Opcode Fuzzy Hash: 172559e824c18d3cfeedd4486189817d6fbc1f914f9a457cc390fc68d8836e76
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0921C138100210DFCB59DF64F881AEE77D5EF20690B908629F858CA246DB34ECA4CB80
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100160A8 Relevance: 6.1, APIs: 4, Instructions: 76synchronizationCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3_catch.LIBCMT ref: 100160AF
                                                                                                                                                                                        • Part of subcall function 10015F7F: GetCurrentThreadId.KERNEL32 ref: 10015F92
                                                                                                                                                                                        • Part of subcall function 10015F7F: SetWindowsHookExA.USER32 ref: 10015FA2
                                                                                                                                                                                      • SetEvent.KERNEL32(?,00000060), ref: 1001615C
                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,000000FF), ref: 10016165
                                                                                                                                                                                      • CloseHandle.KERNEL32(?), ref: 1001616C
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CloseCurrentEventH_prolog3_catchHandleHookObjectSingleThreadWaitWindows
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1532457625-0
                                                                                                                                                                                      • Opcode ID: aba3a14f37cb35c8a4256fe786ec03d8f5582434084a49b38ed0d3b5c255888d
                                                                                                                                                                                      • Instruction ID: 49adf720413ee406403ea303cbd260c8a37cc91a4464af3b062c384fe739287e
                                                                                                                                                                                      • Opcode Fuzzy Hash: aba3a14f37cb35c8a4256fe786ec03d8f5582434084a49b38ed0d3b5c255888d
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9B312A38A00646EFCB14EFA4CE9595DBBB0FF08311B15466CE5569F2A2DB30FA81CB51
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10022C16 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • CharNextA.USER32(?), ref: 10022C6D
                                                                                                                                                                                        • Part of subcall function 10033A93: __ismbcspace_l.LIBCMT ref: 10033A99
                                                                                                                                                                                      • CharNextA.USER32(00000000), ref: 10022C8A
                                                                                                                                                                                      • _strtol.LIBCMT ref: 10022CB5
                                                                                                                                                                                      • _strtoul.LIBCMT ref: 10022CBC
                                                                                                                                                                                        • Part of subcall function 100338D4: strtoxl.LIBCMT ref: 100338F4
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CharNext$__ismbcspace_l_strtol_strtoulstrtoxl
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 4211061542-0
                                                                                                                                                                                      • Opcode ID: c0131c4ce0529d7fd5e33596a62ab6746ae30cca9c8134ef8296b597ce6c539f
                                                                                                                                                                                      • Instruction ID: 5151050668a075cb653ef24e642dff21439099837a3a94c33d4a4bfb9d6c905b
                                                                                                                                                                                      • Opcode Fuzzy Hash: c0131c4ce0529d7fd5e33596a62ab6746ae30cca9c8134ef8296b597ce6c539f
                                                                                                                                                                                      • Instruction Fuzzy Hash: 352127755002556FDB21DFB49C81BAEB7F8DF48241FA14066F984D7240DB709D40CBA1
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10027B2E Relevance: 6.1, APIs: 4, Instructions: 70COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ArrayDestroyFreeSafeTask
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3253174383-0
                                                                                                                                                                                      • Opcode ID: 3972c6b8702509201bc2289ccb81f4c02271859ab5e073d977715a4d6fe1d911
                                                                                                                                                                                      • Instruction ID: 529fdc980b661751dfd2f1e67b0f163afa7902daf74f578c55dc250feead27ea
                                                                                                                                                                                      • Opcode Fuzzy Hash: 3972c6b8702509201bc2289ccb81f4c02271859ab5e073d977715a4d6fe1d911
                                                                                                                                                                                      • Instruction Fuzzy Hash: 71117930201206EBDF66DF65EC88B6A7BE8FF05796B914458FC99CB250DB31ED01CA64
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100266ED Relevance: 6.1, APIs: 4, Instructions: 67COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Rect$EqualH_prolog3Intersect
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2161412305-0
                                                                                                                                                                                      • Opcode ID: f39b3bfbb9b8fe3bd79ee9f08207123a737bade4225fe621e8dcddae7340d759
                                                                                                                                                                                      • Instruction ID: ff5c973b4bb1c2d03ca17daa0168de659ad61ff9b2eaf64daf92020a6b0172b0
                                                                                                                                                                                      • Opcode Fuzzy Hash: f39b3bfbb9b8fe3bd79ee9f08207123a737bade4225fe621e8dcddae7340d759
                                                                                                                                                                                      • Instruction Fuzzy Hash: D621367590024AEFCB01DFA4DD849EEBBB8FF08240F50856AF915A7111DB34AA05DB61
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1001FCED Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3.LIBCMT ref: 1001FCF4
                                                                                                                                                                                        • Part of subcall function 100144EC: _malloc.LIBCMT ref: 10014506
                                                                                                                                                                                      • __CxxThrowException@8.LIBCMT ref: 1001FD2A
                                                                                                                                                                                      • FormatMessageA.KERNEL32(00001100,00000000,00000000,00000800,8007000E,00000000,00000000,00000000,?,8007000E,1004F158,00000004,10013BBC,8007000E), ref: 1001FD53
                                                                                                                                                                                        • Part of subcall function 1001DCEA: _wctomb_s.LIBCMT ref: 1001DCFA
                                                                                                                                                                                      • LocalFree.KERNEL32(8007000E,8007000E), ref: 1001FD7C
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Exception@8FormatFreeH_prolog3LocalMessageThrow_malloc_wctomb_s
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1615547351-0
                                                                                                                                                                                      • Opcode ID: 7e5ced4c9e2eb0c702982f1f92c1bbdd58b98f1cb347c47c5882039fca099ce7
                                                                                                                                                                                      • Instruction ID: 02293aacd12bdd5b71dc2e1620005b8d21a8bb506af1f41bdeabb16afe14deca
                                                                                                                                                                                      • Opcode Fuzzy Hash: 7e5ced4c9e2eb0c702982f1f92c1bbdd58b98f1cb347c47c5882039fca099ce7
                                                                                                                                                                                      • Instruction Fuzzy Hash: C0118675504249FFDB05DFA4DC819BE3BA9FB08350F118929F915CE2A1E631DA50C754
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10017081 Relevance: 6.1, APIs: 4, Instructions: 57COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • FindResourceA.KERNEL32(?,00000000,00000005), ref: 100170A7
                                                                                                                                                                                      • LoadResource.KERNEL32(?,00000000), ref: 100170AF
                                                                                                                                                                                      • LockResource.KERNEL32(00000000), ref: 100170C1
                                                                                                                                                                                      • FreeResource.KERNEL32(00000000), ref: 1001710B
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Resource$FindFreeLoadLock
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1078018258-0
                                                                                                                                                                                      • Opcode ID: 11e397817ce9c23df1d0d820314bfc405a5ae10b9211d558aa096ea116c59da1
                                                                                                                                                                                      • Instruction ID: b090516e65dfb2cc0079b63036416f790ce173b21e3ea297a20d0f4a61f138d4
                                                                                                                                                                                      • Opcode Fuzzy Hash: 11e397817ce9c23df1d0d820314bfc405a5ae10b9211d558aa096ea116c59da1
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0A11DA34600B61FBC711DF68CD88AAAB3B4FB08295F118119E8468B550E3B0ED80D6A0
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10015123 Relevance: 6.1, APIs: 4, Instructions: 56threadCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __EH_prolog3.LIBCMT ref: 1001512A
                                                                                                                                                                                        • Part of subcall function 10015D26: __EH_prolog3.LIBCMT ref: 10015D2D
                                                                                                                                                                                      • __strdup.LIBCMT ref: 1001514C
                                                                                                                                                                                      • GetCurrentThread.KERNEL32 ref: 10015179
                                                                                                                                                                                      • GetCurrentThreadId.KERNEL32 ref: 10015182
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CurrentH_prolog3Thread$__strdup
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 4206445780-0
                                                                                                                                                                                      • Opcode ID: d6edc2b71ccf17cf47a4ad25d9b10d29dc33f6072b75531269d3699570e9d83c
                                                                                                                                                                                      • Instruction ID: 8b11c4afa576c4c19aa6f664ae71e644c3fa519ec3c9c99d11d7e99696a9cddb
                                                                                                                                                                                      • Opcode Fuzzy Hash: d6edc2b71ccf17cf47a4ad25d9b10d29dc33f6072b75531269d3699570e9d83c
                                                                                                                                                                                      • Instruction Fuzzy Hash: C2218EB0801B40DFC722CF7A854525AFBF8FFA4601F14891FE59A8A721DBB4A481CF04
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10017709 Relevance: 6.1, APIs: 4, Instructions: 55registryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • RegSetValueExA.ADVAPI32(00000000,?,00000000,00000004,?,00000004), ref: 10017742
                                                                                                                                                                                      • RegCloseKey.ADVAPI32(00000000), ref: 1001774B
                                                                                                                                                                                      • _swprintf.LIBCMT ref: 10017768
                                                                                                                                                                                      • WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 10017779
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ClosePrivateProfileStringValueWrite_swprintf
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 4210924919-0
                                                                                                                                                                                      • Opcode ID: 3276be8801f00fc95fb59eac867b2e4799b3078c36edba842ee4648e314c5080
                                                                                                                                                                                      • Instruction ID: e9188d0bda7618ab121d067f9e2349c71729dbb6fdaec1ca83b1d39ed15240a7
                                                                                                                                                                                      • Opcode Fuzzy Hash: 3276be8801f00fc95fb59eac867b2e4799b3078c36edba842ee4648e314c5080
                                                                                                                                                                                      • Instruction Fuzzy Hash: A901C072500219FBEB00DF648D85FAFB3BCEF09704F010429FA05EB181EAB0E90187A5
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10017C4C Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • FindResourceA.KERNEL32(?,?,000000F0), ref: 10017C70
                                                                                                                                                                                      • LoadResource.KERNEL32(?,00000000), ref: 10017C7C
                                                                                                                                                                                      • LockResource.KERNEL32(00000000), ref: 10017C8A
                                                                                                                                                                                      • FreeResource.KERNEL32(00000000), ref: 10017CB8
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Resource$FindFreeLoadLock
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1078018258-0
                                                                                                                                                                                      • Opcode ID: edfb174a9e285db0d5a3c51f4831c90a2ac26f0a6dda286db3df881abf1d384e
                                                                                                                                                                                      • Instruction ID: 37c567c5ed2abd0c262b3d9c14b2c0b98263367eb1ad4cff580600f06ae044bd
                                                                                                                                                                                      • Opcode Fuzzy Hash: edfb174a9e285db0d5a3c51f4831c90a2ac26f0a6dda286db3df881abf1d384e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 44112875600219EFDB409F95CA88AAE7BB9FF09390F108069F9099B260DB71DD40CFA1
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002665D Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Rect$EmptyEqualIntersectInvalidate
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3354205298-0
                                                                                                                                                                                      • Opcode ID: 942ad99b2399d162ae308976561f40286ff473c45cb6fa56c7d9567a3f7ded4b
                                                                                                                                                                                      • Instruction ID: 41f5bb3622a22b3bbc1aebe7228573581b0e45adc76bddbe530eb5e3d74ee13d
                                                                                                                                                                                      • Opcode Fuzzy Hash: 942ad99b2399d162ae308976561f40286ff473c45cb6fa56c7d9567a3f7ded4b
                                                                                                                                                                                      • Instruction Fuzzy Hash: C6111C7690021AEFDF01DF94CC89EDE7BB9FF09245F004061FA04DA011E7719645CBA1
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10021616 Relevance: 6.1, APIs: 4, Instructions: 51COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 100144EC: _malloc.LIBCMT ref: 10014506
                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 10021648
                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(?,00000000), ref: 1002164E
                                                                                                                                                                                      • DuplicateHandle.KERNEL32(00000000), ref: 10021651
                                                                                                                                                                                      • GetLastError.KERNEL32(?), ref: 1002166C
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CurrentProcess$DuplicateErrorHandleLast_malloc
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3704204646-0
                                                                                                                                                                                      • Opcode ID: e3eb1482b795a9df1540db4a81f001daf9671be440491e4aa5cb1c9e6ea1c40b
                                                                                                                                                                                      • Instruction ID: b1d6e851d134fb09cc2650d0be1f9f41ce2f018d7dad051a3fdc0e20acdc4583
                                                                                                                                                                                      • Opcode Fuzzy Hash: e3eb1482b795a9df1540db4a81f001daf9671be440491e4aa5cb1c9e6ea1c40b
                                                                                                                                                                                      • Instruction Fuzzy Hash: 43018479700204BFEB10DBA5DD89F5E7BACEF88750F544055F904CB291EA71EC008B60
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100155B8 Relevance: 6.0, APIs: 4, Instructions: 50windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • EnableMenuItem.USER32 ref: 100155F0
                                                                                                                                                                                        • Part of subcall function 100201F1: __CxxThrowException@8.LIBCMT ref: 10020205
                                                                                                                                                                                      • GetFocus.USER32 ref: 10015607
                                                                                                                                                                                      • GetParent.USER32(?), ref: 10015615
                                                                                                                                                                                      • SendMessageA.USER32 ref: 10015628
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: EnableException@8FocusItemMenuMessageParentSendThrow
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 4211600527-0
                                                                                                                                                                                      • Opcode ID: a53acda8154667cb3770614629a05d62209f70ffdd5308ba9c3bbb549cf7bdb7
                                                                                                                                                                                      • Instruction ID: 5e122fa76a0b730552ea88f4d91bd13ac6dffab2f223f6deda68fe1d030935d6
                                                                                                                                                                                      • Opcode Fuzzy Hash: a53acda8154667cb3770614629a05d62209f70ffdd5308ba9c3bbb549cf7bdb7
                                                                                                                                                                                      • Instruction Fuzzy Hash: 6D118E71100611EFDB20DF60CD8581AB7F6FF88716B54C62DF1568A560D732EC848B91
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1001B96E Relevance: 6.0, APIs: 4, Instructions: 49COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetTopWindow.USER32(00000000), ref: 1001B97C
                                                                                                                                                                                      • GetTopWindow.USER32(00000000), ref: 1001B9BB
                                                                                                                                                                                      • GetWindow.USER32(00000000,00000002), ref: 1001B9D9
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Window
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2353593579-0
                                                                                                                                                                                      • Opcode ID: 53b3a67e4a4930d6f35b53cf06474ecb6a52427011bba0ba31954c8fd7e85df7
                                                                                                                                                                                      • Instruction ID: d676a82d7887273777baca2e38fe8b62e8198389fbfbdcd46b7f1d18b22838b9
                                                                                                                                                                                      • Opcode Fuzzy Hash: 53b3a67e4a4930d6f35b53cf06474ecb6a52427011bba0ba31954c8fd7e85df7
                                                                                                                                                                                      • Instruction Fuzzy Hash: 92012236001A2ABBCF129F919D05EDE3B6AEF49394F004010FE0069120D736C9A2EBA6
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1001B32D Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetDlgItem.USER32 ref: 1001B338
                                                                                                                                                                                      • GetTopWindow.USER32(00000000), ref: 1001B34B
                                                                                                                                                                                        • Part of subcall function 1001B32D: GetWindow.USER32(00000000,00000002), ref: 1001B392
                                                                                                                                                                                      • GetTopWindow.USER32(?), ref: 1001B37B
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Window$Item
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 369458955-0
                                                                                                                                                                                      • Opcode ID: 9be62a33154ecf838a8ec693ceb269fba071d7fc85a8faced3965e2d85c2953e
                                                                                                                                                                                      • Instruction ID: 858530c175d9441ab3e78fa875986bdb84c423c322646567b0054cf47e6755e0
                                                                                                                                                                                      • Opcode Fuzzy Hash: 9be62a33154ecf838a8ec693ceb269fba071d7fc85a8faced3965e2d85c2953e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 4D01A236101E6AF7DB129F618D05E8F3B99EF453E4F024010FD249D120DB71DBB196A1
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1003C9F5 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3016257755-0
                                                                                                                                                                                      • Opcode ID: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
                                                                                                                                                                                      • Instruction ID: 43f41ac90f78858b98c9d7795bb0f5538c3c8e7231dcd18d5b884ccf0efad8a7
                                                                                                                                                                                      • Opcode Fuzzy Hash: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
                                                                                                                                                                                      • Instruction Fuzzy Hash: 78013D3640054EBFCF139F86DC41CEE3F66FB19295F558415FA1898121C636DAB1AB82
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002BC31 Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • SysStringLen.OLEAUT32(?), ref: 1002BC45
                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,0000000C,1002D018,00000000,00000018,1002D35E), ref: 1002BC5D
                                                                                                                                                                                      • SysAllocStringByteLen.OLEAUT32(00000000,00000000), ref: 1002BC65
                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000,?,?,0000000C,1002D018,00000000,00000018,1002D35E), ref: 1002BC84
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Byte$CharMultiStringWide$Alloc
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3384502665-0
                                                                                                                                                                                      • Opcode ID: 30c8667133e0e99acdefb8fda4e094958d0ee3b60e94751be478a45e222a3836
                                                                                                                                                                                      • Instruction ID: 8ac585039279df4530c17525e78cb38a3c471deb65f2ee77315d7d06ea712387
                                                                                                                                                                                      • Opcode Fuzzy Hash: 30c8667133e0e99acdefb8fda4e094958d0ee3b60e94751be478a45e222a3836
                                                                                                                                                                                      • Instruction Fuzzy Hash: 15F09671106774BF932157629D8CC9BBF9CFE8F3F5B11052AF549C2100D6629800C6F5
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1003A545 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 100352EC: __getptd_noexit.LIBCMT ref: 100352ED
                                                                                                                                                                                        • Part of subcall function 100352EC: __amsg_exit.LIBCMT ref: 100352FA
                                                                                                                                                                                      • __amsg_exit.LIBCMT ref: 1003A571
                                                                                                                                                                                      • __lock.LIBCMT ref: 1003A581
                                                                                                                                                                                      • InterlockedDecrement.KERNEL32(?), ref: 1003A59E
                                                                                                                                                                                      • InterlockedIncrement.KERNEL32(040A1308), ref: 1003A5C9
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd_noexit__lock
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2880340415-0
                                                                                                                                                                                      • Opcode ID: 77ce0df2017148a369788d84d5d9eaff25b7537eedda72ae9a584ccf42c9de33
                                                                                                                                                                                      • Instruction ID: 227b034a2befce0e561f83ae0ba5e63d07179ac23aa6a18c45afd9c28011782e
                                                                                                                                                                                      • Opcode Fuzzy Hash: 77ce0df2017148a369788d84d5d9eaff25b7537eedda72ae9a584ccf42c9de33
                                                                                                                                                                                      • Instruction Fuzzy Hash: B2016D35D01E21EFEB42DB65884575D77A0FF067A3F510105E800AF291DB25BA81CBD6
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1001DC85 Relevance: 6.0, APIs: 4, Instructions: 42COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • FindResourceA.KERNEL32(?,?,000000F0), ref: 1001DCA7
                                                                                                                                                                                      • LoadResource.KERNEL32(?,00000000,?,?,?,?,1001703A,?,?,100128C0,669449D7), ref: 1001DCB3
                                                                                                                                                                                      • LockResource.KERNEL32(00000000,?,?,?,?,1001703A,?,?,100128C0,669449D7), ref: 1001DCC0
                                                                                                                                                                                      • FreeResource.KERNEL32(00000000,00000000,?,?,?,?,1001703A,?,?,100128C0,669449D7), ref: 1001DCDB
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Resource$FindFreeLoadLock
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1078018258-0
                                                                                                                                                                                      • Opcode ID: b40af9f0dfb9db239089461bda16c39fe6d8ad8ad62dd4b4922628693a12339f
                                                                                                                                                                                      • Instruction ID: 2e1bb7004ec06de307aa608eb86a555f9a12e1d63b329185fddd1afba3e53365
                                                                                                                                                                                      • Opcode Fuzzy Hash: b40af9f0dfb9db239089461bda16c39fe6d8ad8ad62dd4b4922628693a12339f
                                                                                                                                                                                      • Instruction Fuzzy Hash: 74F09676301A126B93417B654E84A7BBB9CEFC65A2701013AFE05D7211EEB1CC45C2A6
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100174CD Relevance: 6.0, APIs: 4, Instructions: 32COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • EnableWindow.USER32(000000FF,00000001), ref: 100174ED
                                                                                                                                                                                      • GetActiveWindow.USER32 ref: 100174F8
                                                                                                                                                                                      • SetActiveWindow.USER32(000000FF,?,00000024,100010EC,00000000,10046640), ref: 10017506
                                                                                                                                                                                      • FreeResource.KERNEL32(00000008,?,00000024,100010EC,00000000,10046640), ref: 10017522
                                                                                                                                                                                        • Part of subcall function 1001DECA: EnableWindow.USER32(?,10046640), ref: 1001DED7
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Window$ActiveEnable$FreeResource
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 253586258-0
                                                                                                                                                                                      • Opcode ID: eb27006848965884004c9991400e475c3ac81a8aa5cc97471f58b07f94fae74b
                                                                                                                                                                                      • Instruction ID: b8177a2bef97c6db83ac0ed626da55a545c9139c8ac7342270f03f66935dd0b6
                                                                                                                                                                                      • Opcode Fuzzy Hash: eb27006848965884004c9991400e475c3ac81a8aa5cc97471f58b07f94fae74b
                                                                                                                                                                                      • Instruction Fuzzy Hash: C5F03C34900A15CFDF12EB64CD8559DBBF2FF88702B100115E446BA161DB72AD80CE16
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002E206 Relevance: 6.0, APIs: 4, Instructions: 21COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 1002E228
                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 1002E235
                                                                                                                                                                                      • CoFreeUnusedLibraries.OLE32 ref: 1002E244
                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 1002E24A
                                                                                                                                                                                        • Part of subcall function 1002E1AF: CoFreeUnusedLibraries.OLE32(00000000,1002E28E,00000000), ref: 1002E1F3
                                                                                                                                                                                        • Part of subcall function 1002E1AF: OleUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,1002E28E), ref: 1002E1F9
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CountTick$FreeLibrariesUnused$Uninitialize
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 685759847-0
                                                                                                                                                                                      • Opcode ID: 5645409a338d605000a15fbb944d62efc2c9a6456e8d0e25dbd15ca34f7d067c
                                                                                                                                                                                      • Instruction ID: b81a2157dff59843e5c721b5fa459b83a8bef19e296eb3c7ce89af4ff474d23a
                                                                                                                                                                                      • Opcode Fuzzy Hash: 5645409a338d605000a15fbb944d62efc2c9a6456e8d0e25dbd15ca34f7d067c
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3BE012358D42B4CBFB04FB20ED883A93BE8FB46305F514527D04692165DB346C59DF52
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10027CC2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 170COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ClearVariant
                                                                                                                                                                                      • String ID: (
                                                                                                                                                                                      • API String ID: 1473721057-3887548279
                                                                                                                                                                                      • Opcode ID: 008ec943e52341c0dca71a05145884f93f6144af570bd047c2597266c283ece8
                                                                                                                                                                                      • Instruction ID: 55505e3d54abccaab23e3fb35bc0536c28338c561f08ce7921e5662988eb51c3
                                                                                                                                                                                      • Opcode Fuzzy Hash: 008ec943e52341c0dca71a05145884f93f6144af570bd047c2597266c283ece8
                                                                                                                                                                                      • Instruction Fuzzy Hash: 52517A75600B11DFCB64CF68D9C2A2AB7F5FF48314B904A6DE5868BA52C770F981CB50
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100259EE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 150COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: H_prolog3
                                                                                                                                                                                      • String ID: @
                                                                                                                                                                                      • API String ID: 431132790-2766056989
                                                                                                                                                                                      • Opcode ID: 154d677d06bdea17fd7c180cae35ab477e1537548e58b8b808fb5212b96a33b2
                                                                                                                                                                                      • Instruction ID: 3c539a28780873688809e1a5131d88fd7e7c20f84f620333ebd6e4501b894ad0
                                                                                                                                                                                      • Opcode Fuzzy Hash: 154d677d06bdea17fd7c180cae35ab477e1537548e58b8b808fb5212b96a33b2
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2951D5B0A0020A9FDB04CFA8C8D8AEEB7F9FF48305F50456AE516EB251E775A945CF50
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10013010 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108memorynetworkCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 1001E3AC: __EH_prolog3.LIBCMT ref: 1001E3B3
                                                                                                                                                                                        • Part of subcall function 1001E3AC: GetWindowTextA.USER32 ref: 1001E3C9
                                                                                                                                                                                        • Part of subcall function 1001DDF4: IsWindow.USER32(?), ref: 1001DE03
                                                                                                                                                                                      • _DebugHeapAllocator.LIBCPMTD ref: 100130B2
                                                                                                                                                                                        • Part of subcall function 10013820: _DebugHeapAllocator.LIBCPMTD ref: 10013875
                                                                                                                                                                                        • Part of subcall function 100137A0: SendMessageA.USER32 ref: 100137BB
                                                                                                                                                                                      • send.WS2_32(?,?,00000064,00000000), ref: 10013195
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AllocatorDebugHeapWindow$H_prolog3MessageSendTextsend
                                                                                                                                                                                      • String ID: :
                                                                                                                                                                                      • API String ID: 14538988-3653984579
                                                                                                                                                                                      • Opcode ID: 13b8f6eccedc4ccdf4080b13ffaaa0417b73d22118cf8ccc7af144c890aa7e78
                                                                                                                                                                                      • Instruction ID: f6b77999ec19404b7b7ce6cfec7bf3295ff1974a42ab232d1976716b8ec2d843
                                                                                                                                                                                      • Opcode Fuzzy Hash: 13b8f6eccedc4ccdf4080b13ffaaa0417b73d22118cf8ccc7af144c890aa7e78
                                                                                                                                                                                      • Instruction Fuzzy Hash: 01410DB59001189FDB24DB64CC91BEEB775FF44304F5082ADE51AA7282DF346A85CF54
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1001508F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 100150B5
                                                                                                                                                                                      • PathFindExtensionA.SHLWAPI(?), ref: 100150CB
                                                                                                                                                                                        • Part of subcall function 10014B27: _strcpy_s.LIBCMT ref: 10014B33
                                                                                                                                                                                        • Part of subcall function 10014DA8: __EH_prolog3.LIBCMT ref: 10014DC7
                                                                                                                                                                                        • Part of subcall function 10014DA8: GetModuleHandleA.KERNEL32(kernel32.dll,00000058), ref: 10014DE8
                                                                                                                                                                                        • Part of subcall function 10014DA8: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 10014DF9
                                                                                                                                                                                        • Part of subcall function 10014DA8: ConvertDefaultLocale.KERNEL32(?), ref: 10014E2F
                                                                                                                                                                                        • Part of subcall function 10014DA8: ConvertDefaultLocale.KERNEL32(?), ref: 10014E37
                                                                                                                                                                                        • Part of subcall function 10014DA8: GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 10014E4B
                                                                                                                                                                                        • Part of subcall function 10014DA8: ConvertDefaultLocale.KERNEL32(?), ref: 10014E6F
                                                                                                                                                                                        • Part of subcall function 10014DA8: ConvertDefaultLocale.KERNEL32(000003FF), ref: 10014E75
                                                                                                                                                                                        • Part of subcall function 10014DA8: GetModuleFileNameA.KERNEL32(10000000,?,00000105), ref: 10014EAE
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ConvertDefaultLocale$Module$AddressFileNameProc$ExtensionFindH_prolog3HandlePath_strcpy_s
                                                                                                                                                                                      • String ID: %s.dll
                                                                                                                                                                                      • API String ID: 3444012488-3668843792
                                                                                                                                                                                      • Opcode ID: 658e8660b57156c47c50295d269887a352ab673736f5c816275cebcb6cd6bc48
                                                                                                                                                                                      • Instruction ID: 0816ccb3c2c5dc3d5c2f43fd153125c4ae2bbce82e663fde520804fb1fdab18a
                                                                                                                                                                                      • Opcode Fuzzy Hash: 658e8660b57156c47c50295d269887a352ab673736f5c816275cebcb6cd6bc48
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9901B971A10118BBDF09DB74DD96AEEB3B8DF04B01F0105E9EA02DB140EEB1EE448A61
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10001FF0 Relevance: 5.2, APIs: 4, Instructions: 181COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • IsBadReadPtr.KERNEL32(00000000,00000014,?,?,?,?,100025CE,00000000,00000000), ref: 10002045
                                                                                                                                                                                      • SetLastError.KERNEL32(0000007E), ref: 10002087
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ErrorLastRead
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 4100373531-0
                                                                                                                                                                                      • Opcode ID: b6f425d35b460735779e1ed3fb281948f59bf2ef0f2add24d18ae520f481b1e4
                                                                                                                                                                                      • Instruction ID: bdea880ba7c0c5bd5d2dbe714977ff7d927dc75702b615567210b407e242d671
                                                                                                                                                                                      • Opcode Fuzzy Hash: b6f425d35b460735779e1ed3fb281948f59bf2ef0f2add24d18ae520f481b1e4
                                                                                                                                                                                      • Instruction Fuzzy Hash: B181A8B4A00209EFDB04CF94C980AAEB7B1FF48354F248159E919AB355D735EE82CF94
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10020B38 Relevance: 5.1, APIs: 4, Instructions: 60COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(?), ref: 10020B95
                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?,?), ref: 10020BA5
                                                                                                                                                                                      • LocalFree.KERNEL32(?), ref: 10020BAE
                                                                                                                                                                                      • TlsSetValue.KERNEL32(?,00000000), ref: 10020BC0
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CriticalSection$EnterFreeLeaveLocalValue
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2949335588-0
                                                                                                                                                                                      • Opcode ID: 6676c0264c2eb297a537204f12f4d5c162c59b7e83937d8b07f604b269a52a54
                                                                                                                                                                                      • Instruction ID: af4df8c6ab00e3b134578f48d56f113cbd39bdf93991f651abc1e22c3acb8acd
                                                                                                                                                                                      • Opcode Fuzzy Hash: 6676c0264c2eb297a537204f12f4d5c162c59b7e83937d8b07f604b269a52a54
                                                                                                                                                                                      • Instruction Fuzzy Hash: 70113435600305EFE721CF54D9C4B9AB7AAFF0A35AF508429F5528B5A2DB71F980CB50
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10020E5D Relevance: 5.0, APIs: 4, Instructions: 37COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(10057798,?,?,?,?,1002074A,00000010,00000008,1001FA2A,1001F9CD,10015B30,1001555B,?,10015D3C,00000004,10015139), ref: 10020E99
                                                                                                                                                                                      • InitializeCriticalSection.KERNEL32(?,?,?,?,?,1002074A,00000010,00000008,1001FA2A,1001F9CD,10015B30,1001555B,?,10015D3C,00000004,10015139), ref: 10020EA8
                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(10057798,?,?,?,?,1002074A,00000010,00000008,1001FA2A,1001F9CD,10015B30,1001555B,?,10015D3C,00000004,10015139), ref: 10020EB5
                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(?,?,?,?,?,1002074A,00000010,00000008,1001FA2A,1001F9CD,10015B30,1001555B,?,10015D3C,00000004,10015139), ref: 10020EC1
                                                                                                                                                                                        • Part of subcall function 100201F1: __CxxThrowException@8.LIBCMT ref: 10020205
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CriticalSection$Enter$Exception@8InitializeLeaveThrow
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3253506028-0
                                                                                                                                                                                      • Opcode ID: cf9bd6703211ded15ebc294ea5b4eaffa7e14a09b8c66129e44fb6711d6d5733
                                                                                                                                                                                      • Instruction ID: 3404b174272e1aedd22e2de365cf3e448d28d784c73140ac4aa41e98356ae93e
                                                                                                                                                                                      • Opcode Fuzzy Hash: cf9bd6703211ded15ebc294ea5b4eaffa7e14a09b8c66129e44fb6711d6d5733
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5AF0907350031A9BDB10DB58FC88B1AB6AAFB96355F870816F64582123EB3264C48A61
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100206C8 Relevance: 5.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(100575E0,?,?,?,10020C8D,?,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139,00000004,10001031), ref: 100206D1
                                                                                                                                                                                      • TlsGetValue.KERNEL32(100575C4,?,?,?,10020C8D,?,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139,00000004,10001031), ref: 100206E6
                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(100575E0,?,?,?,10020C8D,?,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139,00000004,10001031), ref: 100206FC
                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(100575E0,?,?,?,10020C8D,?,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139,00000004,10001031), ref: 10020707
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000002.00000002.252652791.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000002.00000002.252648818.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252687564.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252875218.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.252981445.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000002.00000002.253073575.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_10000000_regsvr32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CriticalSection$Leave$EnterValue
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3969253408-0
                                                                                                                                                                                      • Opcode ID: 384891d58c6dafcceaf36b456d2d2389f12afbb41143d91066085e81aa889ef7
                                                                                                                                                                                      • Instruction ID: 186a6cd651b3b82d4df79f5272d157dd9dcdda25cd8a7682fbe975f35e4e1d68
                                                                                                                                                                                      • Opcode Fuzzy Hash: 384891d58c6dafcceaf36b456d2d2389f12afbb41143d91066085e81aa889ef7
                                                                                                                                                                                      • Instruction Fuzzy Hash: 51F0FE76604720DFD320CF64DD8880B73ABEB8925135A9555F842D3123E630F8058F61
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Execution Graph

                                                                                                                                                                                      Execution Coverage:22.9%
                                                                                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                      Signature Coverage:0%
                                                                                                                                                                                      Total number of Nodes:318
                                                                                                                                                                                      Total number of Limit Nodes:21
                                                                                                                                                                                      execution_graph 22501 10020c26 22502 10020c32 __EH_prolog3 22501->22502 22504 10020c80 22502->22504 22512 1002083b EnterCriticalSection 22502->22512 22526 100201f1 RaiseException __CxxThrowException@8 22502->22526 22527 1002094b TlsAlloc InitializeCriticalSection 22502->22527 22528 100206c8 EnterCriticalSection TlsGetValue LeaveCriticalSection LeaveCriticalSection 22504->22528 22508 10020c8d 22509 10020c93 22508->22509 22510 10020ca6 ~_Task_impl 22508->22510 22529 100209ed 88 API calls 5 library calls 22509->22529 22517 1002085a 22512->22517 22513 10020916 _memset 22514 1002092a LeaveCriticalSection 22513->22514 22514->22502 22515 10020893 22530 10014460 22515->22530 22516 100208a8 GlobalHandle GlobalUnlock 22519 10014460 ctype 80 API calls 22516->22519 22517->22513 22517->22515 22517->22516 22521 100208c5 GlobalReAlloc 22519->22521 22522 100208cf 22521->22522 22523 100208f7 GlobalLock 22522->22523 22524 100208da GlobalHandle GlobalLock 22522->22524 22525 100208e8 LeaveCriticalSection 22522->22525 22523->22513 22524->22525 22525->22523 22527->22502 22528->22508 22529->22510 22531 10014477 ctype 22530->22531 22532 1001448c GlobalAlloc 22531->22532 22534 10013ba0 80 API calls _DebugHeapAllocator 22531->22534 22532->22522 22534->22532 22535 10030d06 22536 10030d12 22535->22536 22537 10030d0d 22535->22537 22541 10030c10 22536->22541 22553 1003906d GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter 22537->22553 22540 10030d23 22544 10030c1c _doexit 22541->22544 22542 10030c69 22546 10030cb9 _doexit 22542->22546 22609 100125c0 22542->22609 22544->22542 22544->22546 22554 10030a37 22544->22554 22546->22540 22548 100125c0 ___DllMainCRTStartup 141 API calls 22550 10030c90 22548->22550 22549 10030a37 __CRT_INIT@12 165 API calls 22549->22546 22551 10030a37 __CRT_INIT@12 165 API calls 22550->22551 22552 10030c99 22551->22552 22552->22546 22552->22549 22553->22536 22555 10030b61 22554->22555 22556 10030a4a GetProcessHeap HeapAlloc 22554->22556 22557 10030b67 22555->22557 22558 10030b9c 22555->22558 22559 10030a6e GetVersionExA 22556->22559 22572 10030a67 22556->22572 22566 10030b86 22557->22566 22557->22572 22724 100310be 67 API calls _doexit 22557->22724 22562 10030ba1 22558->22562 22563 10030bfa 22558->22563 22560 10030a89 GetProcessHeap HeapFree 22559->22560 22561 10030a7e GetProcessHeap HeapFree 22559->22561 22564 10030ab5 22560->22564 22561->22572 22728 10035135 6 API calls __decode_pointer 22562->22728 22563->22572 22750 10035425 79 API calls 2 library calls 22563->22750 22631 10036624 HeapCreate 22564->22631 22566->22572 22725 100389ee 68 API calls ___wtomb_environ 22566->22725 22567 10030ba6 22729 10035840 22567->22729 22572->22542 22573 10030aeb 22573->22572 22641 1003548e GetModuleHandleA 22573->22641 22576 10030b90 22726 10035178 70 API calls 2 library calls 22576->22726 22577 10030bbe 22735 100350ae TlsGetValue TlsGetValue GetModuleHandleA GetProcAddress 22577->22735 22581 10030af9 __RTC_Initialize 22584 10030afd 22581->22584 22587 10030b0c GetCommandLineA 22581->22587 22582 10030b95 22727 1003667e VirtualFree HeapFree HeapFree HeapDestroy 22582->22727 22583 10030bd0 22588 10030bd7 22583->22588 22589 10030bee 22583->22589 22718 1003667e VirtualFree HeapFree HeapFree HeapDestroy 22584->22718 22674 10038d66 22587->22674 22736 100351b5 67 API calls 4 library calls 22588->22736 22737 1002fa69 22589->22737 22595 10030bde GetCurrentThreadId 22595->22572 22596 10030b26 22597 10030b31 22596->22597 22598 10030b2a 22596->22598 22720 10038cad 111 API calls 3 library calls 22597->22720 22719 10035178 70 API calls 2 library calls 22598->22719 22601 10030b36 22607 10030b4a 22601->22607 22721 10038a3a 110 API calls 6 library calls 22601->22721 22604 10030b5f 22604->22598 22605 10030b3f 22605->22607 22722 10030f4d 75 API calls 4 library calls 22605->22722 22608 10030b4f 22607->22608 22723 100389ee 68 API calls ___wtomb_environ 22607->22723 22608->22572 22801 10006a90 22609->22801 22612 1001265a 22831 1002fe65 105 API calls 6 library calls 22612->22831 22613 1001261c FindResourceW LoadResource SizeofResource 22616 10006a90 ___DllMainCRTStartup 67 API calls 22613->22616 22620 10012744 ___DllMainCRTStartup 22616->22620 22617 10012664 22832 1002f81e 5 API calls __invoke_watson 22617->22832 22619 1001284d 22619->22548 22619->22552 22621 100127b7 VirtualAlloc 22620->22621 22622 1001279b VirtualAllocExNuma 22620->22622 22623 100127da 22621->22623 22622->22623 22624 1002fb00 ___crtGetEnvironmentStringsA __VEC_memcpy 22623->22624 22625 100127eb 22624->22625 22806 1002f9a6 22625->22806 22627 100127fa 22825 10002970 22627->22825 22629 10012810 ___DllMainCRTStartup 22828 100026a0 22629->22828 22632 10036647 22631->22632 22633 10036644 22631->22633 22751 100365c9 67 API calls 3 library calls 22632->22751 22633->22573 22635 1003664c 22636 10036656 22635->22636 22637 1003667a 22635->22637 22752 10035aca HeapAlloc 22636->22752 22637->22573 22639 10036660 22639->22637 22640 10036665 HeapDestroy 22639->22640 22640->22633 22642 100354a0 22641->22642 22643 100354a9 GetProcAddress GetProcAddress GetProcAddress GetProcAddress 22641->22643 22753 10035178 70 API calls 2 library calls 22642->22753 22644 100354f3 TlsAlloc 22643->22644 22648 10035541 TlsSetValue 22644->22648 22649 1003560d 22644->22649 22647 100354a5 22647->22581 22648->22649 22650 10035552 22648->22650 22649->22581 22754 100310cd 5 API calls 3 library calls 22650->22754 22652 10035557 22755 10035042 TlsGetValue 22652->22755 22655 10035042 __encode_pointer 5 API calls 22656 10035572 22655->22656 22657 10035042 __encode_pointer 5 API calls 22656->22657 22658 10035582 22657->22658 22659 10035042 __encode_pointer 5 API calls 22658->22659 22660 10035592 22659->22660 22764 10035923 67 API calls ___crtInitCritSecAndSpinCount 22660->22764 22662 1003559f 22663 10035608 22662->22663 22765 100350ae TlsGetValue TlsGetValue GetModuleHandleA GetProcAddress 22662->22765 22768 10035178 70 API calls 2 library calls 22663->22768 22666 100355b3 22666->22663 22667 10035840 __calloc_crt 67 API calls 22666->22667 22668 100355cc 22667->22668 22668->22663 22766 100350ae TlsGetValue TlsGetValue GetModuleHandleA GetProcAddress 22668->22766 22670 100355e6 22670->22663 22671 100355ed 22670->22671 22767 100351b5 67 API calls 4 library calls 22671->22767 22673 100355f5 GetCurrentThreadId 22673->22649 22675 10038d82 GetEnvironmentStringsW 22674->22675 22676 10038da1 22674->22676 22677 10038d8a 22675->22677 22679 10038d96 GetLastError 22675->22679 22676->22677 22678 10038e3c 22676->22678 22680 10038dcb WideCharToMultiByte 22677->22680 22681 10038dbc GetEnvironmentStringsW 22677->22681 22682 10038e44 GetEnvironmentStrings 22678->22682 22683 10030b1c 22678->22683 22679->22676 22687 10038e31 FreeEnvironmentStringsW 22680->22687 22688 10038dff 22680->22688 22681->22680 22681->22683 22682->22683 22684 10038e54 22682->22684 22701 100387ae 22683->22701 22770 10035800 67 API calls _malloc 22684->22770 22687->22683 22769 10035800 67 API calls _malloc 22688->22769 22691 10038e6d 22693 10038e80 22691->22693 22694 10038e74 FreeEnvironmentStringsA 22691->22694 22692 10038e05 22692->22687 22695 10038e0e WideCharToMultiByte 22692->22695 22771 1002fb00 22693->22771 22694->22683 22697 10038e1f 22695->22697 22698 10038e28 22695->22698 22700 1002fa69 ___wtomb_environ 67 API calls 22697->22700 22698->22687 22700->22698 22775 10032b38 22701->22775 22703 100387ba GetStartupInfoA 22704 10035840 __calloc_crt 67 API calls 22703->22704 22712 100387db 22704->22712 22705 100389e5 _doexit 22705->22596 22706 10038962 GetStdHandle 22711 1003892c 22706->22711 22707 100389c7 SetHandleCount 22707->22705 22708 10035840 __calloc_crt 67 API calls 22708->22712 22709 10038974 GetFileType 22709->22711 22710 100388af 22710->22711 22714 100388e3 22710->22714 22715 100388d8 GetFileType 22710->22715 22711->22706 22711->22707 22711->22709 22716 1003898b 22711->22716 22712->22705 22712->22708 22712->22710 22712->22711 22714->22705 22714->22710 22776 10039358 67 API calls 5 library calls 22714->22776 22715->22710 22715->22714 22716->22705 22716->22711 22777 10039358 67 API calls 5 library calls 22716->22777 22718->22572 22719->22584 22720->22601 22721->22605 22722->22607 22723->22604 22724->22566 22725->22576 22726->22582 22727->22572 22728->22567 22732 10035844 22729->22732 22731 10030bb2 22731->22572 22731->22577 22732->22731 22733 10035864 Sleep 22732->22733 22778 10030678 22732->22778 22734 10035879 22733->22734 22734->22731 22734->22732 22735->22583 22736->22595 22739 1002fa75 _doexit 22737->22739 22738 1002faee _doexit __expand 22738->22608 22739->22738 22749 1002fab4 22739->22749 22797 10035a99 67 API calls 2 library calls 22739->22797 22740 1002fac9 RtlFreeHeap 22740->22738 22742 1002fadb 22740->22742 22800 100311f4 67 API calls __getptd_noexit 22742->22800 22744 1002fae0 GetLastError 22744->22738 22745 1002faa6 22799 1002fabf LeaveCriticalSection _doexit 22745->22799 22746 1002fa8c ___sbh_find_block 22746->22745 22798 10035b3d VirtualFree VirtualFree HeapFree __cftoe2_l 22746->22798 22749->22738 22749->22740 22750->22572 22751->22635 22752->22639 22753->22647 22754->22652 22756 10035076 GetModuleHandleA 22755->22756 22757 10035055 22755->22757 22759 10035085 GetProcAddress 22756->22759 22760 1003509f 22756->22760 22757->22756 22758 1003505f TlsGetValue 22757->22758 22763 1003506a 22758->22763 22761 1003506e 22759->22761 22760->22655 22761->22760 22762 10035095 RtlEncodePointer 22761->22762 22762->22760 22763->22756 22763->22761 22764->22662 22765->22666 22766->22670 22767->22673 22768->22649 22769->22692 22770->22691 22772 1002fb18 22771->22772 22773 1002fb47 FreeEnvironmentStringsA 22772->22773 22774 1002fb3f __VEC_memcpy 22772->22774 22773->22683 22774->22773 22775->22703 22776->22714 22777->22716 22779 10030684 _doexit 22778->22779 22780 1003069c 22779->22780 22783 100306bb _memset 22779->22783 22791 100311f4 67 API calls __getptd_noexit 22780->22791 22782 100306a1 22792 10037753 4 API calls 2 library calls 22782->22792 22785 1003072d RtlAllocateHeap 22783->22785 22788 100306b1 _doexit 22783->22788 22793 10035a99 67 API calls 2 library calls 22783->22793 22794 100362e6 5 API calls 2 library calls 22783->22794 22795 10030774 LeaveCriticalSection _doexit 22783->22795 22796 100368d5 TlsGetValue TlsGetValue GetModuleHandleA GetProcAddress __decode_pointer 22783->22796 22785->22783 22788->22732 22791->22782 22793->22783 22794->22783 22795->22783 22796->22783 22797->22746 22798->22745 22799->22749 22800->22744 22802 1002f9a6 _malloc 67 API calls 22801->22802 22803 10006aa1 22802->22803 22804 1002fa69 ___wtomb_environ 67 API calls 22803->22804 22805 10006aad 22803->22805 22804->22805 22805->22612 22805->22613 22807 1002fa53 22806->22807 22818 1002f9b4 22806->22818 22840 100368d5 TlsGetValue TlsGetValue GetModuleHandleA GetProcAddress __decode_pointer 22807->22840 22809 1002fa59 22841 100311f4 67 API calls __getptd_noexit 22809->22841 22812 1002fa5f 22812->22627 22815 1002fa17 RtlAllocateHeap 22815->22818 22816 1002f9c9 22816->22818 22833 10036892 67 API calls __NMSG_WRITE 22816->22833 22834 100366f2 67 API calls 6 library calls 22816->22834 22835 10030e7b GetModuleHandleA GetProcAddress ExitProcess ___crtCorExitProcess 22816->22835 22818->22815 22818->22816 22819 1002fa3e 22818->22819 22822 1002fa3c 22818->22822 22824 1002fa4a 22818->22824 22836 1002f957 67 API calls 4 library calls 22818->22836 22837 100368d5 TlsGetValue TlsGetValue GetModuleHandleA GetProcAddress __decode_pointer 22818->22837 22838 100311f4 67 API calls __getptd_noexit 22819->22838 22839 100311f4 67 API calls __getptd_noexit 22822->22839 22824->22627 22826 1002f9a6 _malloc 67 API calls 22825->22826 22827 10002990 22826->22827 22827->22629 22842 10002280 22828->22842 22831->22617 22832->22619 22833->22816 22834->22816 22836->22818 22837->22818 22838->22822 22839->22824 22840->22809 22841->22812 22877 10001990 22842->22877 22845 100022c3 SetLastError 22875 100022a9 22845->22875 22846 100022d5 22847 10001990 ___DllMainCRTStartup SetLastError 22846->22847 22848 100022ee 22847->22848 22849 10002310 SetLastError 22848->22849 22850 10002322 22848->22850 22848->22875 22849->22875 22851 10002331 SetLastError 22850->22851 22852 10002343 22850->22852 22851->22875 22853 1000234e SetLastError 22852->22853 22855 10002360 GetNativeSystemInfo 22852->22855 22853->22875 22856 10002414 SetLastError 22855->22856 22857 10002426 VirtualAlloc 22855->22857 22856->22875 22858 10002472 GetProcessHeap HeapAlloc 22857->22858 22859 10002447 VirtualAlloc 22857->22859 22861 100024ac 22858->22861 22862 1000248c VirtualFree SetLastError 22858->22862 22859->22858 22860 10002463 SetLastError 22859->22860 22860->22875 22863 10001990 ___DllMainCRTStartup SetLastError 22861->22863 22862->22875 22864 1000250e 22863->22864 22865 10002512 22864->22865 22866 1000251c VirtualAlloc 22864->22866 22909 10002840 VirtualFree VirtualFree GetProcessHeap HeapFree ___DllMainCRTStartup 22865->22909 22867 1000254b ___DllMainCRTStartup 22866->22867 22880 100019c0 22867->22880 22870 1000257f ___DllMainCRTStartup 22870->22865 22890 10001ff0 22870->22890 22874 100025e8 ___DllMainCRTStartup 22874->22865 22874->22875 22876 1000264f SetLastError 22874->22876 22875->22617 22876->22865 22878 100019ab 22877->22878 22879 1000199f SetLastError 22877->22879 22878->22845 22878->22846 22878->22875 22879->22878 22881 100019f0 22880->22881 22882 10001aa0 ___DllMainCRTStartup 22881->22882 22883 10001a83 22881->22883 22885 10001a2c VirtualAlloc 22881->22885 22882->22870 22884 10001990 ___DllMainCRTStartup SetLastError 22883->22884 22888 10001a9c 22884->22888 22886 10001a50 22885->22886 22887 10001a57 ___DllMainCRTStartup 22885->22887 22886->22882 22887->22881 22888->22882 22889 10001aa4 VirtualAlloc 22888->22889 22889->22882 22891 10002029 IsBadReadPtr 22890->22891 22892 1000201f 22890->22892 22891->22892 22894 10002053 22891->22894 22892->22865 22903 10001cb0 22892->22903 22894->22892 22895 10002085 SetLastError 22894->22895 22896 10002099 22894->22896 22895->22892 22910 100018b0 VirtualQuery VirtualFree VirtualAlloc ___DllMainCRTStartup 22896->22910 22898 100020b3 22899 100020bf SetLastError 22898->22899 22902 100020e9 22898->22902 22899->22892 22901 100021f9 SetLastError 22901->22892 22902->22892 22902->22901 22906 10001cf8 ___DllMainCRTStartup 22903->22906 22904 10001e01 22905 10001b80 ___DllMainCRTStartup 2 API calls 22904->22905 22907 10001ddd 22905->22907 22906->22904 22906->22907 22911 10001b80 22906->22911 22907->22874 22909->22875 22910->22898 22912 10001b92 22911->22912 22913 10001b9c 22911->22913 22912->22906 22914 10001c04 VirtualProtect 22913->22914 22917 10001baa 22913->22917 22914->22912 22916 10001be2 VirtualFree 22916->22912 22917->22912 22917->22916

                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                      Function 100125C0 Relevance: 45.7, APIs: 7, Strings: 19, Instructions: 165memoryCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 10006A90: _malloc.LIBCMT ref: 10006A9C
                                                                                                                                                                                      • _printf.LIBCMT ref: 1001265F
                                                                                                                                                                                      • FindResourceW.KERNELBASE(00000000,00001705,DASHBOARD), ref: 1001268A
                                                                                                                                                                                      • LoadResource.KERNEL32(00000000,00000000), ref: 1001269B
                                                                                                                                                                                      • SizeofResource.KERNEL32(00000000,00000000), ref: 100126AC
                                                                                                                                                                                      • VirtualAllocExNuma.KERNELBASE(000000FF,00000000,00000000,00003000,00000040,00000000), ref: 100127AC
                                                                                                                                                                                      • VirtualAlloc.KERNEL32(00000000,00000000,-100510CC,00000040), ref: 100127D1
                                                                                                                                                                                      • _malloc.LIBCMT ref: 100127F5
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.253348428.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.253342345.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253389308.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253403110.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253409463.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253415369.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Resource$AllocVirtual_malloc$FindLoadNumaSizeof_printf
                                                                                                                                                                                      • String ID: .$.$2$3$6p2Z6a6CZ&M>ZR$a@Y$xnQ?<XBeh<22mz&0$DASHBOARD$d$d$e$kre3.l$l$l$l$l$l$l$l$n$ndldl
                                                                                                                                                                                      • API String ID: 572389289-2839844625
                                                                                                                                                                                      • Opcode ID: adac8d752e0c47dc141f46a7132d7a35c557a18b7d00a43f57a8df52d4076e8d
                                                                                                                                                                                      • Instruction ID: 8f66a7c676ce8d0fa2ca8bd8519024a549b55f77dd79b918ae70bd0eec3b217e
                                                                                                                                                                                      • Opcode Fuzzy Hash: adac8d752e0c47dc141f46a7132d7a35c557a18b7d00a43f57a8df52d4076e8d
                                                                                                                                                                                      • Instruction Fuzzy Hash: FB613EB5D10218EBEB00DFA0DC95B9EBBB5FF08344F10911CE504AB390E7B66548CB6A
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10002280 Relevance: 22.8, APIs: 15, Instructions: 331COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 36 10002280-100022a7 call 10001990 39 100022b0-100022c1 36->39 40 100022a9-100022ab 36->40 42 100022c3-100022d0 SetLastError 39->42 43 100022d5-100022f0 call 10001990 39->43 41 1000269a-1000269d 40->41 42->41 46 100022f2-100022f4 43->46 47 100022f9-1000230e 43->47 46->41 48 10002310-1000231d SetLastError 47->48 49 10002322-1000232f 47->49 48->41 50 10002331-1000233e SetLastError 49->50 51 10002343-1000234c 49->51 50->41 52 10002360-10002381 51->52 53 1000234e-1000235b SetLastError 51->53 54 10002395-1000239f 52->54 53->41 55 100023a1-100023a8 54->55 56 100023d7-10002412 GetNativeSystemInfo 54->56 57 100023b8-100023c4 55->57 58 100023aa-100023b6 55->58 59 10002414-10002421 SetLastError 56->59 60 10002426-10002445 VirtualAlloc 56->60 61 100023c7-100023cd 57->61 58->61 59->41 62 10002472-1000248a GetProcessHeap HeapAlloc 60->62 63 10002447-10002461 VirtualAlloc 60->63 64 100023d5 61->64 65 100023cf-100023d2 61->65 67 100024ac-10002510 call 10001990 62->67 68 1000248c-100024a7 VirtualFree SetLastError 62->68 63->62 66 10002463-1000246d SetLastError 63->66 64->54 65->64 66->41 72 10002512 67->72 73 1000251c-10002581 VirtualAlloc call 10001810 call 100019c0 67->73 68->41 74 1000268c-10002698 call 10002840 72->74 81 10002583 73->81 82 1000258d-1000259e 73->82 74->41 81->74 83 100025a0-100025b6 call 10001eb0 82->83 84 100025b8-100025bb 82->84 86 100025c2-100025d0 call 10001ff0 83->86 84->86 90 100025d2 86->90 91 100025dc-100025ea call 10001cb0 86->91 90->74 94 100025f6-10002604 call 10001e30 91->94 95 100025ec 91->95 98 10002606 94->98 99 1000260d-10002616 94->99 95->74 98->74 100 10002618-1000261f 99->100 101 1000267d-10002680 99->101 103 10002621-10002642 100->103 104 1000266a-10002678 100->104 102 10002687-1000268a 101->102 102->41 106 10002646-1000264d 103->106 105 1000267b 104->105 105->102 107 1000265e-10002668 106->107 108 1000264f-1000265a SetLastError 106->108 107->105 108->74
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 10001990: SetLastError.KERNEL32(0000000D,?,?,100022A5,10012839,00000040), ref: 100019A1
                                                                                                                                                                                      • SetLastError.KERNEL32(000000C1,10012839,00000040), ref: 100022C8
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.253348428.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.253342345.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253389308.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253403110.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253409463.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253415369.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ErrorLast
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1452528299-0
                                                                                                                                                                                      • Opcode ID: 0e09b11d72102b2f53da7248ccc42e4e27664b89a2cf1ce4a90d5e07d10becff
                                                                                                                                                                                      • Instruction ID: 346a8eef4056a92d897d0963d9e5b5a8ca828aef95f805bf3d5880fe5d8ad0e4
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0e09b11d72102b2f53da7248ccc42e4e27664b89a2cf1ce4a90d5e07d10becff
                                                                                                                                                                                      • Instruction Fuzzy Hash: 18E14974A00209DFEB48CF94C990AAEB7F6FF88340F208559E905AB359DB75AD42CF50
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10006A90 Relevance: 18.4, APIs: 1, Instructions: 16933COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 109 10006a90-10006aab call 1002f9a6 112 10006ab7-10012570 109->112 113 10006aad-10006ab2 109->113 115 10012584-1001258b 112->115 114 100125b4-100125b8 113->114 116 10012597-1001259b call 1002fa69 115->116 117 1001258d-10012595 115->117 120 100125a0-100125a9 116->120 117->115 121 100125ab-100125ad 120->121 122 100125af 120->122 121->114 122->114
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • _malloc.LIBCMT ref: 10006A9C
                                                                                                                                                                                        • Part of subcall function 1002F9A6: __FF_MSGBANNER.LIBCMT ref: 1002F9C9
                                                                                                                                                                                        • Part of subcall function 1002F9A6: __NMSG_WRITE.LIBCMT ref: 1002F9D0
                                                                                                                                                                                        • Part of subcall function 1002F9A6: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,1003580D,?,00000001,00000001,10035A23,00000018,10050CC8,0000000C,10035AB2,00000001), ref: 1002FA1E
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.253348428.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.253342345.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253389308.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253403110.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253409463.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253415369.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AllocateHeap_malloc
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 501242067-0
                                                                                                                                                                                      • Opcode ID: ab67eba576b62ed2242e6049fa4a9f00a0283ae289beaf397465af8560d1c9fc
                                                                                                                                                                                      • Instruction ID: 7622b3071c216813c8acba396ad13572c3e9674cac4916c3917d4934f1ce5c91
                                                                                                                                                                                      • Opcode Fuzzy Hash: ab67eba576b62ed2242e6049fa4a9f00a0283ae289beaf397465af8560d1c9fc
                                                                                                                                                                                      • Instruction Fuzzy Hash: BF844072D0002ECFCF08DFECCA959EEFBB5FF68204B169259D425BB294C6356A11CA54
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002083B Relevance: 16.6, APIs: 11, Instructions: 103memoryCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(100575E0,?,?,?,?,100575C4,10020C7A,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139,00000004), ref: 1002084A
                                                                                                                                                                                      • GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,100575C4,10020C7A,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139), ref: 100208A0
                                                                                                                                                                                      • GlobalHandle.KERNEL32(02D71710), ref: 100208A9
                                                                                                                                                                                      • GlobalUnlock.KERNEL32(00000000,?,?,?,?,100575C4,10020C7A,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139,00000004), ref: 100208B2
                                                                                                                                                                                      • GlobalReAlloc.KERNEL32 ref: 100208C9
                                                                                                                                                                                      • GlobalHandle.KERNEL32(02D71710), ref: 100208DB
                                                                                                                                                                                      • GlobalLock.KERNEL32 ref: 100208E2
                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?,?,?,?,?,100575C4,10020C7A,00000004,1001FA0B,10015B30,1001555B,?,10015D3C,00000004,10015139,00000004), ref: 100208EC
                                                                                                                                                                                      • GlobalLock.KERNEL32 ref: 100208F8
                                                                                                                                                                                      • _memset.LIBCMT ref: 10020911
                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?), ref: 1002093D
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.253348428.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.253342345.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253389308.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253403110.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253409463.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253415369.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock_memset
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 496899490-0
                                                                                                                                                                                      • Opcode ID: 23a5f943a2514d5899e1dc1f035ea6f74369b98ac7016ed06c6f01df95d95d17
                                                                                                                                                                                      • Instruction ID: dc14c853345dee55639cdae2a1fd03b11c2696e398e705256622f09b1856cd91
                                                                                                                                                                                      • Opcode Fuzzy Hash: 23a5f943a2514d5899e1dc1f035ea6f74369b98ac7016ed06c6f01df95d95d17
                                                                                                                                                                                      • Instruction Fuzzy Hash: 08319C75600715AFE324CF24DD88A1AB7EAEB49241B01492AF996C3662EB71F8448B50
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 1002FA69 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __lock.LIBCMT ref: 1002FA87
                                                                                                                                                                                        • Part of subcall function 10035A99: __mtinitlocknum.LIBCMT ref: 10035AAD
                                                                                                                                                                                        • Part of subcall function 10035A99: __amsg_exit.LIBCMT ref: 10035AB9
                                                                                                                                                                                        • Part of subcall function 10035A99: EnterCriticalSection.KERNEL32(00000001,00000001,?,10035387,0000000D,10050C60,00000008,10035479,00000001,?,?,00000001,?,?,10030C69,00000001), ref: 10035AC1
                                                                                                                                                                                      • ___sbh_find_block.LIBCMT ref: 1002FA92
                                                                                                                                                                                      • ___sbh_free_block.LIBCMT ref: 1002FAA1
                                                                                                                                                                                      • RtlFreeHeap.NTDLL(00000000,?,10050988,0000000C,100352DD,00000000,?,1003580D,?,00000001,00000001,10035A23,00000018,10050CC8,0000000C,10035AB2), ref: 1002FAD1
                                                                                                                                                                                      • GetLastError.KERNEL32(?,1003580D,?,00000001,00000001,10035A23,00000018,10050CC8,0000000C,10035AB2,00000001,00000001,?,10035387,0000000D,10050C60), ref: 1002FAE2
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.253348428.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.253342345.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253389308.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253403110.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253409463.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253415369.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2714421763-0
                                                                                                                                                                                      • Opcode ID: dc462893557a6a2c1efb59ab9fc79b5cbceadcecec0e23dee2ff352f2dee75c2
                                                                                                                                                                                      • Instruction ID: c59143bfe651e608972d8f734a12067a167937505bca417355bd9d82aad263b9
                                                                                                                                                                                      • Opcode Fuzzy Hash: dc462893557a6a2c1efb59ab9fc79b5cbceadcecec0e23dee2ff352f2dee75c2
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3D012BB5904316AEEB11DFB0EC05B9D7BB4EF013D2F50412DF008AE091DB35A840DB92
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 10036624 Relevance: 3.0, APIs: 2, Instructions: 28memoryCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 188 10036624-10036642 HeapCreate 189 10036647-10036654 call 100365c9 188->189 190 10036644-10036646 188->190 193 10036656-10036663 call 10035aca 189->193 194 1003667a-1003667d 189->194 193->194 197 10036665-10036678 HeapDestroy 193->197 197->190
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • HeapCreate.KERNELBASE(00000000,00001000,00000000,10030AEB,00000001,?,?,00000001,?,?,10030C69,00000001,?,?,10050A28,0000000C), ref: 10036635
                                                                                                                                                                                      • HeapDestroy.KERNEL32(?,?,00000001,?,?,10030C69,00000001,?,?,10050A28,0000000C,10030D23,?), ref: 1003666B
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.253348428.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.253342345.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253389308.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253403110.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253409463.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253415369.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Heap$CreateDestroy
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3296620671-0
                                                                                                                                                                                      • Opcode ID: d3c419273cfe47b5decc93e2e70dd510a49122bb40b3ad2795d27682d43cbdf9
                                                                                                                                                                                      • Instruction ID: 5adf962be877c1470e25a5b203e63be93066c2f5666ac54c72bc9e0dfe65a95a
                                                                                                                                                                                      • Opcode Fuzzy Hash: d3c419273cfe47b5decc93e2e70dd510a49122bb40b3ad2795d27682d43cbdf9
                                                                                                                                                                                      • Instruction Fuzzy Hash: 22E06D706103519EFB139B30CE8A33539F8FB5878BF008869F405C80A0FBA08840AA15
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                      Function 100019C0 Relevance: 2.6, APIs: 2, Instructions: 115memoryCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 198 100019c0-100019ee 199 10001a02-10001a0e 198->199 200 10001a14-10001a1b 199->200 201 10001b06 199->201 203 10001a83-10001a9e call 10001990 200->203 204 10001a1d-10001a2a 200->204 202 10001b0b-10001b0e 201->202 213 10001aa0-10001aa2 203->213 214 10001aa4-10001ac9 VirtualAlloc 203->214 206 10001a2c-10001a4e VirtualAlloc 204->206 207 10001a7e 204->207 208 10001a50-10001a52 206->208 209 10001a57-10001a7b call 100017c0 206->209 207->199 208->202 209->207 213->202 216 10001acb-10001acd 214->216 217 10001acf-10001afe call 10001810 214->217 216->202 217->201
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • VirtualAlloc.KERNEL32(4D8B0000,00000000,00001000,00000004,?,1000257F,00000000), ref: 10001A41
                                                                                                                                                                                      • VirtualAlloc.KERNELBASE(4D8B0000,8B118BBC,00001000,00000004,10012839,8B118BBC,?,1000257F,00000000,10012839,?), ref: 10001ABC
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000003.00000002.253348428.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                      • Associated: 00000003.00000002.253342345.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253389308.0000000010046000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253403110.0000000010053000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253409463.0000000010057000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000003.00000002.253415369.000000001005A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd
                                                                                                                                                                                      Yara matches
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AllocVirtual
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 4275171209-0
                                                                                                                                                                                      • Opcode ID: 095274eb58cefc7da223eb8c3e93af1acb0495bf3fbc764276b25f8f0a8074d8
                                                                                                                                                                                      • Instruction ID: bcee95509f27266f5ca249dd7f6d6a0ca5035efccc592cd1fda7edfbe35d51d4
                                                                                                                                                                                      • Opcode Fuzzy Hash: 095274eb58cefc7da223eb8c3e93af1acb0495bf3fbc764276b25f8f0a8074d8
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0D51D9B4A0010AEFDB04CF94C991AAEB7F5FF48344F248599E905AB345D770EE91CBA1
                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                      Uniqueness Score: -1.00%